Snowflake is becoming an agentic control plane.

Sits before any model and before any consequential effect. Reads consequence and routes each call to the proof it warrants. It does not replace the proof architecture. It conducts it.

Marks the spans of a request that need context, proof or permission, and preserves the user’s words byte for byte. The selected authority binds into the receipt before submit, so intent is recorded evidence rather than later recollection.

Commits the assembled prompt window before the model runs, so what the model was shown is a fixed object rather than a later reconstruction.

Wraps the call in a signed envelope declaring identity, intent and budget before inference runs. The claim travels with the record once it leaves Snowflake.

Signs a clearance before the call runs and refuses any call without a valid unexpired pass. The check is proven up front, not inferred from a log afterwards.

Binds every inference into a hash-chained attestation epoch anchored to hardware evidence and a Hive nonce. Startup attestation becomes per-call attestation.

Signs the decision itself, meaning model, inputs and outcome, into one ML-DSA-65 receipt anchored on Base. The atom of the whole stack.

Signs which model actually served each turn of a persistent thread and detects substitution against the model you contracted for, scoring identity instability across the thread. A long-lived thread is exactly where a silent model swap hides. Asserts model identity and continuity only, never output quality.

Breaks the request into signed routable sub-tasks and signs each fragment inside the inference path, so a multi-step answer is provable at fragment level.

Proves what a document model read, where on the page, and at what confidence. The extracted value stays bound to its source region.

Signs tool scope, action, context mutation and reward around every autonomous step. The workflow becomes an audit trail, not a transcript.

Follows the agent across every model, provider, tool and payment stop, each emitting its own receipt. Route proof, not just a final answer.

Binds container image, kernel modules, package index, egress ACL and GPU firmware into a Merkle heartbeat chained across the life of the environment.

Signs agent-instance mints, trajectories and coherence as FIPS 204 receipts, so inherited authority stays attributable.

Compares the approved action tuple against the one actually delivered. Match and the gateway countersigns. Any change, replay, wrong destination or broken chain is recorded as a delta.

A chained Merkle ledger of every refusal-policy change, with a Pedersen commitment and zk-SNARK bond proving the runtime policy sat inside a published band at the moment it mattered, without disclosing the policy.

Additive Pedersen commitments meter outbound exposure by semantic class, covering credential, PII, model weight, test data and plaintext, against caps committed in advance.

Every egress-attempt receipt embeds the SHA-256 of the compiled eBPF enforcement bytecode, so a silent gap between the declared perimeter and the running one is visible.

Investigation runs under a threshold-signed k-of-n credential and every model call under it is replay-bonded, so the investigation is itself evidence.

Consequential actions in weekend, on-call, after-hours and incident windows require k-of-n countersigning from distributed attestors, with k raised as oversight thins.

Rolls the receipts for one event into a single signed decision vector: verification depth, weakest boundary, recoverability, next action. One answer, not a pile of fragments.

Binds the conditions under which a data product was produced, covering credentials, session, tools and output, so a consumer can check origin without trusting the distributor.

Reconstructs the exact route and cue-delta without revealing the prompt, the data or the words. Auditability and confidentiality stop being a trade.

Spectral-signed settlement receipts with on-chain verification and an MCP endpoint, so payment carries the same standard of evidence as the decision behind it.

A searchable index across every receipted event, queryable by sequence, event type and time. It is the convenience layer and not the proof. Each row points back to a receipt that verifies on its own, so if the ledger is unreachable the receipts still check.

Snowflake orchestrates the container. It does not attest to a third party that the image which ran is still the image you approved. Provenance-Bonded Sandbox signs a manifest of the container, kernel, packages, ACL and GPU firmware before the work starts, then keeps a signed heartbeat while it runs, so drift has a timestamp instead of an assumption.

Cortex Guard enforces the filter. Refusal Ledger proves which version of the filter was in force at the moment of one specific decision, and that nobody widened it quietly and dated the change backward. It does this as a signed append-only chain over the policy mutations, without publishing the policy itself.

Not operating the loop is the product benefit, and it is also why you cannot see inside it. Howler fires a signed alarm from within that loop when the agent drifts off the task it was given, reaches for a capability it was never scoped for, or takes on context that should not be there. The alarm is a receipt, so the warning is itself evidence.

Policy governs who may come in. Integrations open a way out from inside handler code. Perimeter Bond binds the permitted reach underneath the application and signs every refused attempt together with the exact bytecode that judged it, so the answer to whether an agent ever touched an unapproved host does not depend on the agent’s own account of itself.

Scheduled and externally triggered work runs in exactly the windows where the fewest people are looking. Diurnal Bond declares the risk regime in advance and signs it, then raises the number of independent attestations required before an action may run once the clock crosses into a low-oversight window. Fewer eyes means more proof.

Sharing decides who may read. Unloading moves bytes out of the account. Egress Bond commits, before the run starts, to a cap on what may leave by class of data, then signs the measurement against that commitment. A breach names the class that broke it and the run can be invalidated after the fact, which is a control rather than a subsequent discovery.

Access History is the platform’s account of its own access, read with platform privileges by whoever holds them. Forensic Rail issues a bonded credential that requires several independent approvers, bounds the session so that looking cannot turn into acting, and makes the analysis replay byte for byte. The investigation becomes an exhibit instead of a claim.