ODGS Snowflake Bridge

Transform your Snowflake Data Dictionary into active ODGS runtime enforcement schemas.

Snowflake stores your data. ODGS enforces the rules.

The ODGS Snowflake Bridge is an institutional connector that reads Snowflake INFORMATION_SCHEMA metadata and transforms table and column definitions into cryptographically addressable ODGS enforcement schemas. Column constraints, nullability rules, and type assertions become mechanically executable governance rules enforced at pipeline runtime — with full audit trail support via the ODGS S-Cert Registry.

Architecturally aligned with federated data sovereignty principles, and on a path toward standardization.

See it in action

Real bridge, real engine, real ES256-signed rule pack, real Ed25519 audit seal — click to watch on GitHub. Only the snowflake.connector DBAPI boundary is mocked (Snowflake has no REST surface); see examples/marketplace-demo/ for the full honest-accounting demo rig.

Architecture

flowchart LR
    subgraph SF["Snowflake"]
        IS["INFORMATION_SCHEMA"]
        TBL["Tables & Columns"]
        CON["Constraints\n(NOT NULL, Types, VARCHAR lengths)"]
    end

    subgraph Bridge["odgs-snowflake-bridge"]
        T["SnowflakeBridge\n.sync()"]
        TR["Transformer\n→ ODGS Schema"]
    end

    subgraph ODGS["ODGS Protocol (odgs>=6.1.0)"]
        I["Universal Interceptor\nHARD_STOP / SOFT_STOP / WARNING / INFO"]
        WB["Write-Back\n→ Snowflake Table Comments"]
    end

    subgraph MP["Metric Provenance (Commercial)"]
        SC["S-Cert Registry\n(JWS Audit Seal)"]
    end

    IS & TBL & CON --> T --> TR --> I
    I -->|"sovereign_audit.log"| WB --> SF
    I -->|"Certified S-Cert"| SC

Three Rule Types Generated

Note on TYPE_CHECK severity: always INFO regardless of --severity — its logic_expression uses type(), which the ODGS engine's sandboxed evaluator doesn't allow, so it can't actually block a pipeline today (unlike MAX_LENGTH's len(), which the engine does support). Binding TYPE_CHECK for real enforcement needs a custom evaluator extension.

Supports 33+ Snowflake data types including VARIANT, OBJECT, and ARRAY semi-structured types.

Install

pip install odgs-snowflake-bridge

Quick Start

Python API

from odgs_snowflake import SnowflakeBridge

bridge = SnowflakeBridge(
    account="xy12345.eu-west-1",
    user="odgs_service",
    password="...",
    organization="acme_corp",
)

# Sync all tables → ODGS metric definitions
bridge.sync(
    database="PRODUCTION",
    output_dir="./schemas/custom/",
    output_type="metrics",
)

# Sync column constraints → enforcement rules
bridge.sync(
    database="PRODUCTION",
    schema_filter="FINANCE",
    output_dir="./schemas/custom/",
    output_type="rules",
    severity="HARD_STOP",
)

CLI

# Using environment variables
export SNOWFLAKE_ACCOUNT=xy12345.eu-west-1
export SNOWFLAKE_USER=odgs_service
export SNOWFLAKE_PASSWORD=...

odgs-snowflake sync \
    --org acme_corp \
    --database PRODUCTION \
    --schema FINANCE \
    --type rules \
    --severity HARD_STOP

# SSO / Browser authentication
odgs-snowflake sync \
    --account xy12345.eu-west-1 \
    --user user@company.com \
    --authenticator externalbrowser \
    --org acme_corp \
    --database PRODUCTION

# Push compliance results back to Snowflake table comments
odgs-snowflake write-back \
    --log-path ./sovereign_audit.log \
    --account xy12345.eu-west-1 \
    --user odgs_service \
    --password YOUR_PASSWORD

Output Schema

A real table_to_rules() output (--type rules):

{
  "$schema": "https://metricprovenance.com/schemas/odgs/v5",
  "metadata": {
    "source": "snowflake",
    "organization": "acme_corp",
    "bridge": "odgs-snowflake-bridge",
    "bridge_version": "0.4.4",
    "generated_at": "2026-07-23T10:00:00+00:00",
    "tables_processed": 8,
    "items_generated": 47
  },
  "items": [
    {
      "rule_id": "transactions_amount_not_null",
      "rule_urn": "urn:odgs:custom:acme_corp:rule:transactions_amount_not_null",
      "name": "TRANSACTIONS.AMOUNT NOT NULL",
      "description": "Column AMOUNT must not be null",
      "domain": "PRODUCTION.FINANCE",
      "severity": "HARD_STOP",
      "logic_expression": "AMOUNT != None",
      "constraint_type": "NOT_NULL",
      "target_column": "AMOUNT",
      "target_table": "PRODUCTION.FINANCE.TRANSACTIONS",
      "source_authority": "snowflake:PRODUCTION",
      "legislative_source": "BRIDGE_GENERATED_UNATTESTED",
      "semantic_hash": "UNATTESTED",
      "verdict_on_pass": "PASS",
      "content_hash": "a1b2c3...",
      "provenance": {
        "bridge": "odgs-snowflake-bridge",
        "bridge_version": "0.4.4",
        "synced_at": "2026-07-23T10:00:00+00:00",
        "source_url": "snowflake://PRODUCTION.FINANCE.TRANSACTIONS/AMOUNT"
      }
    }
  ]
}

Bi-Directional Write-Backs

The bridge supports Bi-Directional Sync: it parses your sovereign_audit.log offline and pushes compliance results back into Snowflake table comments using ALTER TABLE ... SET COMMENT — creating a deterministic feedback loop for Data Stewards without compromising the air-gapped nature of the core ODGS protocol.

Authentication

Regulatory Alignment

This bridge is designed for organisations governed by:

For cryptographic attestation (Ed25519 JWS audit seals and signed .odgs-bundle Regulation Packs for EU AI Act, DORA, and CSRD), see the Metric Provenance Enterprise Platform.

Get started: metricprovenance.com/executive-brief (Executive Brief) · Certified packs: metricprovenance.com/#suite

Requirements

• Python ≥ 3.9
• odgs ≥ 6.1.0 (core protocol)
• snowflake-connector-python ≥ 3.0.0
• Snowflake account with INFORMATION_SCHEMA access

Related

• ODGS Protocol — The core enforcement engine
• ODGS FLINT Bridge — TNO FLINT legal ontology connector
• ODGS Collibra Bridge — Collibra integration
• ODGS Databricks Bridge — Unity Catalog integration

License

Apache 2.0 — Metric Provenance | The Hague, NL 🇳🇱