Canot exit scan

Scope

Platform: Snowflake
Scope: account ab98765, database PROD
Privilege level: 3 (+ privileges and tools (pseudonymized))
SQL mode: read-only
Reads: 5 done out of 19
Content read: 3 tables, 3 objects, 6 query families
Versions: canot X, duckdb X, sqlglot X

Capabilities

This report is an inventory: inventoried, neither exported nor replayed.

Level	This report	Canot on Snowflake
Inventory	done by this scan (level 3)	full, levels 1 to 3
Export	not done by this scan	iceberg, with canot drill
Evidence	not done by this scan	P1 data parity; P2 query replay, with canot drill

Snowflake connector: tested; recorded test: canot drill, 2026-10-17: Snowflake trial account, TPC-H SF10 (docs/banc-essai.md).

What Canot cannot prove here: the declared forms (P1, P2) cover tables and queries; objects to rebuild besides tables are counted, not proven.

Observed costs

Window: 365 days. Credits measured; in dollars, only with the price provided or a dated list-price range.

Item	Value	Nature and basis
Credits consumed	Not read: METERING_DAILY_HISTORY not read: missing privilege.	not read
In dollars	Not estimated: credits not read.	not estimated

Storage

Item	Value	Nature and basis
Average billed storage	Not read: STORAGE_USAGE not read: missing privilege.	not read
Storage in dollars	Not estimated: your contract price not read.	not estimated

Movements

0 frozen, 0 live, 1 recreated, 2 not determined.

recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read. Based on: S01.

Table	Type	Volume	Movement	Evidence
PROD.MART.KPI	TABLE	not read	recreated	last DDL on 2026-10-16, writes not read
PROD.RAW.ARCHIVE_2019	TABLE	not read	not determined	writes not read
PROD.RAW.ORDERS	TABLE	not read	not determined	writes not read

What does not leave with the copy

Objects to rebuild or describe

Type	Count	Examples
procedure	1	PROD.MART.SP_HIDDEN
task	1	PROD.OPS.T_NIGHTLY
view	1	PROD.MART.V_REVENUE

Routines per language: NOT READ 1.

Columns with a platform-specific type (1)

Table	Column	Type
PROD.RAW.ORDERS	doc	VARIANT

Billed history

Item	Value	Nature and basis
Time Travel and Fail-safe (0 tables)	Not read: TABLE_STORAGE_METRICS not read: missing privilege.	not read

Dependencies

Tools seen in queries

Tool	Families	Executions
dbt	1	40
unidentified	4	21
tableau	1	2

Query replayability

Category	Meaning	Families	Executions	Weight
C0	translated and accepted by DuckDB	0	0	0.00 credits
C1	not parseable	0	0	0.00 credits
C2	command, not analyzed	1	1	0.00 credits
C3	translation impossible	0	0	0.00 credits
C4	DuckDB parse error	1	5	not read
C5	binding error (platform-specific object or function)	0	0	0.00 credits
C6	variable	0	0	0.00 credits
C7	DDL, COPY, MERGE, metadata queries: counted separately	1	3	0.20 credits

Item	Value	Nature and basis
C0 rate, by families	0.0%	computed translated and accepted by DuckDB (C0) / C0 to C6; C7 counted separately
C0 rate, by executions	0.0%	computed translated and accepted by DuckDB (C0) / C0 to C6; C7 counted separately
C0 rate, weighted	Not estimated: no testable family.	not estimated

Based on: 0/2 families, window not read, sqlglot X, duckdb X.

accepted ≠ identical result. Translated to DuckDB, not compared.

3 families not tested; 1 family containing a secret, counted then set aside.

