Governed Data Goes to Work
Summit wasn't more AI in the data cloud. It was Snowflake arguing that agents only become real when they can operate against trusted data, business context, identity, and secure action — and positioning governed data as the place that work safely runs.
The real story from Snowflake Summit is not that Snowflake announced more AI features. It is that Snowflake is trying to make governed enterprise data the work layer for agentic AI. That is a much bigger move than "AI inside the data cloud." Snowflake is arguing that enterprise AI only becomes real when agents can operate against trusted data, business context, permissions, identity, governance, and secure connections to the systems where work actually happens.
The theme was "Making AI Real for Business" — and it was not subtle. Snowflake is positioning against AI theater. The message is not "look what agents might do someday." It is: agents are already moving into production, and the enterprise bottleneck is not model capability. It is context, trust, security, identity, and control. That is Snowflake's lane.
It is no longer whether Snowflake is a better data warehouse. It is whether Snowflake becomes the governed action layer for enterprise agents. We think that is the bet.
A Related But Distinct Move From the Data Layer
If Apple is turning the consumer OS into an agent runtime, Microsoft is packaging the enterprise agent stack as the product, Figma is making the canvas a production runtime, Vercel is turning deployment into agentic infrastructure, Cannes showed advertising becoming agentic media infrastructure, Adobe is turning the customer lifecycle into an agentic operating system, and Databricks is turning enterprise data into the agentic control plane, Snowflake is making a related but distinct move: making governed data the place where agentic work becomes safe enough to run.
Enterprise agents don't fail only because they lack intelligence. They fail because they lack trusted context, scoped access, secure tool use, reliable identity, and auditability. A fluent answer is not enough.
- What the business means.
- What it can access.
- Which tool it is allowed to call.
- Whose authority it is acting under.
- That it leaves an audit trail.
From Data Cloud to Agentic Enterprise Platform
Snowflake is still anchored in governed data — that remains the moat. But Summit 2026 made clear it no longer wants to stop at storage, analytics, and AI-assisted querying. The new story is broader: business context, semantic meaning, agent identity, tool governance, secure MCP connectivity, coding agents, work agents, streaming, Postgres, Iceberg, open semantics, enterprise controls, agent security, external system access, automation. That is Snowflake redrawing the boundary around what belongs inside the data platform.
CoWork and CoCo Are Two Surfaces, One Truth System
The two major rebrands were not cosmetic. Snowflake Intelligence became CoWork; Cortex Code became CoCo. That signals a two-persona architecture — Snowflake is not trying to make one assistant do everything. It is creating two work surfaces over the same governed context layer.
Under both sits the same strategic layer: Horizon Context, Cortex Sense, Horizon Catalog, permissions, metadata, identity, semantics, governance. The agent interface changes by persona. The governed context layer remains the common foundation.
Cortex Sense Attacks the Real Reason Agents Fail
Cortex Sense may be the most important announcement because it targets the actual failure mode — and the problem is not retrieval. It is context assembly. A generic model connected to enterprise data through a tool or MCP server can still retrieve the wrong table, misread the metric, ignore dashboard history, miss organizational context, or answer confidently using incomplete information. Cortex Sense gathers context automatically from the Snowflake environment: query history, dashboards, metadata, business definitions, agent behavior, and operational signals.
Snowflake's own accuracy claim is meaningful: CoCo and CoWork reached 83% accuracy with Cortex Sense in internal testing, against lower baselines without that context layer. The exact number needs customer validation, but the direction is the point. Enterprise AI doesn't become trustworthy because the model gets a little better. It becomes trustworthy when the system around the model can assemble the right business context at runtime.
Horizon Context Formalizes Business Meaning
Horizon Context is the semantic layer underneath the agent story — where business meaning, metadata, governance context, operational knowledge, glossary terms, and metrics become part of the platform's shared intelligence. Enterprise data is not self-explanatory.
- A column name does not tell you which definition of revenue applies.
- A dashboard does not tell you whether it is authoritative.
- A query history does not tell you whether the logic is still correct.
- A metric does not tell you whether finance and sales agree on it.
- A table does not tell you whether an agent should use it.
Semantic Studio and Autopilot matter because they turn existing SQL, Tableau, and Power BI definitions into governed semantic views — pulling logic that's trapped in BI workbooks and inherited dashboards into a layer humans and agents share. The more business meaning lives inside Horizon Context, the more Snowflake becomes not just the place data is stored, but the place enterprise meaning is governed.
