Overview

Casabase Cube provides administrative capabilities for managing application access, data security, governance, auditing, application lifecycle, cube lifecycle, and ongoing operations.

Because Casabase Cube runs as a Snowflake Native App, administration is divided between Snowflake-level responsibilities and capabilities provided within Casabase Cube.

Snowflake administrators control:

• Application-role assignments
• Account-level privileges granted to the application
• Access to customer source tables and stages
• Snowflake identity and role management

Casabase Cube administrators manage:

• Cube and dimension configuration
• Row-level security
• Formulas and application settings
• Data classification
• Saved Queries and schedules
• Audit history
• Application health and diagnostics
• Cube lifecycle operations
• Operational tasks

Administrative Roles

Casabase Cube provides two primary application roles:

Role	Purpose
CUBE_PUBLIC	Query and discovery access to Casabase Cube.
CUBE_ADMIN	Modeling and administrative access. Inherits CUBE_PUBLIC.

CUBE_PUBLIC is intended for users, applications, and service identities that need to query cube data or use supported discovery capabilities.

CUBE_ADMIN adds the capabilities required to configure and administer Casabase Cube.

Application roles are granted to Snowflake account roles.

For example:

GRANT APPLICATION ROLE
    CASABASE_CUBE.CUBE_PUBLIC
TO ROLE ANALYST;

GRANT APPLICATION ROLE
    CASABASE_CUBE.CUBE_ADMIN
TO ROLE CUBE_ADMINISTRATOR;

Substitute your installed application name for:

CASABASE_CUBE

where appropriate.

See Roles and Privileges for application roles, required Snowflake privileges, source-data grants, and optional AI access.

Application Privileges

Casabase Cube uses two account-level Snowflake privileges for supported application functionality:

READ SESSION
EXECUTE MANAGED TASK

READ SESSION allows Casabase Cube to evaluate Snowflake session context, including CURRENT_USER(), for functionality such as row-level security and Query Builder user context.

EXECUTE MANAGED TASK allows supported scheduled operations to run as Snowflake serverless managed tasks.

Customer source objects are made available separately through explicit grants such as:

USAGE
SELECT
READ

Casabase Cube does not automatically receive access to arbitrary objects in the customer’s Snowflake environment.

Optional Cortex functionality also requires:

SNOWFLAKE.CORTEX_USER

See Roles and Privileges.

Access Control

Casabase Cube provides row-level security for restricting the cube data available to individual Snowflake users.

Security rules are defined against members of secured cube dimensions.

For example:

Total Entity
├── North America
│   ├── United States
│   └── Canada
├── Europe
└── Asia Pacific

A user granted:

North America

receives full-value access to that member and its descendants.

Security Is Opt-In Per User

Casabase Cube row-level security is opt-in per user.

Security filtering applies when:

1. Security is enabled on at least one dimension of the cube.
2. The user has at least one active security rule for that cube.

A user with application access but no active security rules is unrestricted by Casabase Cube row-level security.

Conceptually:

Security Enabled?
       │
       ├── No ──► No Row-Level Filtering
       │
       └── Yes
              │
              ▼
Active Rule for User?
       │
       ├── No ──► Unrestricted
       │
       └── Yes ──► Apply Security

This distinction is important during access reviews. Enabling security on a cube does not automatically restrict every user who can query it.

Security-Aware Aggregation

Security is applied before aggregation and formula evaluation.

A restricted user can therefore see an ancestor above the permitted branch while receiving a value calculated only from permitted descendants.

Conceptually:

Requested Members
       │
       ▼
Apply User Security
       │
       ▼
Permitted Leaf Scope
       │
       ▼
Aggregation
       │
       ▼
Formula Evaluation
       │
       ▼
User Result

This produces partial rollups for restricted users where appropriate.

The same aggregate member can therefore have different valid values for users with different security scopes.

See Access Control for security configuration, partial rollups, security modes, rule management, and access-review controls.

Data Classification

Data Classification provides governance metadata describing the sensitivity or business classification of a cube.

Supported classifications are:

PUBLIC
INTERNAL
CONFIDENTIAL
RESTRICTED

Classification is a governance label, not an access-control mechanism.

