ドキュメント変更履歴 2026-08-23

--- ahttps://docs.snowflake.com/en/user-guide/trust-center/using-the-trust-center+++ bhttps://docs.snowflake.com/en/user-guide/trust-center/using-the-trust-center@@ -597,33 +597,162 @@ followed correctly. +<a id="label-trust-center-remediate-violations-programmatically"></a>++## Remediate violation findings with one-click remediation++For supported violation findings, the Trust Center generates the SQL statements that resolve the violation finding, shows you the+plan, and runs it after you approve it. You review the exact statements before anything runs.++The statements run in your session under your current role. They are subject to the same access control as any other SQL you run, and+they appear in your query history. The Trust Center doesn't change anything in your account on its own.++<a id="label-trust-center-programmatic-remediation-scanners"></a>++### Violation findings that support one-click remediation++One-click remediation is available for violation findings reported by the following CIS Benchmarks scanners:++<div className="colwidths-auto">++  <thead>+    <tr>+      <th>Scanner</th>+      <th>SCANNER_ID</th>+      <th>What the remediation does</th>+    </tr>+  </thead>+  <tbody>+    <tr>+      <td>Password length policy</td>+      <td>`CIS_BENCHMARKS_CIS1_5`</td>+      <td>Creates a password policy that requires at least 14 characters, then applies it to the account.</td>+    </tr>+    <tr>+      <td>User inactivity</td>+      <td>`CIS_BENCHMARKS_CIS1_8`</td>+      <td>Disables each user that hasn't signed in for 90 days.</td>+    </tr>+    <tr>+      <td>Admin session timeout</td>+      <td>`CIS_BENCHMARKS_CIS1_9`</td>+      <td>Creates a session policy with a 15-minute idle timeout, then applies it to each affected administrator.</td>+    </tr>+    <tr>+      <td>Privileged default role</td>+      <td>`CIS_BENCHMARKS_CIS1_12`</td>+      <td>Sets the default role to `PUBLIC` for each user whose default role is `ACCOUNTADMIN` or `SECURITYADMIN`.</td>+    </tr>+    <tr>+      <td>Yearly rekeying</td>+      <td>`CIS_BENCHMARKS_CIS4_1`</td>+      <td>Sets `PERIODIC_DATA_REKEYING` to `TRUE` for the account.</td>+    </tr>+    <tr>+      <td>Client encryption key size</td>+      <td>`CIS_BENCHMARKS_CIS4_2`</td>+      <td>Sets `CLIENT_ENCRYPTION_KEY_SIZE` to `256` for the account.</td>+    </tr>+    <tr>+      <td>Data retention floor</td>+      <td>`CIS_BENCHMARKS_CIS4_4`</td>+      <td>Sets `MIN_DATA_RETENTION_TIME_IN_DAYS` to `7` for the account.</td>+    </tr>+    <tr>+      <td>Storage integration for stage creation</td>+      <td>`CIS_BENCHMARKS_CIS4_5`</td>+      <td>Sets `REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION` to `TRUE` for the account.</td>+    </tr>+    <tr>+      <td>Storage integration for stage operations</td>+      <td>`CIS_BENCHMARKS_CIS4_6`</td>+      <td>Sets `REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION` to `TRUE` for the account.</td>+    </tr>+    <tr>+      <td>Unload to inline URL</td>+      <td>`CIS_BENCHMARKS_CIS4_8`</td>+      <td>Sets `PREVENT_UNLOAD_TO_INLINE_URL` to `TRUE` for the account.</td>+    </tr>+  </tbody>++</div>++Violation findings from other scanner packages, and from the remaining CIS Benchmarks scanners, don't support one-click+remediation. For those violation findings, use CoCo or follow the instructions on the **Remediation** tab. For more information, see+[](#label-trust-center-remediate-with-cortex-code).++The remediations for `CIS_BENCHMARKS_CIS1_5` and `CIS_BENCHMARKS_CIS1_9` create a `TC_POLICIES` database with a `PUBLIC` schema inside+it to hold the policy they apply. If those objects already exist, the Trust Center uses them and leaves them unchanged.++<a id="label-trust-center-remediate-violation-programmatically"></a>++### Remediate a violation finding with one-click remediation++To remediate a violation finding, follow these steps:++1. Sign in to %sf-web-interface-link%.+2. Switch to a role with the `SNOWFLAKE.TRUST_CENTER_ADMIN` application role granted to it.++   For more information about granting this role, see [](#label-trust-center-requirements).++3. In the navigation menu, select **Governance & security** %raa% **Trust Center**.+4. Select the **%trust-center-tab-violations%** tab.