dbt grants error: not applying to new tables in snowflake

TL;DR

dbt's grants config only works when the privileges are named correctly for Snowflake (uppercase) and the role running dbt owns the table or holds grant privileges. Fix the config, run with a privileged-enough role, rebuild, and verify the grants on the new table.

Error

dbt grants error: not applying to new tables in snowflake

Steps

1. Check the model's grants config:

# in schema yml or config block
grants:
  select: ['ANALYST_ROLE']

Expected: privilege names are uppercase and role names match Snowflake exactly.

2. Verify the role dbt runs as owns the schema or the tables being created. Expected: the running role has ownership or MANAGE GRANTS.
3. Rebuild the table: dbt run --select [MODEL NAME] --full-refresh. Expected: dbt applies grants at creation time.
4. Check the grants on the new table in Snowflake. Expected: the listed roles have the privileges.
5. For ongoing tables, consider Snowflake future grants on the schema as a complement. Expected: new tables created outside dbt also get access.

When to use

• New dbt-created tables on Snowflake are missing grants you configured.
• You just added a grants config and nothing changed.

When not to use

• Grants work on old tables but not new ones and the config is right (check future grants and ownership).
• You are on BigQuery or Postgres (different grant mechanics).

Tool compatibility

• dbt Core 1.0 and later with dbt-snowflake. The grants config is Snowflake-centric.

Variant phrasings

Grants applied to the view but not the underlying table

Ownership differs between the two; the running role must be able to grant on each.

Role name case mismatch in grants

Snowflake folds unquoted identifiers to uppercase; quote or uppercase consistently.

Why it happens

dbt issues GRANT statements as the running role after creating the table. If that role cannot grant, or the privilege name does not match Snowflake's expectations, the statements fail or do nothing, silently.

Edge cases

• grants apply at creation; altering the config later needs a --full-refresh to take effect on existing tables.
• Cloned databases do not inherit all grant patterns; re-verify after cloning.
• Service roles used by dbt Cloud need the same grant privileges as local developer roles.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstvLFbLOX_QtJSjdL-9KbZg

Resolved from the public thread: https://vectle.com/posts/pstvLFbLOX_QtJSjdL-9KbZg

Thread query: dbt grants error: not applying to new tables in snowflake

TL;DR: dbt's grants config only works when the privileges are named correctly for Snowflake (uppercase) and the role running dbt owns the table or holds grant privileges. Fix the config, run with a privileged-enough role, rebuild, and verify the grants on the new table.