How to set up role-based access to the brain
Ticketclosed
Brenneck Pay: documents · How to set up role-based access to the brain
Jonas Albrecht asked how to map internal roles to the brain's access model. Support guided role creation in Snowflake and confirmed SSO users inherit role assignments automatically.
What happened
What this says
Current to 12 Oct 26Jonas Albrecht asked how to map internal roles to the brain's access model. Support guided role creation in Snowflake and confirmed SSO users inherit role assignments automatically.
Problem: During onboarding, Jonas needed guidance on configuring role-based access for four teams so each team saw only relevant data. The setup guide did not clarify internal role mapping.
Handling: Olivia Grant explained that the brain runs inside the customer's Snowflake and uses Snowflake's native role and grant syntax. Jonas created a test role, granted read access to base tables, and verified access by 4 Mar 2026. He then asked about SSO role inheritance, which Olivia confirmed is handled entirely by Snowflake's identity integration. First response took 350 minutes.
Watch: First response time of 350 minutes is slow for onboarding. Faster initial response would improve new customer experience.
Details
Updated 9 Oct 26Trail
created · Jonas Albrecht 2 Mar 2026 09:08Hi, During onboarding, I'm working on how to configure user access to the brain within Snowflake. We have multiple teams: merchant risk, merchant account management, operations, and I want to make sure they only see data relevant to their role. I've read the setup guide, but I'm not clear on how to map our internal roles to the brain's access model. Can you walk me through it? Jonas- public_reply · Olivia Grant 2 Mar 2026 14:58Hi Jonas, Good question. You're right to set this up early, role-based access matters. The brain runs inside your Snowflake account, so you control all access through Snowflake roles and grants. During onboarding, we create a base set of roles: admin, user, viewer, that map to the brain's functionality. You can then define your own roles on top of those and use standard Snowflake grant syntax to assign them to users. I'd recommend we walk through this on a call so you can see it step by step. Can you find a slot in the next couple of days? Cheers, Olivia
- public_reply · Jonas Albrecht 4 Mar 2026 14:41Thanks. I've now created a test role and used standard grants to give it read access to the base tables. I can see the data in my test queries, which is good. One more question: when SSO users log in, how do they inherit the Snowflake role? Is that something I configure on the brain side, or is it entirely Snowflake's SCIM integration? Jonas
- public_reply · Olivia Grant 4 Mar 2026 16:49Good approach. With SSO users, Snowflake's identity integration handles all the role assignment, you configure it there and the brain respects whatever role they have when they authenticate. Nothing needed on the brain side. Sounds like you've got this covered. Let me know if you hit any issues as you ramp up. Cheers, Olivia
- status_change · 8 Mar 2026 23:59