+5. Select a violation finding to open the findings detail panel, and select **Remediate Now**, or select the remediation icon in the+   list of violation findings.++   The Trust Center generates the remediation plan and opens the **Remediate violation** dialog.++6. Review the plan. The dialog shows the following information:++   - **Potential impact**: what the remediation changes in your account. If CoCo is available for your account,+     select **Explain** to open a CoCo chat that describes in more detail what the remediation does and how it+     affects your account, and answers follow-up questions about it.+   - **Violation**: the violation finding that the plan resolves.+   - **Affected entities**: the users that the remediation acts on. This appears only for remediations that act on individual users.+   - The SQL statements that the Trust Center runs on your behalf, in the order that they run.++7. Select **Execute plan**.++   The dialog reports **Violation remediated**, **Violation partially remediated**, or **Remediation failed**. If a statement fails,+   the dialog identifies the failing statement and its SQL error.++8. Wait for the next scheduled scanner run, or [run the scanner on demand](#label-trust-center-start-scanner-on-demand), to confirm+   that the root cause of the violation finding has been remediated.++   The Trust Center automatically removes the violation finding from the **%trust-center-tab-violations%** tab after the scanner+   confirms the remediation. A remediated finding might appear as an open finding in Snowsight for up to 3 hours after the violation+   finding is remediated and the scanner is re-run.++### Considerations for one-click remediation++- Always review the SQL statements in the plan before you select **Execute plan**.+- If a statement fails, the Trust Center stops that step and doesn't run the remaining steps in the plan. Statements that already ran+  successfully stay applied, and the result is reported as **Violation partially remediated**.+- If a violation finding was already remediated, generating a plan for it fails. The dialog reports that the violation finding is+  already remediated and offers only **Close**. A new plan becomes available only if a later scanner run reports the violation+  finding again.+- A remediation plan is generated for a specific scanner result. If the plan is no longer current, or if the violation finding+  changed after the plan was generated, select **Refresh plan** to generate a new plan.+ <a id="label-trust-center-remediate-with-cortex-code"></a> -## Remediate violations with Cortex Code--<div className="previewfeat sidebar">--<div className="sidebar-title">--%logo-snowflake-black% [Preview Feature](/release-notes/preview-features) — Open--</div>--Available to all accounts.--</div>--You can use Cortex Code to get AI-guided remediation for Trust Center violations directly in %sf-web-interface%. When you select-**Begin Remediation** for a finding, Cortex Code opens a chat that explains the violation in the context of your account,+## Remediate violation findings with CoCo++You can use CoCo to get AI-guided remediation for Trust Center violation findings directly in %sf-web-interface%. When you select+**Remediate with Coco** for a finding, CoCo opens a chat that explains the violation finding in the context of your account, recommends remediation steps, and can execute remediation actions with your approval. -Cortex Code provides interactive, conversational remediation that is personalized to your account's specific configuration. Unlike-the static remediat... (truncated) 

差分が長いため、途中まで表示しています。