Natoma Makes Snowflake an Agent Action Platform
The Natoma acquisition may be the most strategically important move in the whole cycle. It gives Snowflake an enterprise MCP governance layer — secure connectivity for agents to business systems, with identity, policy, audit, observability, and delegated permissions at the tool-call level. Because data alone is not enough. Agents need to act: create Jira tickets, update CRM records, query SaaS systems, trigger workflows, call internal APIs, work across Slack, sales, support, databases, and documents. Without a governed action layer, Snowflake is where agents understand data but not where agents do work.
This is Snowflake moving from systems of insight toward systems of action. That phrase matters — it is the missing bridge between insight and work.
Agent Identity Makes Agents First-Class Principals
It is no longer enough to govern human users — agents need identities too. Agent Identity gives each agent a distinct, verifiable identity with permissions, auditability, and access controls separate from the human who created or invoked it. An agent should not borrow a human's full access indefinitely; it should operate with scoped identity, clear permissions, traceable actions, and lifecycle governance. The same logic showed up around Vercel Connect: agents must become first-class principals.
- Which agent accessed this table, and which user was it acting for?
- Which tool did it call, and which permissions applied?
- Was the action approved?
- Was data moved outside the trust boundary?
- Was the agent compromised or prompt-injected?
- Did it trigger unusual data movement?
Snowflake is building controls around exactly those questions: prompt injection detection, AI security posture management, data exfiltration detection, data movement policies, multi-party approval, and intent-driven governance.
CoCo Is a Data-Native Coding Agent
CoCo's importance is not that it writes code — every platform has a coding-agent story now. The important part is that CoCo is data-native: it works inside Snowflake's governed environment, aware of metadata, permissions, semantic context, data assets, and platform operations. That makes it different from a generic coding agent dropped into a repo. It helps with SQL, notebooks, pipelines, migrations, OpenFlow configuration, automations, and data engineering — and Cloud Agents extend that with managed sandbox execution: shell commands, Python, package installs, dbt builds, web browsing, operational tasks inside a Snowflake-managed environment.
Giving agents shell access, browser access, package installation, and pipeline control inside a managed data platform is a major capability. It requires serious isolation, permissions, egress control, logging, and approval boundaries. Data engineering is becoming agentic — but agentic data engineering is only safe if the execution environment is governed as tightly as the data. That is where Snowflake's security stack has to prove itself.
CoWork's Real Move Is Reusable Artifacts
CoWork is the business-facing agent — for knowledge workers who want to ask questions, run research, create artifacts, and analyze business data without writing SQL. The most interesting pattern is not "chat with data." It is the creation of reusable artifacts: a report, dashboard, analysis, research brief, or decision artifact that can be shared, revisited, refined, published, and operationalized. Enterprise knowledge work rarely ends with a single answer — the output has to become part of the workflow, and CoWork does it against governed data rather than disconnected AI tools where context, permissions, and audit are weaker.
That is the product tension. If business users are going to use AI for real work, Snowflake wants that work inside the governed boundary — but only if the experience competes with general-purpose AI tools.
The Skill Catalog Turns Workflow Knowledge Into Assets
The Skill Catalog is easy to underread — it may become one of the more important compounding mechanisms. A skill is not just a prompt. It is reusable workflow knowledge: a defined pattern for how to complete a recurring task, connect tools, apply context, and produce a useful output. In most enterprises this knowledge lives informally.
- In someone's notebook, or a Slack thread.
- In a dbt macro or a dashboard habit.
- In a migration playbook or a brittle script.
- In a senior analyst's head, or a consulting deck.
A governed Skill Catalog turns those patterns into reusable assets — and that is where agentic systems compound: the first agent automates a task, the second reuses the skill, the third team adapts it, and the organization accumulates operational leverage. The more teams turn repeated workflows into skills, the more Snowflake becomes a memory layer for how work gets done. Skills are the bridge between individual automation and institutional capability.
Open Semantics Interchange Lets Meaning Travel
Open Semantics Interchange makes Snowflake's semantic layer useful beyond Snowflake-native tools — because business meaning cannot stay trapped in one interface. Definitions, KPIs, metrics, glossary terms, and semantic views need to travel across dashboards, BI tools, agents, workflow systems, and partner applications. If each tool defines meaning differently, agents produce inconsistent answers and teams lose trust. Snowflake's play is to make Horizon Context the semantic source of truth other systems can read.
If Snowflake can make its semantic layer portable across partner tools, it increases ecosystem gravity without forcing every interaction inside Snowflake. The winning context layer has to be useful outside its own UI.
Infrastructure Still Matters
Summit was agent-heavy, but the infrastructure announcements mattered — the pattern across them is clear: reduce the number of reasons data has to leave Snowflake.
