How to Use Snowflake AI Agents: A Practical Walkthrough

Why Enterprises Are Moving Agents Into Snowflake (And the Gaps They Hit)

The agents that wow a conference audience rarely survive their first month in production. The reason is almost always the same: the agent works beautifully on a demo dataset, then collapses the moment it has to touch the real, governed data behind the firewall.

Snowflake has bet its platform on solving exactly that problem. The company has pivoted from data warehouse to AI Data Cloud, embedding Claude models directly inside Cortex AI so enterprises can run agents against governed data without copying sensitive records outside the platform. Adoption has followed: more than 1,000 Snowflake customers deployed over 15,000 AI agents in the three months ending October 24, 2025, and Snowflake Intelligence became generally available on November 6, 2025.

Yet scale exposes a second problem the demos never show. Once an enterprise moves past a handful of agents, each new bot needs its own list of tools and its own instruction set. Large deployments "can easily accumulate dozens of tools," with an agent potentially spending "tens of thousands of tokens loading tool definitions into context" before answering, according to Snowflake's enterprise-scale engineering blog. Update one capability and you must update every agent that references it. The Stanford GSB 2026 case study on Snowflake calls this the "pilot-to-production gap," and frames it as the central adoption challenge for enterprise agentic AI.

The practical pain points fall into a familiar pattern:

• Data access. Agents that cannot read governed tables produce answers no business user trusts.
• Tool sprawl. Dozens of inline tool definitions bloat context windows and slow inference.
• Drift. Capability updates must be re-applied to every agent individually.
• Governance. Without inherited permissions, agents become a new attack surface rather than a productivity win.

That is the gap Cortex Agents and the emerging skill-pack model are designed to close: a shared capability layer, referenced once and propagated everywhere, running inside the same identity and permission boundary as the rest of the warehouse. The rest of this walkthrough shows how to build on top of it.

For teams assembling agent skills across multiple stacks, SkillzBench is building a free skills directory and MCP connector to discover, verify, and benchmark agent skills before they reach production.

The Snowflake Agent Stack: Cortex Agents, Skills, and Skill Packs Explained

Snowflake's agent stack has quietly grown into three distinct layers, and knowing which one you're actually building on changes everything about how you work with it. The company has repositioned from data warehouse to AI Data Cloud, reaching a $100 million AI revenue run rate ahead of schedule by Q3 FY26 — with agents as the centerpiece of that pivot.

At the top sits Snowflake Intelligence, a generally available enterprise intelligence agent aimed at every employee, not just engineers. Beneath it, Cortex Agents gives developers a managed platform for building data agents that plan tasks, use tools, and generate responses from structured and unstructured data alike. Claude models run as the model layer inside Cortex — embedded directly so agents operate on governed data without it leaving Snowflake. Supported GA models include claude-opus-5, claude-sonnet-5, and claude-haiku-4-5, alongside OpenAI and Gemini options.

The concept most readers come looking for — "skill packs" — maps to two separate things, and the distinction matters:

• Agent skills: packaged, modular bundles of instructions and scripts that give an agent repeatable, task-specific capabilities. These function as a tool type today.
• Skills Package: an announced capability (public preview soon) that lets teams define a curated skill set once and reference the whole collection in any agent specification with a single URI, with updates propagating automatically to every referencing agent.
• Related scale features include Agent Toolsets, Tool Search for progressive disclosure of tool definitions, and a Versioning UI for comparing and rolling back agent configurations.

Here's the caveat worth repeating: most of these scale-operating features are announced as "public preview soon" or "GA soon" and remain subject to change. Treat them as roadmap, not shipped functionality. Snowflake's own documentation also cautions that LLM response accuracy and citations are not guaranteed, and that all agent answers should be reviewed before serving them to users.

That gap between announcement and availability is precisely where capability sprawl begins — and where discovery, verification, and benchmarking of agent skills becomes its own discipline. SkillzBench is building a free directory and MCP connector to help teams sort proven skills from risky ones, since published research found roughly 26% of skills carry at least one vulnerability.

Building Your First Agent: The Five-Step Lifecycle

Most agents fail not because the model is weak, but because nobody scoped them properly before building. Snowflake's official Cortex Agents documentation lays out a five-step lifecycle that keeps you from boiling the ocean — and it starts before you touch a single tool.

Step 1: Scope with the "top 20 questions." Snowflake's best-practices guide is blunt: "Don't boil the ocean with a generalist agent. Start narrow with a specific, high-value use case." The recommended method is to partner with business stakeholders and identify the top 20 questions they need answered, then use those as the agent's initial scope. This exercise forces clarity on tools, data, and success criteria before any build effort.

Step 2: Create the agent. You can create a Cortex Agent through Snowsight, SQL, or the REST API. You can even experiment by calling agent:run directly with configuration passed per request, before committing to a persistent agent object. Supported GA models include Anthropic's Claude family, OpenAI's GPT models, and Google's Gemini; Snowflake recommends selecting auto, which picks the highest-quality model for your account.