--- ahttps://docs.snowflake.com/en/user-guide/hybrid-tables-inline-stored-procedures+++ bhttps://docs.snowflake.com/en/user-guide/hybrid-tables-inline-stored-procedures@@ -178,5 +178,5 @@     [ <arg_name> <arg_data_type> [ , ... ] ] )   RETURNS { <result_data_type>-          | TABLE ( <col_name> <col_data_type> [ , ... ] ) }+          | TABLE ( [ <col_name> <col_data_type> [ , ... ] ] ) }   LANGUAGE SQL   AS@@ -196,6 +196,11 @@  - Reference procedure arguments inside SQL statements using a colon prefix: `:arg_name`.-- `RETURNS TABLE` requires an explicit column list with names and data types. The column types-  must match the types returned by the query exactly.+- You can declare `RETURNS TABLE()` with an empty column list. Snowflake infers the column names+  and types from the returned `RESULTSET` when you `CALL` the procedure.+- To use the procedure as a table source, for example `SELECT ... FROM TABLE(proc())`, declare an+  explicit column list. `RETURNS TABLE()` without columns fails in that context because the return+  table must declare a nonzero number of columns.+- When you declare columns in `RETURNS TABLE`, the column types must match the types returned by+  the query exactly.  <a id="label-isproc-call-syntax"></a>@@ -208,4 +213,22 @@ CALL <name> ( [ <arg> [ , ... ] ] ) ```++<a id="label-isproc-compilation"></a>++### Compilation++Inline Stored Procedures compile the entire body up front at `CALL` time. This eager compilation+differs from standard stored procedures, which compile statements as they run.++The following effects are expected:++- Statically decidable errors are reported at `CALL` time, before any statement in the body runs.+  Examples include an unknown column or table, the wrong number of function arguments or `INSERT`+  columns, and a `RETURN` type that doesn't match the declared return type.+- Those compilation errors aren't catchable by an `EXCEPTION` handler. The handler runs only for+  errors that occur after compilation succeeds.+- A compilation error in a branch is reported even if that branch wouldn't execute at runtime.+- Snowflake type-checks every `RETURN` path against the declared return type, regardless of which+  branch runs.  <a id="label-isproc-examples"></a>@@ -261,4 +284,33 @@ ``` +<a id="label-isproc-example-sequence"></a>++### Insert a row using a sequence++Inline Stored Procedures can use sequences, including `NEXTVAL` and auto-increment columns. This+procedure inserts a new order and lets a sequence generate the primary key:++```sql+CREATE OR REPLACE SEQUENCE order_id_seq START = 2000 INCREMENT = 1;++CREATE OR REPLACE INLINE PROCEDURE place_order_seq(+  customer_id NUMBER(18,0),+  product     VARCHAR,+  quantity    NUMBER(10,0)+)+RETURNS VARCHAR+LANGUAGE SQL+AS+$$+BEGIN ATOMIC+  INSERT INTO orders (order_id, customer_id, product, quantity, status)+    VALUES (order_id_seq.NEXTVAL, :customer_id, :product, :quantity, 'PENDING');+  RETURN 'OK';+END;+$$;++CALL place_order_seq(42, 'Helmet', 1);+```+ <a id="label-isproc-example-update"></a> @@ -339,4 +391,34 @@  CALL get_order(1001);+```++<a id="label-isproc-example-returns-table-empty"></a>++### Return a table without declaring columns++You can declare `RETURNS TABLE()` with an empty column list. `CALL` infers the columns from the+returned `RESULTSET`. You can't use that procedure as a table source in a `FROM` clause unless you+declare an explicit schema:++```sql+CREATE OR REPLACE INLINE PROCEDURE list_orders()+RETURNS TABLE()+LANGUAGE SQL+AS+$$+BEGIN ATOMIC+  LET res RESULTSET := (+    SELECT order_id, customer_id, product, quantity, status+      FROM orders+  );+  RETURN TABLE(res);+END;+$$;++-- CALL succeeds and infers columns from the RESULTSET.+CALL list_orders();++-- Fails: 001175 Return table must declare a nonzero number of columns.+SELECT * FROM TABLE(list_orders()); ``` @@ -702,7 +784,7 @@     </tr>     <tr>-      <td>No cross-database queries</td>-      <td>All tables referenced in the procedure must belong to the same database.</td>-      <td>Restructure queries to stay within a single database.</td>+      <td>At most one database</td>+      <td>A procedure body can reference at most one database. That database doesn't have to be the database that contains the procedure. Referencing two or more databases isn't supported.</td>+      <td>Keep all table references in a single database, or split the work across separate procedure calls.</td>     </tr>     <tr>@@ -737,7 +819,22 @@     </tr>     <tr>-      <td>No sequences</td>-      <td>Queries that use sequences, either explicitly or implicitly (auto incrementing columns), aren't supported.</td>-      <td>Generate the identifier value in the caller and pass it as an explicit argument, or use a different key generation strategy such as a UUID.</td>+      <td>No table functions</td>+      <td>Table functions such as `FLATTEN`, `LATERAL FLATTEN`, `GENERATOR`, and `SPLIT_TO_TABLE` aren't supported. The call fails with an error that the procedure is accessing a non-hybrid table.