That pattern matters for agents, which are sensitive to latency, freshness, governance, permissions, cost, and context. The more data and workflow logic stay inside one governed environment, the easier agents are to trust. The agent interface gets the attention; the governed data substrate determines whether the agent can be trusted.
The Anthropic Partnership Is a Trust Narrative
The Anthropic partnership expansion was more than a model relationship — it strengthened Snowflake's trust narrative. Having Daniela Amodei onstage reinforced the alignment: enterprise AI adoption depends on safety, governance, and trust, which maps cleanly onto Snowflake's message around governed data, agent identity, Cortex Sense, Horizon Context, Natoma, and AI security posture.
Claude becomes available through Snowflake's ecosystem; Snowflake gets a trusted model partner aligned with enterprise safety; customers get a cleaner procurement and deployment path for Claude-powered workflows inside governed environments. Snowflake does not have to be the model company. It has to make the enterprise comfortable using strong models against governed data with traceable controls. That is a different game — and more aligned with Snowflake's strengths.
The Databricks Comparison Was Impossible to Miss
Snowflake Summit happened three weeks before Databricks Data + AI Summit, on the same Moscone turf. Both companies are moving toward the same center — agentic business interfaces, coding agents, semantic context layers, open table formats, governance, model choice, MCP connectivity, business metrics, enterprise AI control planes. But the emphasis differs.
Enterprises will not choose on one feature. They'll choose based on where their data already lives, which platform their teams trust, how messy their governance is, how much open formats matter, how much ML maturity they have, and whether they believe the future stack is built around Snowflake's governed data cloud or Databricks' lakehouse intelligence layer. The feature parity is closing. The architectural philosophies still differ — and that is where the real competition sits.
Governance Can Become Gravity — or Drag
Snowflake is right that enterprise agents need identity, permissions, semantic context, data-movement controls, audit trails, prompt-injection defense, and multi-party approval. Governance can become a moat. It can also become friction. If the governance layer is too heavy, teams route around it.
- They'll use ChatGPT, or Claude.
- They'll export data.
- They'll build sidecar workflows.
- They'll run shadow agents.
- They'll move faster outside the approved system.
Snowflake needs to make the governed path feel easier than the ungoverned path — not just safer. Easier. That is the bar for enterprise AI.
What Was Great, What Was Missing
Snowflake was strongest where it connected agentic AI to enterprise trust. The strongest part of Summit was coherence: not "AI everywhere" in a generic way, but a single argument — enterprise agents become real when grounded in governed data, context, identity, and secure action. That is a strong lane.
Cortex Sense as the right answer to context assembly. Horizon Context as the semantic foundation. Natoma as a serious path into MCP governance and tool-call control. Agent Identity as exactly the primitive enterprises need before agents act. The CoWork/CoCo split — two surfaces, one truth system. And Open Semantics Interchange, because business meaning has to travel.
External validation of the Cortex Sense accuracy claim against messy environments. Sandbox scrutiny for Cloud Agents that run commands, browse, and install packages. Simplicity across a very broad surface. And honest cost modeling — agentic workloads mean more queries, tool calls, compute, traces, sandboxes, and recurring automations.
Making AI real for business also means making AI spend legible. The data-store advantage is real. It is not the whole product.
Governed Enterprise Data Is Becoming the Agentic Work Layer
Summit 2026 was not mainly a data-cloud event. It was a declaration that governed enterprise data is becoming the work layer for agentic AI — a story reorganized from warehousing to agentic work.
- Cloud data warehousing and data sharing.
- Performance and governance.
- Business context, semantic meaning, agent identity.
- MCP governance, secure tool calls, coding and business work agents.
- Prompt-injection defense, data-exfiltration detection, multi-party approval.
- Open semantics, external action, governed automation.
The operator question is no longer "should our data live in Snowflake?" It is: how much of our agentic enterprise work should be governed by Snowflake? If Snowflake is right, the companies that win with agents will not be the ones with the most impressive demo. They will be the ones with the strongest governed context and action layer.
The Direction Is Clear. The Execution Risk Is Real.
Snowflake has to prove Cortex Sense accuracy in customer environments, make CoWork and CoCo useful enough for daily work, integrate Natoma deeply, and keep the agent security stack powerful without becoming painful. Watch five things:
The deeper watch item is behavioral. When agents can safely use governed data, understand business context, carry their own identity, and call tools across the enterprise, the center of gravity shifts. That is the real Summit signal. Snowflake did not just add AI to the data cloud. It started turning governed enterprise data into the agentic work layer.
See exactly how this impacts your specific industry and function. Upgrade to PRO to get bespoke tactical breakdowns generated instantly for your operating model.