Install from Marketplace

Agent Mask installs as a Snowflake Native App with Containers. During installation, Snowflake asks you to grant the application the privileges it needs to create and run its compute resources in your account. The compute pool and container service start on first use.

Start Marketplace Trial See If Agent Mask Fits

Prerequisites

Your Snowflake account needs the following privileges. Agent Mask requests them during installation.

Privilege	Why it’s needed
CREATE COMPUTE POOL	Provisions the GPU compute node that runs the masking service.
BIND SERVICE ENDPOINT	Allows the SQL function to reach the application’s container service.
CREATE WAREHOUSE	Creates a small warehouse for application queries and retention tasks.
EXECUTE TASK	Runs scheduled retention tasks for expired response records.

Install

1. Open the Snowflake Marketplace.
2. Find Agent Mask.
3. Click Get.
4. Accept the 4 privilege grants.
5. Choose a database name for the installed application (default: AGENT_MASK_EN).

Trial access

Agent Mask is offered as a 7-day free trial on the Marketplace. After the trial period expires, the mask() function returns a trial-expired error until paid access is enabled. Contact Agent Mask to continue.

See Trial limits for full details.

First-use cold start (~12 minutes)

The first call to app_public.mask() starts the application’s Snowflake compute resources:

1. Provision the GPU compute node (~1–3 min)
2. Pull the container service image and start the container (~8 min)
3. Start the Agent Mask service (~1 min)

Total: roughly 12 minutes. This first-use wait is mostly Snowflake infrastructure provisioning. Once warm, queries skip the provisioning wait — actual run time depends on input size. The pool auto-suspends after 5 minutes of inactivity to reduce idle compute cost; it auto-resumes on the next query.

You can monitor startup progress via:

CALL app_public.status();

Or open the bundled Streamlit demo at Apps → agent_mask → demo in Snowsight.

Verify install

Run a verification query against the masking function:

SELECT app_public.mask(
  'Patient Robert James O''Brien, SSN 319-72-8845, phone 555-0198'
);

Expected output (after cold start):

Patient [PERSON_1], SSN [US_SSN_1], phone [PHONE_NUMBER_1]

Application roles

Agent Mask creates two application roles you can grant to your own Snowflake roles:

• app_admin — Administrative actions for the app: start/stop the service, scale, configure retention, and run mask().
• app_user — mask(), start_app(), status(), and get_retention(). Cannot stop the app, scale, change service config, or change retention.

GRANT APPLICATION ROLE agent_mask_en.app_admin TO ROLE data_platform;
GRANT APPLICATION ROLE agent_mask_en.app_user TO ROLE analyst;

If you chose a different application database name during installation, replace agent_mask_en in the examples with that name.

Next: Quickstart →