Snowflake HTML reports preview shares CoCo data snapshots by role

Snowflake has put HTML reports into public preview, a new way to turn an analysis built with CoCo into a single self-contained HTML file and publish it to colleagues as a Report artifact. The release note is dated November 4, 2026, and the documentation lists the feature as a preview available to all accounts. A report can be generated with CoCo in Snowsight Workspaces, in CoCo Desktop, or in Snowflake CoWork through an agent with code execution enabled, and it is shared with specific users or roles inside the same Snowflake account.

The design choice that analysts and administrators need to understand first is the data model. A published report carries an embedded snapshot of its query results. Opening it does not rerun any query with the viewer's role and does not need a warehouse, which means anyone granted view access can read the numbers inside the report even if they have no privileges on the source tables. Snowflake's documentation says so directly and advises reviewing the content and the intended audience before publishing.

··········

WHAT SNOWFLAKE HTML REPORTS ARE.

An HTML report is one .html file that holds its HTML, CSS and JavaScript together. In Workspaces the editable source stays in the author's workspace, while the published version opens in an artifact view for recipients. Snowflake describes three typical uses: static presentation reports that combine query results, charts and summary statistics; slide-style reports made of full-bleed sections that scroll like a deck, meant for asynchronous updates; and designed data narratives such as onboarding guides, OKR pages or findings briefs with interactive charts.

Charts inside a report are interactive but drawn from the saved data in the file, and the report can contain links that a reader opens by clicking. Everything else must be self-contained, as the sandbox rules described further down require.

........

Item	HTML reports (preview)
Release note date	November 4, 2026
Status	Public preview, all accounts
Authoring surfaces	Workspaces, CoCo Desktop, CoWork
File format	One self-contained .html file
Data in the artifact	Embedded snapshot
Warehouse to open	Not required
Sharing privilege	MANAGE ACCESS ON REPORT ARTIFACTS
Scheduled refresh	Not supported
Price	Not disclosed for reports

........

··········

HOW COCO BUILDS AN HTML REPORT IN SNOWSIGHT WORKSPACES.

In Snowsight the path is Projects » Workspaces, then either Report from the new file menu or a chat with CoCo. The author describes the data, the structure and the charts wanted, then reviews the queries CoCo runs and the report it generates. CoCo saves the .html file to the workspace automatically, and the author can iterate on it before anything is published. A request might look like the following prompt, which keeps the scope, the grain and the chart types explicit so the generated queries are easy to audit.

Build an HTML report on weekly orders for Q3 2026 from ANALYTICS.SALES.ORDERS.
Sections: 1) summary statistics (total orders, revenue, average order value),
2) a line chart of weekly revenue, 3) a bar chart of revenue by region,
4) a table of the ten largest customers by revenue.
Show me every SQL query before you embed its results.

Editing offers three modes: Preview for rendered text and static content while charts stay visible, No JavaScript for content that scripts would replace at render time, and Code for the HTML, CSS and JavaScript source. Save updates the workspace file only; the published artifact changes when the author publishes again.

Refreshing follows the same logic. The author opens the source file, selects Refresh report, reviews or edits the refresh instructions, selects Refresh and checks the result. CoCo updates the data and the source file, and a new publish pushes the update to recipients. The artifact link stays the same across republishes and always points to the latest published version, never to unpublished edits.

Outside Workspaces, a CoWork agent with code execution enabled can generate the HTML, and the user selects Publish artifact on the result, since generating the file alone shares nothing. In CoCo Desktop the user opens the HTML file, selects Publish artifact and chooses who gets access. The same assistant also runs inside spreadsheets, as covered in Snowflake CoCo for Google Sheets preview runs live queries under your role.

··········

SHARING REPORT ARTIFACTS: ROLES, PRIVILEGES AND THE DATA SNAPSHOT.

Publishing creates a single Report artifact for the whole account, shared by every surface. Recipients can open it in Snowsight under Projects » Artifacts, in CoWork or in CoCo Desktop, and the same grants apply everywhere. In the sharing dialog the default is owner-only; the author adds roles or users under Who has access and picks Can view, which maps to the READ privilege, or Can publish, which maps to WRITE and lets the recipient update the artifact. Users are found by Snowflake username. A link on its own grants nothing: recipients must sign in to the same account and hold access through a role or a grant to their personal role.

Snowflake's artifact model separates query-backed artifacts from saved-content artifacts, and the table below summarizes the documented behavior.

........

Artifact type	How content is supplied	Viewer needs source-data privileges
Dashboard	Queries run with caller's rights	Yes, checked at query time
Chart	Queries run with caller's rights	Yes, checked at query time
Report	Static snapshot embedded in the file	No
File	Saved static file (PDF, PowerPoint)	No
Thread	Snapshot of a CoWork conversation	No

........

For a BI team the consequence is concrete. A dashboard artifact checks each viewer's own data privileges when its queries run. A report freezes whatever the author's role could see when the report was created or refreshed, and every recipient sees that same content. Snowflake also notes that later changes to source data or to source-data privileges do not update saved content that already exists. A report built by a role with broad access and shared to PUBLIC would expose those numbers to every user in the account, since granting READ to PUBLIC makes a report visible to all account users.

Administrators control sharing per artifact type with account-level privileges: MANAGE ACCESS ON REPORT ARTIFACTS for reports, with matching privileges for dashboards, charts, files and threads. Where Snowflake's artifact sharing behavior change is enabled, all five are granted to PUBLIC by default. Snowflake's documentation shows how to restrict one type; adapted to reports, the pattern looks like this.