</td>+      <td>Rewrite the query to use hybrid tables only, or run the table-function work outside the procedure.</td>+    </tr>+    <tr>+      <td>UDF calls in scripting expressions</td>+      <td>You can call a user-defined function (UDF) inside a SQL statement in the procedure body. Calling a UDF in a scripting expression, such as `LET` or `RETURN`, isn't supported.</td>+      <td>Call the UDF from a SQL statement, for example `SELECT my_udf(...) INTO :var FROM hybrid_table ...`.</td>+    </tr>+    <tr>+      <td>Queries must involve a hybrid table</td>+      <td>A query that doesn't involve a hybrid table isn't supported. Examples include `SELECT 1+2 INTO :v`, a `VALUES` source, and a constant CTE. Direct assignment is supported: `LET v := 1 + 2`. This restriction doesn't apply to DML sources such as `INSERT ... SELECT 1`.</td>+      <td>Use `LET` for constants and computed values instead of `SELECT ... INTO`.</td>+    </tr>+    <tr>+      <td>No SQLROWCOUNT</td>+      <td>The `SQLROWCOUNT` variable isn't available, so you can't drive control flow from the number of rows affected by DML.</td>+      <td>Run `SELECT COUNT(*) INTO :n ...` against the hybrid table before or after the DML statement.</td>     </tr>   </tbody> 

--- ahttps://docs.snowflake.com/en/developer-guide/restricted-callers-rights/high-level-caller-privileges+++ bhttps://docs.snowflake.com/en/developer-guide/restricted-callers-rights/high-level-caller-privileges@@ -1,5 +1,3 @@ # High-level caller privileges--Available to all accounts.  - [](/developer-guide/restricted-callers-rights)@@ -19,10 +17,11 @@ | --------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | DATA READ                   | Account, database, schema | Read data from objects in the target container.                                                                                             |-| DATA WRITE                  | Account, database, schema | Write data to objects in the target container. Implicitly covers DATA READ.                                                                 |+| DATA WRITE                  | Account, database, schema | Write data to objects in the target container.                                                                                              |+| OBJECT DISCOVERY            | Account, database, schema | Discover objects in the target container (for example, using SHOW) without reading their data.                                              | | COMPUTE USAGE               | Account                   | Use compute resources in the account.                                                                                                       | | PROGRAM USAGE               | Account, database, schema | Invoke certain executables in the target container.                                                                                         | | GRANT MANAGEMENT            | Account, database, schema | Run GRANT and REVOKE statements for permissions on in-account objects, and create [references](/sql-reference/references) to those objects. |-| OBJECT MANAGEMENT           | Account, database, schema | Take full control of non-sensitive objects in the target container. Implicitly covers DATA READ, DATA WRITE, and COMPUTE USAGE.             |-| FULL MANAGEMENT             | Account                   | All operations permitted in the account. Implicitly covers every other high-level caller privilege.                                         |+| OBJECT MANAGEMENT           | Account, database, schema | Take full control of non-sensitive objects in the target container.                                                                         |+| FULL MANAGEMENT             | Account                   | All operations permitted in the account.                                                                                                    |  High-level caller privileges can only be granted as caller grants. They cannot be granted as regular privileges (for example,@@ -38,18 +37,9 @@ account). -## Hierarchy--High-level caller privileges form a containment hierarchy: an ancestor implicitly covers every operation allowed by its-descendants, so granting an ancestor automatically authorizes everything the descendants would.