Integrations — Warehouses
NerveStax and Snowflake
Agents build and test models on Snowflake, then hand you a pull request.
What we do
What NerveStax does with Snowflake
Point a project at Snowflake and agents build and test its dbt models on a development target from inside a sandbox, read schemas, tables and run history, and check the project against what is really in the warehouse. Credentials are stored encrypted. Every code change arrives as a pull request a person approves.
-
Builds and tests models on a dev target
dbt run, test and build execute in the sandbox against the target the project configures. On a protected project each one stops for approval before it touches the warehouse.
-
Reads schemas, tables and columns
Agents list databases, schemas and tables, read column types and row counts, and use that instead of guessing what a model can select from.
-
Profiles and samples a table
When an agent profiles or samples a table, the rows it retrieves go to your model provider under your key. Result rows are not masked, so treat sampling as you would any query.
-
Finds drift against the project
The catalog from a dbt run is compared with the project, so a model whose warehouse shape no longer matches what the code says is visible rather than discovered at 3am.
-
Write SQL waits for a person
Read queries run freely. Anything that is not a read against a source connection is treated as a write and stops for approval before it executes.
-
Credentials stay encrypted
Account, user and key are stored with AES-256-GCM, referenced by handle, redacted from logs and from everything the model reads, and no screen shows them back.
Background
About Snowflake
Snowflake is a hosted cloud data warehouse. Teams model in it with dbt and schedule those builds with an orchestrator; databases, schemas and tables are its three levels of naming.
How it connects
What connecting it looks like
-
01
Create a warehouse user
We recommend a user for NerveStax limited to the databases and schemas the project builds into, rather than an account with broad rights.
-
02
Add the connection
Add the account, user and credentials in settings. They are stored encrypted, and can be replaced but never read back.
-
03
Point a project at it
Give the dbt project the target it should build into. That development target is where agent work is tested before you see it.
-
04
Mark production projects protected
Protection makes every dbt command on that project wait for a person's approval, with the command, selector and target shown.
Scope
What this does not cover
- There is no separate least-privilege identity for agent runs — an agent uses the credentials on the project, which is why the user you create matters.
- Warehouse cost monitoring is not built.
Questions
Snowflake and NerveStax
Q01Does NerveStax run against production Snowflake?+
Not without a person. dbt commands run in a sandbox against the target the project configures, normally a development one, and on a project you mark as protected every dbt run, test and build waits for approval. Code reaches production only through a pull request your team merges.
Q02Do my table rows go to the model provider?+
Only when an agent queries, samples or profiles a table — then the rows it retrieves are in the answer it reads, capped per call and not masked. Those calls go to the model provider you chose, under your own key. Schemas, column names, dbt artifacts and run results are what it works from the rest of the time.
Q03What permissions should the Snowflake user have?+
Enough to build the project's models into its development target and to read the schemas it models from, and no more. There is no separate identity for agent runs, so the connection you configure is exactly what an agent can reach. A read-only role plus write on the development schemas is a reasonable starting point.
Q04Can it reach a Snowflake account behind network policies?+
It has to be reachable from wherever the sandbox runs. On hosted NerveStax that is the sandbox provider's network; self-host and run the sandbox tier in your own cluster and connections come from your network instead, which is the usual answer for a locked-down account.
Q05Does it watch Snowflake spend?+
No. Cost monitoring and query-spend alerting are not built. What NerveStax keeps is the record of models, tests, runs, lineage and freshness, and the triage of alerts your platform sends it.