Which Snowflake role can manage any object grant globally, including modifying and revoking grants?

The SECURITYADMIN role is explicitly designed to manage security across the entire Snowflake account. This role is granted the MANAGE GRANTS privilege by default, which allows it to modify or revoke any access grant in the account. This global capability enables a clear separation of duties, where the SECURITYADMIN can oversee and audit all permissions, independent of the roles that own the objects (like SYSADMIN) or manage users (like USERADMIN).

A. USERADMIN: This role is focused on creating and managing users and roles. It does not have the authority to manage object grants globally.
B. ORGADMIN: This role operates at the organization level to manage accounts. It does not have permissions to manage object grants within an individual account.
C. SYSADMIN: This role creates and manages account-level objects like warehouses and databases. It can grant privileges on objects it owns but cannot globally manage grants made by other roles.

1. Snowflake Documentation: System-Defined Roles.

Section: Overview of System-Defined Roles

Content: "SECURITYADMIN: Role that can manage any object grant globally. This role is granted the MANAGE GRANTS security privilege to allow it to modify any grant, including revoking it."

2. Snowflake Documentation: Access control privileges.

Section: Global Privileges > MANAGE GRANTS

Content: "Enables a role to modify any existing grant and revoke any grant. Only the SECURITYADMIN and ACCOUNTADMIN roles have this privilege by default." This confirms the unique capability of the SECURITYADMIN role.