KnowBe4 Demo — Technical Build Plan
Goal: Build the teaser + fallback demo end-to-end in a phData-side Snowflake environment, mirroring KB4's data shape (security-awareness domain), so the workshop has a bulletproof reference and the live build can fall back to it. Pipeline mirrors Gary's: sample data → semantic view (Cortex Code accelerated) → Cortex Analyst model → Snowflake Intelligence activation → custom Snowflake MCP → Claude Cowork connector → RBAC.
Current state (verified 2026-06-26, this machine)
- snow CLI: INSTALLED (
/opt/homebrew/bin/snow, v3.21.0 — installed 2026-06-26 eve via brew). ✓ - No Snowflake account/sandbox connection wired yet (no
~/.snowflakeconfig). This is the only remaining blocker. - So, honest answer to "do you have access to a Snowflake env + snow CLI": CLI yes (just installed); a Snowflake account/connection not yet — needs an account + credentials (Step 0 decision below). Any creds go through 1Password/Keychain, never a
.envon disk. Once an account is picked:snow connection add+snow connection testand we're live.
STEP 0 — Environment decision (the fork — need your pick)
| Option A — phData Snowflake sandbox | Option B — fresh Snowflake trial (on the mini) | |
|---|---|---|
| What | The real "our env"; you likely have access as a phData employee. | A clean 30-day Snowflake trial account you own, for the learning build. |
| Pros | Real, Cortex features enabled, what the team/Gary actually use; no porting. | Isolated, you own it, ideal for learning + cert prep, no phData-governance entanglement, I can drive it fully from the mini. |
| Cons | phData infra — I'd need a connection path + creds; governance considerations for an agent on the mini touching it. | Separate from the real demo env; the build would need porting to phData's env for the actual workshop. Confirm Cortex Analyst / Intelligence are available on the trial tier. |
| Best for | The actual team demo (lives here eventually, via Gary). | Your "build it myself to learn the stack" goal. |
My recommendation: build your learning version in Option B (a trial, fully drivable from the mini), keep it portable, and bring it to Gary to merge into the phData env (Option A) for the real workshop. That gets you hands-on the entire stack (great cert prep) without stepping on phData governance, and gives Gary a second reference build to blend.
Build sequence (env-independent once Step 0 is picked)
- Tooling — install snow CLI on the mini (
brew install snowflake-clioruv tool install snowflake-cli-labs); wire the connection to the chosen account; creds in Keychain/1Password. Verify withsnow connection test. - Bronze — sample data. Load representative security-awareness data mirroring KB4's shape: users, accounts, simulated-phishing campaigns, phishing events, training modules, risk scores, departments. Synthetic but realistic. (Snowflake sample DBs + a generated overlay.)
- Silver — model events + entities (the ontology from the workshop): entities (user, account, campaign, training module, department) + events (phish-sent, clicked, reported, training-completed, risk-score-change). Build the silver tables/views with enforced-style modeling.
- Gold — semantic view(s). Define reusable semantic view(s) over silver. Use Cortex Code (CoCo) to accelerate the definition (and to demo the AI-assisted build itself).
- Cortex Analyst model. Author the semantic-model YAML (logical tables, dimensions, facts, metrics, relationships, synonyms); test NL→governed SQL on the chosen activation question. Embed in Snowflake Intelligence as activation #1.
- Custom Snowflake MCP. Stand up the MCP server exposing the semantic layer as typed tools (search / get / query grounding assets). Constraint: must be internet-reachable from Anthropic IP ranges (hosting TBD — note this dependency).
- Claude Cowork connector + RBAC. Connect Cowork to the MCP via Custom Connector (OAuth + URL); enforce Snowflake RBAC so the Cowork agent is gated by roles (demo: a restricted role sees less). This is the destination from the teaser.
Open dependencies / what I need from you
- Step 0 pick: Option A (phData sandbox + connection path) or B (spin a trial — recommended). On your "go for B," I install snow + set up the trial connection tonight/this weekend and start the build.
- Cortex availability confirm (esp. if B): Cortex Analyst + Snowflake Intelligence on the chosen tier/region.
- MCP hosting: where the custom MCP runs so it's reachable from Anthropic IPs (a small always-on host; we have the quick-sites/Cloudflare pattern to lean on).
Risk notes
- The MCP→Cowork→RBAC leg is the differentiator AND the part with real pre-build effort (hosting + OAuth). Start it early; don't leave it to demo morning.
- Keep the build portable (DDL + YAML + MCP code in a repo) so it ports cleanly from a trial into phData's env.