For example:

FINANCE
    │
    ├── Classification: CONFIDENTIAL
    │
    └── Security: Configured Separately

Assigning CONFIDENTIAL or RESTRICTED does not automatically:

• Enable row-level security
• Create security rules
• Change application-role assignments
• Filter query results

Administrators should review classification together with actual application access and security configuration.

Use:

CALL CUBE.GET_DATA_INVENTORY();

to review cube classification, security coverage, and recent usage.

See Data Classification.

Compliance and Privacy

Casabase Cube provides administrative information that can support an organization’s governance, privacy, security, and compliance processes.

Use:

CALL CUBE.GET_PRIVACY_REPORT();

to generate the application privacy and governance report.

The report includes information about:

• Cube and classification coverage
• Row-level security coverage
• Audit history
• Governance recommendations
• Application data-handling posture

Casabase Cube reports its application data-handling posture as:

data_egress           NONE
external_connections  NONE
pii_collection        NONE
telemetry             DISABLED

Core Casabase Cube processing occurs inside the customer’s Snowflake environment.

The Privacy Report and other administrative outputs provide application-level evidence. They should not be interpreted as compliance certification for a particular regulatory framework or standard.

See Compliance and Privacy.

Audit Log

Casabase Cube maintains an application-level audit log of significant administrative and data-access activity.

Audit information can include:

• User
• Event type
• Action
• Affected object
• Cube
• Status
• Execution time
• Rows processed
• Error information
• Event-specific details
• Timestamp

Use:

CALL CUBE.GET_AUDIT_SUMMARY(30);

for a summarized view of recent activity.

Use:

CALL CUBE.EXPORT_AUDIT_LOG(
    NULL,
    NULL,
    NULL,
    NULL,
    1000
);

for detailed audit records.

Audit history remains inside the customer’s Snowflake environment and persists across application upgrades.

Retention is managed explicitly through:

PURGE_AUDIT_LOG

with a dry-run option available before records are deleted.

See Audit Log for event types, investigation workflows, export, and retention.

Application Upgrades

Casabase Cube follows the Snowflake Native App application lifecycle.

When the installed application moves to a new version, Casabase Cube performs the required application migrations and rebuilds managed structures while preserving customer-specific application state.

Examples of state that persists include:

• Cubes
• Dimension definitions
• Formulas
• Data
• Security rules
• Data classifications
• Saved Queries
• Schedules
• Audit history

Upgrade activity is recorded through events such as:

APP_UPGRADE
UPGRADE_MIGRATION

An important operational behavior is that an individual cube migration can require attention even when the overall application upgrade completes successfully.

Administrators should therefore validate the environment after an upgrade.

A typical sequence is:

Confirm Version
       │
       ▼
Review Upgrade Events
       │
       ▼
Run HEALTH_CHECK
       │
       ▼
Run Known Verification Query
       │
       ▼
Check Scheduled Queries
       │
       ▼
Validate Customer-Owned Dependencies

See Application Upgrades for the complete upgrade and validation process.

Health and Diagnostics

Casabase Cube provides health and diagnostic procedures for validating application state and investigating operational or performance issues.

The primary health check is:

CALL CUBE.HEALTH_CHECK(NULL);

This can validate areas such as:

• Dimension structures
• Source configuration
• Query support objects
• Data freshness
• Configuration integrity
• Formula syntax and safety
• AI-agent freshness

For support diagnostics, use:

CALL CUBE.GENERATE_SUPPORT_INFO(NULL);

Casabase Cube also provides performance-analysis capabilities including:

PERFORMANCE_REPORT
SLOW_QUERY_INSPECTOR
FORMULA_COST_ESTIMATOR
RECOMMEND_CLUSTERING
RECOMMEND_SEARCH_OPTIMIZATION

The recommendation procedures report optimization opportunities for administrator review rather than silently applying physical changes.

See Health and Diagnostics.

Cube Lifecycle

Casabase Cube provides administrative operations for managing cubes throughout their lifecycle.

These include:

Clone
Export / Import Configuration
Drop

These operations are separate from the Configuration section, which focuses on defining and maintaining the multidimensional model itself.