--<pre>-FULL MANAGEMENT-└── OBJECT MANAGEMENT-│    ├── DATA WRITE-│    │     └── DATA READ-│    └── COMPUTE USAGE-├── GRANT MANAGEMENT-└── PROGRAM USAGE-</pre>+## Privilege relationship++Some high-level privileges can naturally overlap. For example, DATA READ, DATA WRITE, OBJECT MANAGEMENT, and OBJECT DISCOVERY+can each authorize discovering a table, but only DATA READ authorizes reading the table's data. One high-level privilege can+also subsume another one. For example, OBJECT MANAGEMENT subsumes OBJECT DISCOVERY and COMPUTE USAGE.  ## DATA READ@@ -65,6 +55,5 @@ - Invoking executables. -DATA READ can be granted on an account, database, or schema. It is implicitly covered by DATA WRITE, OBJECT MANAGEMENT, and-FULL MANAGEMENT.+DATA READ can be granted on an account, database, or schema.  The following example lets all RCR executables owned by `rpt_owner` read data in the `reporting` database:@@ -76,14 +65,17 @@ ## DATA WRITE -The DATA WRITE high-level caller privilege authorizes an RCR executable to write data to objects in the target container. This currently includes tables only. It-implicitly covers DATA READ.+The DATA WRITE high-level caller privilege authorizes an RCR executable to write data to objects in the target container. This currently includes tables only.++UPDATE and DELETE operations require the ability to read existing data, and can't be authorized by DATA WRITE alone. DATA READ+may be used in conjunction to support these operations.  DATA WRITE doesn't authorize any of the following: +- Reading data. - Creating or altering objects. - Running GRANT or REVOKE statements. - Invoking executables. -DATA WRITE can be granted on an account, database, or schema. It is implicitly covered by OBJECT MANAGEMENT and FULL MANAGEMENT.+DATA WRITE can be granted on an account, database, or schema.  The following example lets all RCR executables owned by `etl_owner` read from any schema in the `raw` database and write to@@ -95,4 +87,19 @@ ``` +## OBJECT DISCOVERY++The OBJECT DISCOVERY high-level caller privilege authorizes an RCR executable to discover objects in the target container —+that is, to see that an object exists — without reading the object's data. This currently includes operations such as+SHOW on objects in the container.++OBJECT DISCOVERY doesn't authorize any of the following:++- Reading or writing data.+- Creating or altering objects.+- Running GRANT or REVOKE statements.+- Invoking executables.++OBJECT DISCOVERY can be granted on an account, database, or schema.+ ## COMPUTE USAGE @@ -100,5 +107,5 @@ warehouses and compute pools. -COMPUTE USAGE can only be granted on an account. It is implicitly covered by OBJECT MANAGEMENT and FULL MANAGEMENT.+COMPUTE USAGE can only be granted on an account.  ## PROGRAM USAGE@@ -114,5 +121,5 @@ - MCP servers. -PROGRAM USAGE can be granted on an account, database, or schema. It is implicitly covered by FULL MANAGEMENT.+PROGRAM USAGE can be granted on an account, database, or schema.  ## GRANT MANAGEMENT@@ -132,5 +139,5 @@ - Caller grants -GRANT MANAGEMENT can be granted on an account, database, or schema. It is implicitly covered by FULL MANAGEMENT.+GRANT MANAGEMENT can be granted on an account, database, or schema.  The following example shows the caller grants that allow an RCR executable owned by `data_owner` to create a SELECT reference,@@ -151,9 +158,10 @@  The OBJECT MANAGEMENT high-level caller privilege authorizes an RCR executable to take full control of non-sensitive objects in-the target container. It implicitly covers DATA READ, DATA WRITE, and COMPUTE USAGE.+the target container.  With exceptions (see below), OBJECT MANAGEMENT allows: -- All operations on all objects inside accounts (but not including accounts themselves).+- All operations on all objects inside accounts (but not including accounts themselves), except the data-access operations+  covered by DATA READ and DATA WRITE. - Creation of objects inside accounts. @@ -170,17 +178,19 @@ - Writing to stages, repositories, and workspaces. -OBJECT MANAGEMENT can be granted on an account, database, or schema. It is implicitly covered by FULL MANAGEMENT.--The following example lets a Snowflake Native App provision and grant access to objects in its database:--```sql+OBJECT MANAGEMENT can be granted on an account, database, or schema.++The following example lets a Snowflake Native App read and write data in its database, and also provision and grant access to+objects in that database:++```sql+GRANT CALLER DATA READ         ON DATABASE my_app_db TO APPLICATION my_app;+GRANT CALLER DATA WRITE        ON DATABASE my_app_db TO APPLICATION my_app; GRANT CALLER OBJECT MANAGEMENT ON DATABASE my_app_db ... (truncated) 