Step 3: Add tools — and write instructions in four separate layers. Every agent combines four instruction types, and Snowflake recommends keeping them in distinct settings rather than one giant prompt:

• Semantic views — "cheat sheets" between raw data and how the AI interprets it
• Orchestration instructions — business logic and tool selection
• Response instructions — format and tone
• Tool descriptions — which Snowflake calls "the most critical factor for accurate tool selection"

Sloppy or incomplete instructions, the guide warns, lead to missteps in reasoning, incorrect data retrieval, and wasted compute cost. An agent should have exactly as many tools as its targeted purpose requires — no more.

Step 4: Test in the Snowsight playground, then integrate. Test conversations in Snowsight first, then wire the agent into applications via the agent:run REST API. One caveat from Snowflake's own docs: the accuracy of LLM responses and citations is not guaranteed, so review all answers before serving them to users.

Step 5: Monitor and iterate. Use per-agent orchestration budgets, resource budgets, and per-user AI credit quotas to control spend, and lean on the versioning UI (public preview) to compare and roll back configurations. The scale problem is real — large deployments can accumulate dozens of tools, with an agent potentially spending tens of thousands of tokens loading tool definitions before answering anything.

The same discipline applies to agent skills generally: packaged, reusable instructions are only as good as their verification. That's the gap SkillzBench is building toward — a free directory and MCP connector for discovering, security-scanning, and benchmarking skills across any agent stack.

Governance, Cost Control, and the Review-Your-Outputs Rule

An agent that can only see what you can see — that's the design principle that makes Snowflake's agents safe to run on governed data. Agents inherit the logged-in user's identity, default role, and default warehouse, and per Snowflake's security and governance practices, neither agents nor Snowflake Intelligence can perform any action beyond the logged-in user's permissions.

That inheritance model matters when you connect an agent to sensitive tables. Cortex Analyst can generate only SELECT queries and executes within the user's security context, so an agent answering a question can't touch data its human operator couldn't reach anyway. Calling an agent also requires the SNOWFLAKE.CORTEX_USER or SNOWFLAKE.CORTEX_AGENT_USER roles, plus privileges on the agent and tool objects themselves, according to the official Cortex Agents documentation.

Governance pairs with cost control in the same configuration. Agents run reasoning loops that consume tokens on every turn, and Snowflake gives you explicit levers to cap that spend:

• Per-agent orchestration budgets that limit how much compute a single agent can consume
• Resource budgets set at the account or object level
• Per-user AI credit quotas that contain runaway usage from any individual

These controls matter at scale. Snowflake notes that large deployments can easily accumulate dozens of tools, with an agent potentially spending tens of thousands of tokens loading tool definitions into context before answering — costs that better prompting alone won't fix. Setting a budget before you deploy keeps a misbehaving agent from becoming a compute incident.

The last safeguard is behavioral, not technical. Snowflake's own documentation carries a blunt warning: the accuracy of LLM responses or the citations provided is not guaranteed, and you should review all answers from the Agents API before serving them to your users. Snowflake's Agent GPA (Goal, Plan, Action) evaluation framework catches up to 95% of errors on standard datasets, which helps — but it's a monitoring aid, not a substitute for human review.

For teams assembling agent capabilities from the broader ecosystem, the same review discipline applies to the skills and tools you load into an agent. Published research found roughly 26% of agent skills carry at least one vulnerability, which is why SkillzBench is building a free directory that security-scans, license-checks, and benchmarks every skill before you attach it via MCP. Governance inside Snowflake plus verified skills outside it is the combination that makes agents production-ready rather than pilot-ready. Snowflake's security leaders put it well: security and governance aren't just safeguards — they're accelerators for responsible AI adoption.

Going Further: Reusable Skills Across Your Whole Agent Stack

Snowflake's skill-pack direction signals where enterprise agents are heading: instead of rebuilding capabilities for every new agent, teams define them once and reuse them everywhere. The Skills Package capability, announced as public preview soon, lets teams reference an entire curated collection in any agent specification with a single URI — and updates propagate automatically to every referencing agent.

That reuse layer matters because scale breaks naive designs. Large deployments easily accumulate dozens of tools, and an agent can spend tens of thousands of tokens loading tool definitions into context before it answers a single question.

Snowflake also connects outward through MCP. Cortex Agents support MCP connectors for Atlassian Jira and Salesforce, and Snowflake positions its managed MCP Server as a secure, standardized bridge to external agents like Anthropic, Cursor, and Salesforce's Agentforce.

The same openness that makes skills and MCP valuable also makes them risky. Published research cited by SkillzBench found that roughly 26% of agent skills carry at least one vulnerability — and skills are now everywhere, from Claude Code and Codex to Cursor, Gemini CLI, and chat-app agents. A reusable capability layer is only as safe as the capabilities flowing into it.

SkillzBench is AIQ Labs' free, independent answer to that problem, currently in development. Its planned pillars:

• Discover — continuously crawl and dedupe agent skills from GitHub into one directory.
• Verify — pin every version to a commit SHA, then validate, license-check, security-scan, and quality-judge it.
• Benchmark — test each skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points.
• Equip — one free MCP connector plus per-agent loadouts, so each agent sees only the skills and tools you toggle on.
• Stay current — track upstream changes, re-scan, re-benchmark, and notify you.

A trust score from 0 to 100 combines security, quality, license, maintenance, and community signals, while Lift stays separate from ratings and money never touches scores. The directory, MCP connector, benchmarks, and alerts are all free.