How we structure Snowflake RBAC as code (four-layer pattern, no direct user grants) : r/dataanalytics