差分が長いため、途中まで表示しています。

--- ahttps://docs.snowflake.com/en/user-guide/organization-users+++ bhttps://docs.snowflake.com/en/user-guide/organization-users@@ -19,9 +19,9 @@ - [](/user-guide/organization-accounts) -Organizations with multiple accounts often need to have the same person be a user in more than one of those accounts. To avoid the-repetition of creating a user object for the person in each account separately, the organization administrator can create an-*organization user* in the [organization account](/user-guide/organization-accounts). Each organization user acts as a global user-entity that can be imported into regular accounts by account administrators, simplifying the process of having the same person have a-user object in multiple accounts.+Organizations with multiple accounts often need to have the same person be a user in more than one of those accounts. The same is true of a+service or application that runs in more than one account. To avoid the repetition of creating a user object in each account separately,+the organization administrator can create an *organization user* in the [organization account](/user-guide/organization-accounts). Each+organization user acts as a global user entity that can be imported into regular accounts by account administrators, simplifying the+process of having the same person or service have a user object in multiple accounts.  Account administrators don't add organization users directly to their regular account. Rather, they add *organization user groups*, which@@ -29,6 +29,6 @@ added to the account. -If you want to create organization users for people who already have a user object in one or more regular accounts, you'll need to link-the organization user with the existing user object after importing the organization user group. For more information, see+If you want to create organization users for people or services that already have a user object in one or more regular accounts, you'll+need to link the organization user with the existing user object after importing the organization user group. For more information, see [](#label-org-users-conflicts). @@ -38,5 +38,5 @@  1. As a global organization administrator in the organization account:-   1. [Create an organization user](#label-org-users) for each person that+   1. [Create an organization user](#label-org-users) for each person or service that       you want to be a user in multiple regular accounts.    2. [Create an organization user group](#label-org-users-groups-create) that is a logical grouping of the users.@@ -70,4 +70,34 @@ The USERADMIN role can also create an organization user. +<a id="label-org-users-types"></a>++### Organization user types++An organization user is either a `PERSON` user, which represents a human, or a `SERVICE` user, which represents a service or application+that interacts with Snowflake without human interaction. Specify the TYPE property to choose between them. If you don't specify a type, the+organization user is a `PERSON` user. For the characteristics of each type, including the authentication methods that a service user can+use, see [](/user-guide/admin-user-management#label-user-management-types).++For example, the following command creates an organization user for a service that loads data in several accounts:++```sql+USE ROLE GLOBALORGADMIN;++CREATE ORGANIZATION USER etl_pipeline+   EMAIL = 'data-platform@example.com'+   TYPE = SERVICE;+```++The type of an organization user determines the following:++- The type of the user objects that Snowflake creates when an account administrator imports an organization user group. Importing a group+  that contains `etl_pipeline` creates a `SERVICE` user named `etl_pipeline` in the regular account.