Role-based access control (RBAC) limitations

Preview

This feature is in Public Preview.

This page lists the features and behaviors that do not work, or work only partially, when acting as a role. Features not listed here behave the same when acting as a role as they do when acting as your user identity.

For how identity-related SQL functions (current_user(), is_member, is_account_group_member) behave when assuming a role, see How identity functions behave when assuming a role.

Unsupported and partially supported features

The following features either do not work or behave differently when acting as a role:

• Agent Bricks: creating agents as a role is not supported.
• Alerts: managing alerts as a role is not supported.
• Apps: Connecting to an app works. An app can authorize as its own service principal or, when a user connects, as a role that user has permission to assume. An app's service principal cannot yet assume a role for programmatic (machine-to-machine) data access.
• Lineage: the system.access.table_lineage.created_by column is correctly populated with the role, but the user who assumed the role is not captured.
• Pipelines: Lakeflow pipelines are not supported for roles.
• Vector Search: managing Vector Search endpoints as a role is supported, but creating indexes as a role fails. As a workaround, create the index as a user and then change the owner to a role. Querying vector endpoints and indexes as a role is captured correctly in audit events.

Identity and group management

• The workspace SCIM API (/api/2.0/preview/scim/v2) does not support creating or managing groups. Use the Account SCIM API (/api/2.1/accounts/{account-id}/scim/v2/) or the Workspace Account SCIM API (/api/2.0/account/scim/v2/) instead.