Snowflake Puts Hard Spend Caps on AI Agents

Snowflake on Nov. 3 made its Cortex AI Gateway generally available with hard spending limits for AI agents and unveiled Business Ontology, a governed layer that tells agents what business terms officially mean. The data cloud company announced the tools at its virtual Expedition 2026 event, with most of the security features still in private preview.

Key takeaways

• Cortex AI Gateway, cost governance, observability and Cortex Inference are generally available; cost governance can enforce hard limits that stop runaway agents.
• Business Ontology, which assigns each business definition an accountable owner, is slated for public preview soon.
• Sandboxes, agent abuse detection, trace analysis and dynamic model routing are in private preview, and an OpenAI safety-signal integration is in development.

What Snowflake Business Ontology does

Business Ontology gives a company one governed place to record what terms such as "net revenue" officially mean. According to Snowflake's announcement, each definition has an accountable owner, is linked to the tables and views that implement it and can cover data inside and outside Snowflake. Every change is logged for audit.

Snowflake describes three layers. The ontology sets the official meaning, a Semantic View calculates it, and a feature called Cortex Sense infers what has not been defined yet. Human-approved definitions take precedence over inferences. Connectors pull metadata from Tableau, Power BI, dbt, SQL Server and PostgreSQL.

Snowflake's own agents, the CoCo coding agent and the CoWork personal work agent, use the approved concepts to ground their answers. "Business Ontology gives every definition an accountable owner, links it to the data that implements it," said Joe Tobey, head of data product engineering at dentsu.

AI agent spending limits and security controls

Cortex AI Gateway is meant to be the single entry point for agents, applying one set of policies across clouds, frameworks and AI providers. Agents inherit the access and permission controls that apply to human users. SiliconANGLE reported that the gateway was first introduced in July.

The generally available cost governance attributes AI spend to users, teams, departments, agents and apps. A Snowflake blog post adds weekly per-user quotas, organization budgets in dollars or credits, and anomaly alerts covering up to 50 custom spend groups per account. "The question we couldn't answer was which teams and which agents were driving the spend," said Andy Owens, vice president of data and AI at ad tech firm Kargo.

Cortex AI Gateway Tools, now in public preview, checks every agent tool call against authorization policies before it runs. Cortex AI Guardrails targets prompt injection and jailbreaks, including for third-party agents. The press release lists Guardrails as coming to public preview soon, while the blog post describes it as in public preview.

In private preview, Cortex Sandboxes run agent code next to company data under the user's permissions, and Agent Abuse Detection reviews full agent trajectories for actions beyond granted permissions. Dynamic Model Routing picks an approved model by cost, accuracy and latency. Snowflake says internal tests showed up to 3x better token efficiency than using only frontier models at the same quality, a claim that could not be independently verified.

Why business context matters for enterprise AI agents

Snowflake cited research it sponsored from MIT Technology Review Insights. In a survey of 400 senior data and technology executives in July and August 2026, 55% named lack of business context as the main cause of low-quality agent insights, and 45% named fragmented or inaccessible data second. All respondents' organizations earn at least $500 million a year.

"An agent that acts on your business has to be trusted," Chief Executive Sridhar Ramaswamy said, according to SiliconANGLE. The outlet framed the launch as part of a race with SAP and Salesforce to control the layer where enterprise agents operate. Snowflake says it has more than 14,500 customers.

What's next

Snowflake did not give dates for the preview features or disclose pricing. It said it was a technical design partner with OpenAI on Private Safety Processing, which would feed privacy-preserving safety signals into the gateway's detection of dangerous agent activity. SiliconANGLE also reported an expanded Oracle partnership to offer Snowflake as a first-party service on Oracle Cloud Infrastructure.

FAQ

Can customers use Business Ontology today?
Not broadly. Snowflake lists it as coming to public preview soon, without a date.

Can Snowflake stop an agent that overspends?
Yes. Its generally available cost governance enforces hard limits and can attribute spend to individual agents and apps.

Does the gateway only cover Snowflake's own agents?
No. Snowflake says it applies across clouds, frameworks and AI providers, and Guardrails covers third-party agents routed through it.

References

• Snowflake Helps Enterprises Deploy AI Agents with Trusted Business Context and Built-In Controls — Snowflake (Nov. 3, 2026)
• Build Trust in AI Agents with Governed Business Context and AI Security — Snowflake Blog (Nov. 3, 2026)
• Snowflake expands agentic AI platform with business context and governance tools — SiliconANGLE (Nov. 3, 2026)