Snowflake launched Cortex AI Gateway on July 28, 2026, a centralized control layer that governs every AI agent touching enterprise data, whether that agent was built inside Snowflake or on an external platform like Anthropic’s Claude Code or Cursor. The announcement positions Snowflake not just as the place where enterprise data lives, but as the platform that decides what AI agents are allowed to do with it and records exactly what they did.
The gateway enters public preview soon. It is the most direct product consequence of Snowflake’s May 2026 acquisition of Natoma Labs, a 27-person startup that built an enterprise MCP gateway enforcing identity, policy, and audit at the individual tool-call level.
The Two Problems Cortex AI Gateway Solves
Enterprise AI agents create two distinct crises that traditional security and finance tools were not built to handle.
The first is governance: agents from different platforms and teams reach across dozens of enterprise systems, operating under standing credentials that were designed for applications with narrow, deterministic behavior. Autonomous agents are different. They initiate sequences of actions, may traverse sensitive data stores mid-workflow, and can interact with tools their original developers never anticipated. Traditional access management has no visibility into what an agent decided to do next.
The second is cost: because agents consume tokens across multiple models and workloads simultaneously, spending grows in ways that are invisible until the bill arrives. There is no native mechanism in most agent frameworks to attribute consumption to a specific team, workflow, or business unit, or to stop an agent that is burning through a budget ceiling.
Snowflake’s official press release frames both as the primary barriers to production-grade agentic AI: “Traditional security architectures were not designed for this level of cross-system agent activity, and organizations often lack a centralized way to govern AI usage.”
Cortex AI Gateway addresses both barriers through a unified control plane rather than separate tools.
What the Gateway Actually Does
Cortex AI Gateway provides four capabilities that work together:
Govern every agent connection. The gateway supports more than 100 MCP servers and centralizes the access policies, authentication, and permissions that determine which models, data sources, applications, and tools each agent is allowed to reach. This applies equally to Snowflake’s own first-party agents (CoWork and CoCo) and to third-party agents built on Claude Code, Cursor, or any other platform. A single policy layer replaces the patchwork of per-system configurations that most enterprises rely on today.
See every agent action. Every agent interaction generates an end-to-end log: which agent initiated the action, which tools and systems it accessed, in what order, and what it returned. This audit trail is centralized, making it available for security investigations, compliance reporting, and retrospective governance reviews without custom instrumentation across individual agents.
Control AI spending. IT and finance teams get a unified view of token consumption across all models, teams, and workloads, attributed to the agents and users driving it. Hard spending limits can be set per agent, per team, or per workload, and the gateway enforces those limits in real time rather than surfacing overages after the fact.
Route to the right model. The gateway intelligently routes each agent request to the most appropriate enterprise-approved model based on a configurable mix of quality, cost, latency, and availability. This gives organizations multi-model flexibility without requiring individual teams to manage their own routing logic.
Dual Attribution: Answering “Whose Action Was It?”
The most novel governance concept in today’s announcement is what Snowflake calls dual attribution, described by Chief Security and Trust Officer Mayank Upadhyay in the VentureBeat coverage of the launch.
When an AI agent takes an action, security teams face a question that standing credential models cannot answer: was this the agent’s action, or the human’s? Cortex AI Gateway answers by logging both: the verified non-human identity of the agent and the specific human who authorized the task. Every action is attributable to the machine that executed it and to the person who delegated it.
The companion principle is task-scoped permissions. Instead of inheriting a user’s full standing access, an agent receives only the permissions required for the specific task at hand, and only for as long as the task is in progress. This closes the most common attack surface in enterprise AI deployments: an agent that inherits broad standing credentials can take actions far outside its intended scope, often without any mechanism to detect or stop it.
Upadhyay described the underlying philosophy in the announcement: “The future of AI won’t be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control.”
The Security Partner Ecosystem
Cortex AI Gateway launches with a first wave of third-party agent access integrations: 1Password, Aembit, Linx Security, Okta Cross App Access (entering private preview in Q4 2026), SailPoint, and Saviynt. SiliconANGLE noted the unusual nature of the coalition: many of these vendors compete with one another for overlapping identity and access management budgets, yet all agreed to build against Snowflake’s common trust framework.
The integrations target a specific governance gap: agents that operate under a user’s broad credentials make it impossible to distinguish which agent accessed which data and under whose authority. The Snowflake partner model addresses this by brokering verified non-human identities at the tool-call level, so every access event carries a clear chain of attribution regardless of which platform the agent was built on.
