Snowflake’s prompt-injection guardrail is regional, opt-in and metered

Snowflake expanded Cortex AI Guardrails’ prompt-injection protection on September 4 to accounts whose CORTEX_ENABLED_CROSS_REGION parameter is set to AWS_EU, AWS_JP or AWS_APJ. Previously, the feature required ANY_REGION, AWS_US or AWS_GLOBAL. That is a meaningful availability change for teams whose inference routing was constrained to the newly supported AWS regions—but it does not make the protection automatic. Snowflake release note

Check eligibility before testing prompts

Snowflake’s current documentation says Cortex AI Guardrails require Enterprise Edition or higher. They are available to commercial accounts—not Government, Virtual Private Snowflake or Sovereign accounts—with cross-region inference enabled. The supported CORTEX_ENABLED_CROSS_REGION values now include ANY_REGION, AWS_US, AWS_EU, AWS_JP, AWS_APJ and AWS_GLOBAL. Cortex AI Guardrails documentation

The operational consequence is simple: confirm the account edition, account type and inference-routing parameter before treating an unsuccessful enablement as a model or policy failure.

Enable it at the account—not agent—layer

An ACCOUNTADMIN enables the advanced prompt-injection control through the account-level AI_SETTINGS parameter. Snowflake documents this setting for CoCo, Snowflake Intelligence and Cortex Agents, giving administrators one control surface rather than a separate switch on each agent. The same documentation says the guardrail scans tool outputs for indirect prompt injections, while the underlying model’s protections handle known direct prompt-injection and jailbreak techniques. Cortex AI Guardrails documentation

That scope matters in testing. A team should verify both that the account setting is present and that the request is coming through one of the supported products. The release note expands where the feature can run; it does not expand the list of protected clients.

Treat logs and cost as part of rollout

Snowflake exposes guardrail scan history through SNOWFLAKE.ACCOUNT_USAGE.CORTEX_AI_GUARDRAILS_USAGE_HISTORY. The view records whether a request raised a guardrail signal, along with credit and token consumption, and can be audited by user, agentic source or role. Snowflake also warns that legitimate prompts can occasionally be flagged and recommends periodic log review. Usage is billed according to the number of tokens scanned. Cortex AI Guardrails documentation

A defensible rollout therefore needs three checks: confirm regional eligibility, enable the account-level policy, and review both flagged requests and scan consumption. The September 4 change removes a regional availability obstacle. It does not remove the administrator’s job of proving that the control is enabled, observing false positives and budgeting for the scan path.