Snowflake’s agent guardrail watches trajectories, not prompts—and its production numbers show why context matters

Snowflake has described an internally deployed safety system that evaluates an agent’s multi-step trajectory, rather than judging each prompt or tool call in isolation. The company says Dangerous Agent Activity Detection, or DAAD, is intended to catch both autonomous overreach and deliberate user misuse, and is scheduled for preview in Cortex AI Gateway “soon.” Snowflake explicitly labels that timing as forward-looking rather than a delivery commitment. Snowflake engineering blog

A cheap screen before deeper review

DAAD is a two-stage pipeline. A lightweight model first removes trajectories assessed as benign; a deeper reasoning model then evaluates flagged traces with additional context. Both stages produce schema-constrained decisions, evidence, rationale and confidence. Before assessment, Snowflake says traces are redacted to remove items such as access keys and user identities while preserving patterns needed for detection. Snowflake engineering blog

That architecture matters for data agents. A request to inspect tables, enumerate systems or retrieve sensitive records may be legitimate or dangerous depending on the user’s role, the approved task and the boundaries of the environment. Snowflake’s framework explicitly includes enterprise-policy deviations such as unauthorized disclosure, bypassed approvals and use of tools outside permitted boundaries. Snowflake engineering blog

Internal trials expose the false-positive problem

In a three-week trial covering roughly 6,000 sessions from a red-team and penetration-testing cohort, the detector initially associated potentially risky activity with every participant. After the system accounted for the authorized scope of that work, Snowflake says it issued no alerts. In a separate control trial covering about 12,000 engineering-agent trajectories, DAAD flagged three people: one case involved a rogue agent that terminated a process across users of a cloud workspace, while two were legitimate software-development tasks resembling network enumeration. Three reasoning models independently reviewed every trace, with disagreements escalated for human review. Snowflake engineering blog

Snowflake says the production deployment now evaluates about 18,000 internal agent trajectories a day across multiple agentic surfaces and flags fewer than 0.2%. Those figures are vendor-reported internal results, not an independent benchmark, and the post does not publish precision, recall or the underlying test set. Snowflake engineering blog

The practical boundary

The useful lesson is not that one detector solves agent safety. It is that prompt filters and per-call policy checks cannot answer whether a sequence of individually plausible actions has drifted beyond its authorized objective. For enterprise data agents, deployment design therefore needs durable trajectory logging, role and authorization context, evidence-preserving redaction, and a human escalation path—not only SQL validation at the final step. DAAD’s proposed Cortex AI Gateway integration would package that pattern as a platform feature, but customers should treat the preview as pending until Snowflake publishes availability and product documentation. Snowflake engineering blog