+- Which existing users the organization user can be linked to when an account administrator resolves a conflict. For more information, see+  [](#label-org-users-conflicts).++`PERSON` and `SERVICE` are the only types available to an organization user. Other user types, such as `SERVICE_AGENT` and+`LEGACY_SERVICE`, are only available to users in a regular account. You also can't change the type after you create the organization user,+so create the organization user with the type that the corresponding users in your accounts need.+ <a id="label-org-users-groups"></a> @@ -232,10 +262,21 @@ Use one of the following strategies to resolve a conflict between an organization user and an existing user: -- **Link the existing user**: If an existing user object corresponds to the same person as an organization user, and you want to manage the-  user as an organization user going forward, you can link the existing user with the organization user to resolve the conflict. Call the-  [](/sql-reference/functions/system_link_organization_user) function to link an existing user with an organization user. For example, to-  link the existing user `jloeb` with the organization user `jloebsmith`, call the function as follows:+- **Link the existing user**: If an existing user object corresponds to the same person or service as an organization user, and you want to+  manage the user as an organization user going forward, you can link the existing user with the organization user to resolve the conflict.+  Call the [](/sql-reference/functions/system_link_organization_user) function to link an existing user with an organization user. For+  example, to link the existing user `jloeb` with the organization user `jloebsmith`, call the function as follows:   ```sql   SELECT SYSTEM$LINK_ORGANIZATION_USER('jloeb', 'jloebsmith');+  ```++  The two users must have compatible types. A `SERVICE` organization user can only be linked to a `SERVICE` local user. A `PERSON`+  organization user can only be linked to a local user that is a `PERSON` user or whose TYPE property is `NULL`. If the types aren't+  compatible, the function returns an error and the local user isn't linked. Because you can't change the type of an organization user, use+  [](/sql-reference/sql/alter-user) to change the type of the local user, then link it. For example, to link a service user that predates+  the organization user to the `SERVICE` organization user `etl_pipeline`:+  ```sql+  ALTER USER legacy_loader SET TYPE = SERVICE;++  SELECT SYSTEM$LINK_ORGANIZATION_USER('legacy_loader', 'etl_pipeline');   ```  

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-organization-user+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-organization-user@@ -35,4 +35,5 @@   MIDDLE_NAME = '<string>'   LAST_NAME = '<string>'+  TYPE = { PERSON | SERVICE }   COMMENT = '<string>' ```@@ -95,4 +96,40 @@  </dd>+<dt>`TYPE = { PERSON | SERVICE }`</dt>+<dd>++Specifies whether the organization user represents a person or a service.++<dl>+<dt>`PERSON`</dt>+<dd>++Organization user is a human user who can interact with Snowflake.++</dd>+<dt>`SERVICE`</dt>+<dd>++Organization user is a service or application that interacts with Snowflake without human interaction.++</dd>+</dl>++For the characteristics of each type of user, including the authentication methods that a service user can use, see+[](/user-guide/admin-user-management#label-user-management-types).++`PERSON` and `SERVICE` are the only types that an organization user can have. Types that are valid for a user in a regular account but+not for an organization user, such as `SERVICE_AGENT` and `LEGACY_SERVICE`, are rejected.++The type determines which existing users the organization user can be linked to, and is applied to the user objects that Snowflake+creates when the organization user is imported into a regular account. For more information, see+[](/user-guide/organization-users#label-org-users-types).++You can't change the type after you create the organization user. The [](/sql-reference/sql/alter-organization-user) command doesn't+accept the TYPE property.