RBAC as code pattern for Snowflake (role hierarchy + future grants)

Sharing a pattern for managing Snowflake RBAC as code that's saves orgs from permission drift.

Quick summary:

• Four-layer role hierarchy: object roles → composite roles → functional roles → users. Never grant straight to a user.
• Use future grants on schemas/tables/views. Skipping this means every new object needs a manual grant, which is exactly how things drift.
• Deployment/service account needs privileges covering every resource type in the config. Don't use a built-in admin role past the sandbox stage.
• Plan before apply, always. A wrong grant is a security issue, not just a cost issue.

We use an open source tool we built (Snowcap) for the YAML/plan/apply workflow, but wanted to share the pattern itself since it's useful regardless of tooling.

Writeup: https://datacoves.com/post/snowcap-snowflake-rbac-as-code