06-reference/research

cortex agent cross tenant marketplace publish

2026-09-23·research-brief·source: deep-research·by Ray Data Co (deep-research synthesis)
snowflakecortex-agentsnative-appssnowflake-marketplacephdata

Yes, There Is a Today-Shippable Cross-Tenant Path, But Only One of the Two Is Generally Available: Native Apps Carrying a Cortex Agent Went GA 2026-08-07, While Direct Agent Sharing Is Still Open Preview

The question

"Is there a today-shippable cross-tenant path to publish a phData Cortex Agent (or agent + skills bundle) to Snowflake Marketplace / as a Native App so a different org's CoWork surfaces it, and what is the partner listing / validation / security-review process?"

This is open follow-up #2 from [[2026-07-08-cortex-agent-cowork-skill-native-publish]], which confirmed in-account surfacing but left the cross-tenant publish path explicitly UNCONFIRMED. Closing that gap is the whole point of this brief. Naming note for traceability: the internal phData program that older vault docs call "CAF" was renamed on 2026-08-10; the current framing is the Organizational Intelligence (OI) umbrella.

Headline: As of 2026-09-23, Snowflake documents two distinct cross-tenant paths. Packaging a Cortex Agent inside a Snowflake Native App is generally available (GA) as of the 2026-08-07 release note, the app-created agent appears in the consumer's Snowflake CoWork, and it travels through the standard Native App listing chain (automated security scan triggered by DISTRIBUTION = EXTERNAL, then a Marketplace Operations functional review). Directly sharing a standalone agent object via a share or listing is documented but carries a Preview Feature - Open banner, and it explicitly cannot carry skills, procedures, or Model Context Protocol (MCP) connector tools. So the "agent + skills bundle" half of the question splits: skills ride the Native App path, not the direct-share path.

What we already know (from the vault)

What the web says

Convergences and contradictions

Synthesis for RDCO

The productized-accelerator motion the parent brief called premature is now buildable, and the load-bearing change is the packaging unit, not the agent. Between 2026-07-08 and today, the answer flipped from "no documented path" to "GA path, one specific shape." The shape is an application package, not an agent object: the accelerator becomes a Snowflake Native App whose setup script runs CREATE AGENT, ships its own semantic views, Cortex Search services, procedures and skills, and installs into a client account where the agent shows up in that client's CoWork alongside their own agents. That is a genuinely different artifact from what phData's delivery spine produces today. The spine ends at a deployed agent in the client's account; the listing motion ends at a versioned, security-scanned app package with a manifest that declares every privilege it needs. For a Deal Solutions Architect and Technical Account Lead, the new competencies are application-package versioning, the restricted-caller's-rights grant model, and manifest privilege declaration, none of which appear in the current create-agent to deploy workflow.

The precise claim to make, and the two claims to avoid. Sayable today: "we can package the accelerator as a Snowflake Native App that creates a Cortex Agent in your account, distribute it through a Marketplace or private listing, and your users reach it in CoWork." Not sayable: (1) "we can publish the agent object itself to the Marketplace," since that path still carries an open-preview banner and drops skills, procedures and MCP connectors; (2) "your teams will discover our skills in the Skill Catalog," since the Skill Catalog has no release note at all. The distinction is commercially real, because the preview path is the cheap one (a GRANT USAGE ON AGENT ... TO SHARE plus linked-object grants) and the GA path is the expensive one (build an app, pass a security scan, pass a human functional review). Anyone reading only a Summit announcement or a partner blog would collapse those and over-promise the cheap path.

The review chain is the real cost line, and it is a company-level motion, not a project-level one. Automated security scan plus a Marketplace Operations human install-and-test means a listed accelerator has a release process with an external gate, a regression surface across app versions, and an owner for re-submission. That is a product-management function, which lands squarely on the Organizational Intelligence umbrella rather than on any single engagement. It also suggests a staging strategy worth pricing separately: use a private listing to a named client account as the first cross-tenant step and keep public Marketplace exposure as a later decision, since a private listing avoids public discovery even if it does not obviously avoid the security scan (see follow-ups). The Cortex-specific requirements are cheap to satisfy but easy to fail on review: declare SNOWFLAKE.CORTEX_USER rather than broad imported privileges, document any pinned model name in the listing, and never prompt for the consumer's Snowflake credentials.

One partner-standing correction to carry forward. The stricter gate found in the listing guidelines (Snowflake Partner Network membership, AI Data Cloud Products Partner Program enrollment, Connected Application Select tier or higher, Connection String Identifier, Security and Data Handling Attestation, ten-business-day review) belongs to the Connected Application track, not the Native App track. phData's public Elite Consulting Partner standing per [[2026-09-11-phdata-snowflake-partnership-warm-start-map]] is a services tier and should not be presented as satisfying, or as required by, the Native App listing path. Conflating the two tracks would put a fabricated prerequisite into a deal conversation.

Why this is in the vault

It closes the single unconfirmed item that gated the packaging half of [[2026-07-08-cortex-agent-cowork-skill-native-publish]]: whether phData can build reusable Cortex accelerators as distributable intellectual property or only as per-account builds. The answer changes the artifact an Organizational Intelligence accelerator has to produce (an application package, security-scanned and functionally reviewed) and gives the DSA a precise GA-versus-preview line so a client conversation does not promise the open-preview agent-sharing path as shippable.

Open follow-ups

Related

Sources

Vault:

Web (all Snowflake primary documentation, read 2026-09-23):