Snowflake CoCo for Google Sheets preview runs live queries under your role

1 hour ago

7 min read

Cover with the title Snowflake CoCo for Google Sheets preview runs live queries under your role over a teal city skyline. Data Studios original cover

Snowflake released Snowflake CoCo for Google Sheets in preview on November 3, 2026, adding its AI agent as a chat pane inside a Google Sheets spreadsheet that is connected to live Snowflake data. From that pane an analyst can ask a question in natural language or write SQL, load the results into the sheet, and ask CoCo to build pivot tables, charts and formulas. Snowflake's release note lists the add-on as a preview, and the documentation marks it "Preview Feature — Open" and available to all accounts.

The design choice that will interest data owners most is that every query runs under the signed-in user's own Snowflake role. Role-based access control, masking policies and row access policies therefore apply to whatever lands in the spreadsheet, so a sheet built with CoCo shows the same rows and masked columns that the user would see in Snowsight. Each change CoCo proposes appears as a before-and-after preview and is written only after the user selects Accept, and each written value gets a citation recorded in a hidden sheet.

During this stage of the preview there is no Google Workspace Marketplace listing. The add-on is distributed as an Apps Script file that each user copies into each spreadsheet, and an account administrator has to create an OAuth security integration in Snowflake before anyone can sign in.

··········

WHAT SNOWFLAKE COCO FOR GOOGLE SHEETS DOES IN A SPREADSHEET.

Snowflake describes CoCo as an AI-driven agent integrated into the Snowflake platform for data engineering, analytics, machine learning and agent building. The Google Sheets add-on is part of the same product and, according to the documentation, brings the capabilities of the other CoCo experiences into the spreadsheet. CoCo in Snowsight, CoCo Desktop and the CoCo CLI are generally available; the two spreadsheet integrations, one for Google Sheets and one for Microsoft's spreadsheet application, are both in preview.

Inside Google Sheets, the documented capabilities cover querying with natural language or SQL with live results loaded into the sheet, schema exploration (including a /catalog command), and use of the semantic views the user's role can access. CoCo can also build pivot tables, charts and formulas, apply formatting and conditional formatting, add data validation, sort, run find and replace, create named ranges, and manage rows, columns and sheets. Skills are invoked with a slash, and /feedback sends feedback to Snowflake.

For BI teams that already publish governed semantic views, the ability to work from those views is the most practical part of the feature. An operations analyst or a sales manager who lives in Google Sheets can pull a metric defined once in Snowflake instead of exporting a CSV and rebuilding the logic in a formula, and the data team keeps one definition. Users who already explore warehouse data from spreadsheets through Google's own tooling can compare this approach with conversational analytics in Connected Sheets for BigQuery, which Google made generally available in October.

........

Item	Snowflake CoCo for Google Sheets (preview)
Released	November 3, 2026, preview
Preview type	Open, available to all accounts
Where it runs	Google Sheets in a desktop web browser
Mobile apps	Not supported on Android or iOS
Distribution	Apps Script file per spreadsheet
Marketplace listing	Planned for a later preview stage
Sign-in	OAuth only, no programmatic access tokens
Billing	Token consumption, no per-seat license
Compute and storage	Billed separately at on-demand rates

........

··········

INSTALLING THE COCO APPS SCRIPT ADD-ON IN GOOGLE SHEETS.

The preview installation is manual. In the target spreadsheet the user opens Extensions > Apps Script, renames the project to CoCo for Sheets, replaces the Code.gs and appsscript.json files with the ones Snowflake provides, saves and reloads the spreadsheet. The pane then opens from Extensions > CoCo for Sheets > Open Coco, and the script asks for authorization on first use.

Because the script lives inside a single spreadsheet's Apps Script project, it can access only that spreadsheet, and a user who wants CoCo in five workbooks has to repeat the copy five times. Snowflake states that after the Marketplace release a Google Workspace administrator will be able to install the add-on for the whole organization so that users no longer copy the script. Until then, teams running a pilot should keep a short internal procedure and a controlled copy of the two files, since unofficial copies circulating by email are hard to audit.

A few interface constraints are documented. The sidebar has a fixed width of 300 pixels, and the pane has to be reopened after every reload of the spreadsheet. Google Sheets' own total cell limit applies to everything CoCo writes, and empty columns count toward it. CoCo warns in the preview when it would delete trailing empty columns to make room, and it refuses an import that does not fit.

··········

SNOWFLAKE OAUTH SETUP FOR COCO IN GOOGLE SHEETS.

On the Snowflake side, an administrator with the ACCOUNTADMIN role or the global CREATE INTEGRATION privilege creates one OAuth security integration per account. The same integration can be shared with the spreadsheet add-on for Microsoft's application. The documented integration is a custom public client that enforces PKCE, issues refresh tokens valid for 86,400 seconds (24 hours) and uses a fixed redirect URI. Snowflake notes that the URI contains the word "excel" because both spreadsheet add-ons share the same callback page, and that it must match exactly.