Conceptually:

                         Cube
                          │
        ┌─────────────────┼─────────────────┐
        │                 │                 │
        ▼                 ▼                 ▼
      Clone        Export / Import         Drop
        │            Configuration           │
        ▼                 │                 ▼
   New Cube               ▼          Remove Cube
                    Portable Model
                    Configuration

Cloning a Cube

Use:

CUBE.CLONE_CUBE

to create a new cube from an existing cube.

Cloning supports two behaviors.

With:

P_REBUILD = TRUE

Casabase Cube:

• Copies the cube configuration
• Rebuilds the target dimensions
• Copies the source fact table

The result is a populated replica.

With:

P_REBUILD = FALSE

Casabase Cube:

• Copies the cube configuration
• Leaves the target dimensions inactive until rebuilt
• Does not copy the fact table

The result is an empty replica.

Conceptually:

Source Cube
     │
     ▼
 CLONE_CUBE
     │
 ┌───┴──────────────────────┐
 │                          │
 ▼                          ▼
P_REBUILD = TRUE        P_REBUILD = FALSE
 │                          │
 ▼                          ▼
Populated Replica        Empty Replica

Cloned security rules should be reviewed before the target cube is made available to users.

See Cloning a Cube.

Exporting and Importing Configuration

Use:

EXPORT_CUBE_CONFIG
IMPORT_CUBE_CONFIG

to preserve or move cube configuration independently of its business data.

Configuration export can include information such as:

• Dimension definitions
• Formulas
• Saved Queries
• Cube variables
• Configuration metadata

Configuration export does not include:

• Cube fact data
• Contents of dimension definition tables
• Row-level security grants
• Source data files

This makes export/import useful for:

• Configuration backup
• Environment promotion
• Version control
• Configuration recovery
• Reusable model definitions

Conceptually:

Cube
 │
 ▼
EXPORT_CUBE_CONFIG
 │
 ▼
Configuration JSON
 │
 ▼
IMPORT_CUBE_CONFIG
 │
 ▼
Target Configuration

Referenced Snowflake objects must exist and be accessible in the target environment where required.

See Exporting & Importing Configuration.

Dropping a Cube

Use:

CUBE.DROP_CUBE

when a cube is no longer required.

DROP_CUBE uses an explicit confirmation model.

With:

P_CONFIRM = FALSE

the procedure performs a dry run and returns a summary of what would be removed without making changes.

With:

P_CONFIRM = TRUE

the cube and its associated Casabase Cube objects are permanently removed.

A safe workflow is:

Export Required Configuration
        │
        ▼
DROP_CUBE(FALSE)
        │
        ▼
Review Preview
        │
        ▼
Confirm Cube Name
        │
        ▼
DROP_CUBE(TRUE)

Dropping a cube should not be confused with:

CLEAR_CUBE_DATA

which removes data from a cube’s fact table while preserving the cube structure.

See Dropping a Cube.

Lifecycle Operations Compared

Operation	Primary Purpose	Configuration	Fact Data
Clone, P_REBUILD = TRUE	Create a populated replica	Copied	Copied
Clone, P_REBUILD = FALSE	Create an empty replica	Copied	Not copied
Export / Import	Preserve or move configuration	Exported as JSON	Not included
Drop Cube	Permanently remove a cube	Removed	Cube is removed
Clear Cube Data	Empty an existing cube while preserving its model	Preserved	Removed

This distinction helps administrators choose the appropriate lifecycle operation rather than using destructive operations where a configuration-only or data-only operation is intended.

Operational Tasks

Routine administration focuses on the logical application rather than maintaining a separate OLAP infrastructure stack.

Typical operational responsibilities include:

• Rebuilding dimensions after dimension-source changes
• Monitoring asynchronous operations
• Reviewing serverless task history
• Recovering stale build locks
• Exporting cube configuration
• Creating dimension snapshots
• Reviewing application health
• Reviewing audit activity
• Monitoring scheduled queries
• Performing security and governance reviews
• Managing cube lifecycle operations

For example:

CALL CUBE.REBUILD_DIMENSIONS(
    'FINANCE',
    FALSE,
    FALSE,
    FALSE
);

rebuilds dimensions selected by the normal rebuild configuration.