REVOKE MANAGE ACCESS ON REPORT ARTIFACTS
  ON ACCOUNT FROM ROLE PUBLIC;

GRANT MANAGE ACCESS ON REPORT ARTIFACTS
  ON ACCOUNT TO ROLE artifact_sharer;

Restricting the privilege leaves existing artifact grants in place. Sharing also requires authority over the specific artifact, and only the owner can view or change access in the Share dialog. An ACCOUNTADMIN can switch off the account-wide Sharing artifacts and chats setting under Data controls in the CoWork settings in Snowsight; when it is off, new sharing is blocked and non-owners lose access even with existing grants, although the grants themselves are not removed. A dropped artifact cannot be restored with UNDROP. SHOW ARTIFACTS, DESCRIBE ARTIFACT and GRANT OWNERSHIP ON ARTIFACT are listed as coming soon, and artifact grants do not appear in SHOW GRANTS output.

··········

SECURITY SANDBOX AND PREVIEW LIMITS OF SNOWFLAKE HTML REPORTS.

Reports run in a strict sandbox under a strict content security policy, and the rules apply to every report, whether CoCo generated it or a user uploaded the HTML. Loading scripts from a CDN, calling external APIs and loading remote images are blocked, as are inline event-handler attributes such as onclick and onload; scripts must use addEventListener instead. Allowed code is limited to the report's inline scripts and vendored libraries, including Chart.js, Plotly cartesian charts, D3, Vega and Vega-Lite for charts, Mermaid for diagrams, Three.js for 3D, and Marked, highlight.js and KaTeX for text, code and math.

The preview has clear gaps that matter for anyone thinking of replacing a scheduled BI deliverable. Data does not refresh automatically. There is no scheduled refresh and no scheduled delivery through Slack, Microsoft Teams or email. Reports larger than the account's artifact file-size limit must be reduced before publishing, for example by compressing embedded images, and the documentation does not state the numeric limit. Recipients do not automatically get edit access to the source file. Printing is available from the artifact view, including the browser's save-as-PDF option.

··········

COCO ACCESS AND CREDIT LIMITS BEHIND HTML REPORTS.

Creating and refreshing a report in Snowsight requires CoCo access. According to Snowflake's CoCo documentation, the active role needs SNOWFLAKE.CORTEX_USER or the narrower SNOWFLAKE.CORTEX_AGENT_USER, plus SNOWFLAKE.COPILOT_USER until behavior change BCR-2445 reaches the account. SNOWFLAKE.CORTEX_USER is granted to PUBLIC by default. CoCo in Snowsight is not available in the Azure East US (Virginia) region, even with cross-region inference enabled.

Spending is governed by the parameter CORTEX_CODE_SNOWSIGHT_DAILY_EST_CREDIT_LIMIT_PER_USER. Its default of -1 means no limit, 0 blocks CoCo, and a positive value blocks a user once estimated credit usage over the past 24 hours exceeds it. The documentation's examples set an account-wide value and a per-user override.

ALTER ACCOUNT SET CORTEX_CODE_SNOWSIGHT_DAILY_EST_CREDIT_LIMIT_PER_USER = 20;
ALTER USER jsmith SET CORTEX_CODE_SNOWSIGHT_DAILY_EST_CREDIT_LIMIT_PER_USER = 10;

Snowflake does not publish a separate price for HTML reports. Viewing a published report needs no warehouse, while generating and refreshing it uses CoCo, which runs queries and consumes AI credits under the limits above. Budget controls for the related agent features are described in Snowflake CoWork Deep Research now cites web sources next to your data.

··········

WHAT TO CHECK BEFORE USING HTML REPORTS FOR BI DISTRIBUTION.

The first check is the author's role. Because the snapshot reflects what that role could read, reports meant for broad audiences should be built by a role whose access matches the audience, or the queries should aggregate away sensitive rows before CoCo embeds them. The second check is the sharing privilege: if the behavior change has granted MANAGE ACCESS ON REPORT ARTIFACTS to PUBLIC, an administrator may want to move it to a dedicated role before the preview spreads. The third check is the SQL CoCo shows: comparing its totals with a certified dashboard catches a wrong join or filter before a number goes out under the team's name.

Analysts comparing agent-built reporting across vendors will recognize the pattern from OpenAI's Data agent in ChatGPT Work, which also produces interactive dashboards from warehouse data. The Snowflake approach keeps the file, the grants and the audit trail inside the account, and the semantic layer work announced the same week, described in Snowflake semantic views get FIXED, INCLUDE and EXCLUDE LOD metrics, is the kind of governed definition a CoCo-built report can draw on.

··········

SNOWFLAKE HTML REPORTS: SNAPSHOT SHARING AND OPEN QUESTIONS.

Snowflake confirms that HTML reports are in public preview for all accounts, built with CoCo in Workspaces, CoCo Desktop or CoWork and shared as one Report artifact by user or role. The artifact embeds a data snapshot, opens without a warehouse, can be read by recipients who lack access to the source tables, and changes only when someone refreshes the source and publishes again.

What depends on the account is CoCo access through the Cortex database roles, the region (Azure East US is excluded for CoCo in Snowsight), the per-user daily credit limit, and how administrators have configured the MANAGE ACCESS privileges and the account-wide sharing switch. What Snowflake has not disclosed is a general availability date, a price specific to reports, the numeric artifact file-size limit and any plan for scheduled refresh or delivery. Until those arrive, HTML reports fit one-off briefs, findings documents and periodic updates that an analyst refreshes by hand, while recurring, permission-sensitive distribution stays better served by query-backed dashboards.

··········

FOLLOW US FOR MORE.

·····

DATA STUDIOS

·····

datastudios.org