Introduction

UnifyApps connects to Snowflake and returns the agents that account hosts, so they can be inventoried, monitored and brought under policy alongside every other platform you run.

Snowflake connections support both registries: agents are swept into the Agent Registry, and models served through the connection can be imported into the Model Registry.

What UnifyApps discovers

Discovery reads the platform's own APIs through a connection your tenant already holds. Each agent it returns becomes a record in the Agent Registry, and the traces those agents produce are collected from that point on.

Capability support

Note: You do not instrument a discovered agent. Its traces arrive through the connection — there is no SDK step and nothing to install. A discovered agent shows Setup Pending until its first trace lands, which usually means it simply has not run yet, not that you owe it work. Give it real usage and it flips to Active on its own. While it is pending, the agent detail page still shows a Setup tab carrying SDK and OTLP instructions. On a discovered agent those do not apply — the tab appears for anything awaiting a first trace, however it was registered. See Agent Statuses.

Before you begin

1. Create the connection first — Discovery sweeps a connection your tenant already holds. It does not collect credentials. See Create a Connection.

2. Know which account or environment you are scanning — One connection covers one. Separate production and test environments need one connection each.

3. Agree the identity's scope — Discovery sees exactly what the connection identity can list. A narrow identity produces an inventory that looks complete and is not.

4. Grant the connection role access — Grant CORTEX_USER and USAGE on the database, schema, warehouse and each agent to the connection's role. The role cannot be ACCOUNTADMIN, SECURITYADMIN or ORGADMIN. The Setup tab includes SQL to verify access.

Add the connection

Step 1: Open + Add Application in Discovery

Step 2: Select Snowflake

Step 3: Confirm Observe · Advisory

It is preselected and is the only tier available for this platform.

Step 4: Choose the connection and click Connect

Verify

The new row shows PLATFORM as Snowflake and STATUS as Connected. DISCOVERED populates once the first sweep completes.

Open the connection to see its Assets table. Everything arrives Excluded — discovered but not governed — until you register it. See Register Discovered Agents.

Limitations

1. Observation only — Controls set to Block or Mask cannot take effect on this connection. Flag works as documented and every violation is recorded as an incident.

2. Coverage stops at the connection's permissions — Assets the identity cannot list will not appear, and their absence is not reported.

3. Models are imported, not swept — Use + Add Model and pick from the connection catalogue.

Troubleshooting

The sweep completed but DISCOVERED is empty. Either the account genuinely hosts none, or the connection identity cannot list them. Check the second before concluding the first.

Fewer assets than the platform's own console shows. Scope. Confirm the connection covers the whole boundary you intend to govern.

Assets appear but never accumulate traces. Check LAST TRACE against known usage before treating it as a telemetry fault.

A Block control never blocks. Expected on an advisory connection. See Connection Types.