Connect Snowflake to Saemi

Saemi runs your questions against Snowflake using SQL-standard user credentials. Setup takes about three minutes.

Before you start

You need:

• A Snowflake account identifier (e.g. abc12345.us-east-1 or xy67890.snowflakecomputing.com)
• A warehouse Saemi can resume (X-Small is plenty for typical question loads)
• A role with read access on the databases you want Saemi to query
• A user with that role + password (or key-pair) auth

We recommend creating a dedicated Saemi user rather than reusing a personal account — that way you can audit Saemi-issued queries separately and rotate credentials without disrupting humans.

Step 1 — Create a Saemi user (recommended)

Run in a Snowflake worksheet:

-- Role with read-only access to the data you want Saemi to see
CREATE ROLE saemi_reader;
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE saemi_reader;
GRANT USAGE ON DATABASE analytics TO ROLE saemi_reader;
GRANT USAGE ON SCHEMA analytics.public TO ROLE saemi_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics.public TO ROLE saemi_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA analytics.public TO ROLE saemi_reader;

-- Dedicated user
CREATE USER saemi_bot
    PASSWORD = 'replace-with-a-strong-password'
    DEFAULT_ROLE = saemi_reader
    DEFAULT_WAREHOUSE = compute_wh
    MUST_CHANGE_PASSWORD = FALSE;
GRANT ROLE saemi_reader TO USER saemi_bot;

Step 2 — Connect in Saemi

1. Open /accounts/connector/ in Saemi
2. Click Snowflake → Connect
3. Fill in:
   - Account — abc12345.us-east-1 form (without snowflakecomputing.com)
   - Warehouse — compute_wh
   - Database — analytics (optional, scopes the schema scan)
   - Username — saemi_bot
   - Password — what you set above
   - Role — saemi_reader (optional but recommended — locks Saemi to read-only)
4. Click Test connection — Saemi runs SELECT 1 against your warehouse
5. Click Save

After save, Saemi will:

1. List visible tables (filtered by your role's grants)
2. Pick the top tables by inbound foreign-key count
3. Generate an ERD as a wiki page
4. Draft five starter questions

The whole post-save flow takes 30-90 seconds.

Costs

Saemi only spins your warehouse up when you ask a question. With auto-suspend at the default 600 seconds, expect a few warehouse-minutes per active hour. A team of 10 typically sees <$30/month of incremental warehouse cost from Saemi.

Troubleshooting

"Cannot perform query — no warehouse selected" — set the Warehouse field. Snowflake won't run anything without one.

"Insufficient privileges to operate on schema X" — your saemi_reader role lacks USAGE on that schema. Grant it (GRANT USAGE ON SCHEMA db.schema TO ROLE saemi_reader).

"User must change password" — set MUST_CHANGE_PASSWORD = FALSE (or log in as that user once and change it manually).

Key-pair auth — Saemi currently uses password auth. Key-pair support is on the roadmap; ping us if you need it sooner.

What Saemi sees

Saemi can read every table the connection role can SELECT on. If you have PII tables you don't want the LLM to touch, scope the role accordingly — Saemi can't see what it can't query.