Use:

CALL CUBE.EXPORT_CUBE_CONFIG('FINANCE');

to capture cube structure and settings before significant changes.

Configuration export does not contain cube fact data.

See Operational Tasks for rebuilds, task monitoring, build locks, configuration backup, dimension snapshots, and recurring administrative reviews.

Administrative Responsibility Model

Casabase Cube administration builds on Snowflake’s security and governance model rather than replacing it.

At a high level:

Snowflake
│
├── Identity and Authentication
├── Account Roles
├── Application Role Grants
├── Account-Level Application Privileges
├── Source-Object Grants
└── Platform Security / Governance
        │
        ▼
Casabase Cube
│
├── Cube and Dimension Configuration
├── Row-Level Security
├── Data Classification
├── Saved Queries and Schedules
├── Audit History
├── Application Lifecycle
├── Cube Lifecycle
├── Health and Diagnostics
└── Operational Administration

Snowflake controls the underlying platform and access boundary.

Casabase Cube provides the application-specific controls required to administer multidimensional models within that environment.

Administrative Control Layers

It is useful to distinguish the major administrative controls:

Snowflake Account Roles
        │
        ▼
Who can receive application access?


Application Roles
        │
        ▼
What can the user do?


Row-Level Security
        │
        ▼
Which cube data can the user see?


Data Classification
        │
        ▼
How should the cube be governed?


Audit Log
        │
        ▼
What activity occurred?

These controls work together but serve different purposes.

For example, assigning:

RESTRICTED

to a cube does not create security rules.

Similarly, deleting a user’s final active security rule does not remove application access. If the user still inherits CUBE_PUBLIC or CUBE_ADMIN, the user becomes unrestricted by Casabase Cube row-level security.

Initial Administrative Workflow

For a new Casabase Cube environment, a typical sequence is:

Grant Required Application Privileges
        │
        ▼
Grant Required Source Access
        │
        ▼
Assign Application Roles
        │
        ▼
Configure Cubes and Dimensions
        │
        ▼
Classify Production Cubes
        │
        ▼
Determine Security Requirements
        │
        ▼
Configure User Security Rules
        │
        ▼
Validate Restricted and Unrestricted Access
        │
        ▼
Establish Audit Retention
        │
        ▼
Validate Application Health
        │
        ▼
Begin Ongoing Administration

Not every environment uses every optional capability. For example, Cortex privileges are required only when the associated AI functionality is used.

Ongoing Administrative Review

A practical recurring review includes:

HEALTH_CHECK
       │
       ▼
Audit Summary
       │
       ▼
Data Inventory
       │
       ▼
Security Review
       │
       ▼
Scheduled Query Review
       │
       ▼
Configuration Backup

Broader periodic reviews can additionally include:

• Privacy reporting
• CUBE_ADMIN membership
• Application account grants
• Audit retention
• Performance reporting
• Physical optimization recommendations
• Cubes with no recent query activity
• Review of obsolete or unused cubes
• Review of whether important cube configurations are backed up

The exact review frequency should follow the organization’s operational, security, and governance requirements.

Key Administrative Principles

Casabase Cube administration is based on several important principles:

Application Access
        ≠
Row-Level Security

Data Classification
        ≠
Access Enforcement

Security Enabled
        +
No Active User Rule
        =
Unrestricted User

Security Scope
        │
        ▼
Aggregation and Formulas

Configuration Backup
        ≠
Fact Data Backup

Clone with P_REBUILD = FALSE
        =
Configuration Without Fact Data

DROP_CUBE
        ≠
CLEAR_CUBE_DATA

Successful App Upgrade
        ≠
Every Cube Migration Verified

Understanding these distinctions prevents many of the most common administrative mistakes.

Related Topics

• Roles and Privileges
• Access Control
• Data Classification
• Compliance and Privacy
• Audit Log
• Application Upgrades
• Health and Diagnostics
• Operational Tasks
• Cloning a Cube
• Exporting & Importing Configuration
• Dropping a Cube