Alongside the gateway, Snowflake released several additional AI security capabilities, now generally available: tools for assessing an organization’s AI risk posture, mechanisms to give agents a verified non-human identity, and controls for protecting sensitive data from improper use. Controls that limit an agent session strictly to the scope required for its assigned task remain in private preview.
Snowflake reported that both BlackRock and Thomson Reuters are among the enterprises relying on these security foundations as they scale AI deployments.
The Market Context: Why This Had to Happen Now
The timing of this launch is not incidental. The analyst forecasts behind it describe a market moving faster than most enterprise governance teams anticipated.
| Research source | Forecast | Year |
|---|---|---|
| Gartner | 40% of enterprises will demote or decommission AI agents due to governance gaps found after incidents | 2027 |
| IDC | 1 billion+ actively deployed AI agents executing 217 billion actions per day | 2029 |
| IDC | Agentic AI exceeds $1.3 trillion in worldwide IT spending | 2029 |
| Snowflake | Cortex AI Gateway supports 100+ MCP servers at launch | 2026 |
Sources: Gartner, IDC, Snowflake press release
Cortex AI Gateway is not Snowflake’s first move in this direction. The Natoma acquisition in May brought the foundational MCP governance technology. AI guardrails and prompt injection protection came earlier in 2026. The gateway represents the point at which those individual investments converge into a unified product positioned to govern the agentic enterprise at scale.
The competitive landscape makes the move urgent. Salesforce, ServiceNow, Microsoft, and Google are all converging on the same runtime governance chokepoint: the layer that decides what an agent may touch and records what it did. Snowflake’s differentiating claim is proximity to the data itself. As Upadhyay described it, security for agents “can’t just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data.”
What This Means for Enterprise AI Builders
For teams deploying AI agents, Cortex AI Gateway introduces a governance pattern that most organizations will eventually need regardless of vendor: a centralized control plane that separates what an agent can access from what a user can access, attributes every action to both the agent and the human who authorized it, and enforces spending limits in real time.
The MCP-native architecture is significant. MCP has become the de facto standard for wiring agents to enterprise tools, and a gateway that centralizes governance at the MCP layer can apply consistent controls regardless of which agent framework, model provider, or downstream application is involved. This is the same design philosophy behind the Agentic Resource Discovery standard that Google and Microsoft have been advancing, and it addresses the same root problem: enterprises need to govern agents uniformly across a heterogeneous stack that no single vendor controls.
The cost attribution capability deserves attention on its own merits. Token spending across a multi-agent, multi-model enterprise stack can compound in ways that are nearly impossible to audit without a centralized aggregation layer. Snowflake’s ability to attribute that consumption to specific agents, teams, and workloads, and to enforce hard limits before overruns occur, addresses a pain point that finance and IT leadership will recognize immediately, even if they have not yet quantified it.
For organizations that are already standardized on Snowflake for data governance, the gateway offers a path to extend the same policy and audit model they already use for data access into the layer where agents act on that data. The governance is not separate from the data platform: it is the same platform, extended one layer up the stack.
What to Watch
Cortex AI Gateway enters public preview “soon,” with no firm date announced. The more meaningful milestones to track are:
Partner integration depth. The Okta Cross App Access integration arrives in Q4 2026. Whether the other partners (1Password, SailPoint, Saviynt, Aembit, Linx Security) build deep bidirectional integrations or remain at the level of initial connectors will determine how useful the dual attribution model is in practice.
Third-party agent adoption. Cortex AI Gateway governs Claude Code and Cursor agents today. Whether development teams on non-Snowflake stacks route their agents through the gateway voluntarily, or whether this remains primarily a Snowflake-native governance layer, will define its actual market footprint.
The MCP governance race. Snowflake is not alone. Neo Security raised $100M to build an agentic control layer. Hush Security’s $30M round funds just-in-time permissions and agent registries. The category of enterprise AI agent governance is being built simultaneously by several well-funded companies, and the first to achieve broad cross-platform coverage will define how the governance layer works for the rest of the decade.
Snowflake’s advantage is data proximity. Its disadvantage is potential vendor lock-in perception for enterprises that want MCP governance that is genuinely platform-agnostic. How that tension resolves will determine whether Cortex AI Gateway becomes the enterprise standard or one of several competing control planes.
The one thing that is clear: the era of deploying agents without a centralized governance layer is ending. Gartner’s 40 percent decommission prediction is already driving board-level conversations. Snowflake has now put a product in front of that demand, built on technology that was purpose-designed for exactly this problem.