CREATE SECURITY INTEGRATION IF NOT EXISTS coco_sheets_oauth
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'PUBLIC'
  OAUTH_REDIRECT_URI = 'https://ai.snowflake.com/static/excel/oauth/callback.html'
  OAUTH_ENFORCE_PKCE = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 86400
  ENABLED = TRUE
  COMMENT = 'OAuth for Snowflake CoCo spreadsheet add-ons';

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('COCO_SHEETS_OAUTH');

The documentation recommends CREATE SECURITY INTEGRATION IF NOT EXISTS over CREATE OR REPLACE, because replacing the integration generates a new client ID, invalidates refresh tokens and signs out every user. The SYSTEM$SHOW_OAUTH_CLIENT_SECRETS call returns the client ID that users need, and the integration name passed to it must be in uppercase. By default ACCOUNTADMIN, ORGADMIN, GLOBALORGADMIN and SECURITYADMIN cannot authenticate through OAuth, and the ALLOWED_ROLES_LIST parameter can narrow the allowed roles further, which is a sensible default for a tool that writes query results into shared spreadsheets.

Users sign in from the pane with their account identifier, the OAuth client ID and an optional role. They select Sign in with Snowflake, copy a one-time code that is valid for about a minute, paste it and select Finish sign-in. The role can be changed later under More > Settings > Role. Sign-in tokens stay in the browser pane, the Apps Script code never receives them and has no permission to make network requests, and the pane connects to Snowflake directly from the browser, so Snowflake network policies evaluate the user's own IP address. Teams with strict network policies should confirm that the addresses their analysts work from are allowed.

CoCo itself has to be enabled for the account. The CoCo administration documentation states that ACCOUNTADMIN, or an equivalent role, enables it from the CoCo Admin page in Snowsight, and that access is granted through the CORTEX_AGENT_USER database role (CoCo and Cortex Agents only) or CORTEX_USER (all Cortex AI features). Cross-region inference, controlled by the CORTEX_ENABLED_CROSS_REGION account parameter, is required for the Google Sheets add-on only when the model the user selects is not available in the account's region.

··········

PREVIEWS, CITATIONS AND LIMITS OF COCO IN GOOGLE SHEETS.

Every write CoCo proposes is shown as a before-and-after preview, and nothing changes in the spreadsheet until the user selects Accept. Undo behavior depends on the change: a single value change takes one undo, while structural edits and large batched results can take several steps. Each written value receives a citation stored in a hidden sheet named _CORTEX_CITATIONS, which gives reviewers a way to trace a number back to its Snowflake source, a pattern Snowflake also uses in CoWork Deep Research with cited sources.

The Google Sheets version is narrower than its counterpart for Microsoft's spreadsheet application. The CORTEX cell functions, such as =CORTEX.ASK(), are not available, and neither is intelligent refresh, which covers the Refresh data action, the /refresh command and the Refresh when this workbook opens option. Data loaded into Google Sheets does not refresh automatically, so a sheet built on Monday shows Monday's numbers until someone asks CoCo to run the query again.

........

Capability	Google Sheets add-on
Natural-language and SQL queries	Yes
Semantic views of the user's role	Yes
Pivot tables, charts, formulas	Yes
Before-and-after preview with Accept	Yes
Per-value citations	Yes, in _CORTEX_CITATIONS
CORTEX cell functions	No
Intelligent or automatic refresh	No
Android and iOS apps	No

........

Analysts who compare this with Google's own assistant features in Sheets will find a different scope: Gemini in Google Sheets works on the data already in the spreadsheet, while CoCo starts from governed tables and semantic views in Snowflake and writes the results into the sheet.

··········

COCO FOR GOOGLE SHEETS COSTS AND USAGE MONITORING.

Snowflake bills the Google Sheets add-on by token consumption, with no separate per-seat license. Token rates are published in the Snowflake Service Consumption Table, and the integration documentation does not quote specific credit rates. Warehouse compute used by the queries and storage are billed separately at standard on-demand rates, so a pilot has two cost lines to watch: AI tokens and the warehouse that executes the SQL CoCo generates.

Daily limits can be set through credit usage limits. Usage of the spreadsheet integration appears in CORTEX_CODE_CLI_USAGE_HISTORY, and SNOWFLAKE_COCO_USAGE_HISTORY covers all CoCo surfaces, which lets an administrator separate spreadsheet usage from Snowsight or CLI usage before deciding whether to widen the rollout. Assigning a small, dedicated warehouse to pilot users is a simple way to keep the compute side visible.

··········

SNOWFLAKE COCO IN GOOGLE SHEETS: READY FOR A PILOT, NOT YET FOR RECURRING REPORTS.

Snowflake confirms the open preview for all accounts, the Apps Script installation, OAuth-only sign-in through a PKCE public client, query execution under the user's role with masking and row access policies applied, before-and-after previews, per-value citations and token-based billing with warehouse costs on top. Those facts are enough to start a controlled pilot with a restricted role list and a dedicated warehouse.

Several points depend on the account. Whether cross-region inference has to be enabled depends on the model the user picks and on the account's region, and access depends on which roles hold CORTEX_AGENT_USER or CORTEX_USER and on the ALLOWED_ROLES_LIST of the integration. Network policies are evaluated against each user's own IP address.

Snowflake has not published a date for the Marketplace listing or for general availability, specific row or file-size limits beyond Google Sheets' cell limit, or credit rates in the integration page itself. Teams evaluating it should also keep in mind that loaded data does not refresh on its own, which makes the add-on better suited to ad hoc analysis than to recurring reports for now. Snowflake's broader AI document features, such as AI_EXTRACT for 1,000-page documents, follow the same preview-first pattern.

··········

·····

DATA STUDIOS

·····

datastudios.org