++Default: `PERSON`++</dd> <dt><code className="samp">COMMENT = '<em>string</em>'</code></dt> <dd>@@ -123,7 +160,25 @@ ## Examples -Create an organization user and set the EMAIL property:+Create an organization user and set the EMAIL property. Because the TYPE property isn't specified, the organization user is a+`PERSON` user:  ```sql CREATE ORGANIZATION USER joe EMAIL = 'joe.davis@example.com'; ```++Create an organization user for a service that runs in more than one account:++```sql+CREATE ORGANIZATION USER etl_pipeline+  EMAIL = 'data-platform@example.com'+  TYPE = SERVICE;+```++When an account administrator imports an organization user group that contains `etl_pipeline`, the user object created in the regular+account is also a `SERVICE` user. If a service user named `etl_pipeline` already exists in the account, the administrator can link it to+the organization user by calling+[](/sql-reference/functions/system_link_organization_user), because both users are `SERVICE` users:++```sql+SELECT SYSTEM$LINK_ORGANIZATION_USER('etl_pipeline', 'etl_pipeline');+``` 

--- ahttps://docs.snowflake.com/en/sql-reference/functions/system_link_organization_user+++ bhttps://docs.snowflake.com/en/sql-reference/functions/system_link_organization_user@@ -13,6 +13,6 @@  When an account administrator adds an organization user group to a regular account, a conflict arises when an organization user in the-group corresponds to a person who already has a user object in the account. This function resolves the conflict and allows the user to be-managed as an organization user going forward.+group corresponds to a person or service that already has a user object in the account. This function resolves the conflict and allows the+user to be managed as an organization user going forward.  ## Syntax@@ -34,5 +34,5 @@ <dd> -Name of the organization user that corresponds to the same person as <code className="samp"><em>local_user</em></code>.+Name of the organization user that corresponds to the same person or service as <code className="samp"><em>local_user</em></code>.  </dd>@@ -44,7 +44,32 @@ organization user. -## Example+The TYPE property of the local user must be compatible with the TYPE property of the organization user. Snowflake treats a user whose TYPE+property is `NULL` as a `PERSON` user, so the types are compatible in the following cases:++<div className="colwidths-auto">++| Organization user type | Compatible local user types |+| ---------------------- | --------------------------- |+| `PERSON`               | `PERSON`, `NULL`            |+| `SERVICE`              | `SERVICE`                   |++</div>++If the types aren't compatible, the function returns an error and the local user isn't linked. For example, you can't link a `SERVICE`+local user to a `PERSON` organization user. Because the type of an organization user can't be changed, resolve this kind of conflict by+creating the organization user with the type you need, or by using [](/sql-reference/sql/alter-user) to change the type of the local user+before you link it. After a local user is linked, its TYPE property can no longer be changed in the regular account.++## Examples++Link the local user `jloeb` with the organization user of the same name:  ```sql SELECT SYSTEM$LINK_ORGANIZATION_USER('jloeb', 'jloeb'); ```++Link a local service user with a `SERVICE` organization user. Both users are `SERVICE` users, so the types are compatible:++```sql+SELECT SYSTEM$LINK_ORGANIZATION_USER('etl_pipeline', 'etl_pipeline');+``` 

--- ahttps://docs.snowflake.com/en/user-guide/cortex-code/credit-usage-limit+++ bhttps://docs.snowflake.com/en/user-guide/cortex-code/credit-usage-limit@@ -218,4 +218,15 @@ indicating that the daily credit limit has been reached. The user cannot use that surface until sufficient time has passed for the rolling 24-hour usage to drop below the limit. Other surfaces with separate limits are not affected.++For example, a CoCo CLI user who exceeds their limit sees an error like the following:++```text+Error: Daily credit usage limit reached. Your estimated usage has exceeded the+configured limit for this surface. Please try again later or contact your+account administrator to adjust your limit.+```++In CoCo Desktop, a similar message appears in the chat interface. In %sf-web-interface%, the CoCo panel displays+the error inline.  Administrators can adjust or remove the limit at any time to restore access.