Platform-specific functions

Function	Families
moteur:LAST_QUERY_ID	1
moteur:MY_UDF	1
moteur:RESULT_SCAN	1
stage	1
tablefromrows	1

Most executed families (normalized forms)

Category	Executions	Tool	Normalized form
	40	dbt	`SELECT o.id, o.amount FROM CANOT_LAB.RAW.ORDERS AS o WHERE o.id > ?`
	12		`SELECT COUNT(*) FROM CANOT_LAB.RAW.ORDERS WHERE id = ?`
C4	5		`SELECT * FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()))`
C7	3		`COPY INTO @CANOT_LAB.EXT.S3_PUBLIC/out/ FROM (SELECT * FROM CANOT_LAB.RAW.ORDERS)`
	2	tableau	`SELECT MY_UDF(id) FROM CANOT_LAB.RAW.ARCHIVE_1`
C2	1		`EXECUTE`

Ranges

Planning estimates: each range carries its assumptions. A canot drill replaces the assumed throughput with a measurement.

Item	Value	Nature and basis
Volume to copy	Not read: TABLE_STORAGE_METRICS not read: missing privilege.	not read
Copy read time	Not estimated: volume not read.	not estimated
Copy read credits	Not estimated: volume not read.	not estimated
Copy read cost	Not estimated: credits not read.	not estimated
Rework	0.8 d to 5.0 d 3 objects to rebuild and 1 column with a platform-specific type q4o assumptions: 0.25 to 1.5 day per object, 0.1 to 0.5 per column, open to discussion	estimated, low confidence · S02, S09, S10, S11 objects × days per object + columns × days per column

Findings

Each finding is labeled "To review", with no severity level. It states what is observed and what is not.

F11 · Scheduled chain and its failuresTo review

1 finding

Target	Observed
object PROD.OPS.T_NIGHTLY	Task, schedule USING CRON 0 1 * * * UTC, state started; runs not read.

F12 · Incomplete readTo review

15 findings

Target	Observed
read S03	TABLE_STORAGE_METRICS not read (missing privilege); limits: active bytes and history (F05, F06, F07, ranges).
read S04	STORAGE_USAGE not read (missing privilege); limits: average billed storage.
read S05	METERING_DAILY_HISTORY not read (missing privilege); limits: credits per service.
read S06	WAREHOUSE_METERING_HISTORY not read (missing privilege); limits: credits per warehouse.
read S07	TABLE_DML_HISTORY not read (missing privilege); limits: latest writes (movement).
read S08	TABLE_QUERY_PRUNING_HISTORY not read (missing privilege); limits: fallback for reads per table (F05).
read S12	TASK_HISTORY not read (timed out); limits: task runs and failures (F11).
read S13	QUERY_HISTORY not read (privilege level not requested); limits: query families, replayability, observed writes (F03).
read S14	ACCESS_HISTORY not read (privilege level not requested); limits: reads per object: F05 not computed; edition not determined (Standard or missing privilege).
read S15	POLICY_REFERENCES not read (privilege level not requested); limits: applied policies (F10).
read S16	TAG_REFERENCES not read (privilege level not requested); limits: tags (F10).
read S17	GRANTS_TO_ROLES not read (privilege level not requested); limits: owner roles with no holder (F04).
read S18	GRANTS_TO_USERS not read (privilege level not requested); limits: owner roles with no holder (F04).
read S19	SHARES not read (privilege level not requested); limits: external consumers (F09).
read code_des_routines	Code not read for 1 routine (filtered by privileges or not provided); limits: dynamic SQL (F08).

No finding for: F01, F02, F03, F04, F05, F06, F07, F08, F09, F10. An absence of findings only holds for the reads done (see F12 and the method).

What this report does not quantify

Average billed storage: STORAGE_USAGE not read: missing privilege.
Storage cost: your contract price not read.
Credits consumed: METERING_DAILY_HISTORY not read: missing privilege.
Credits in dollars: credits not read.
Volume to copy: TABLE_STORAGE_METRICS not read: missing privilege.
Copy read time: volume not read.
Copy read credits: volume not read.
Copy read cost: credits not read.
Billed history: TABLE_STORAGE_METRICS not read: missing privilege.
Your contract rate: your contract price not read.
Destination storage, running both platforms in parallel, operations after the exit: depend on your contract and your architecture.
Identical results of translated queries: accepted ≠ identical result: translated to DuckDB, not compared; a canot drill compares the results.
Cost projections provided by the platform: not used: they cannot be verified from the scan.

Method

5 reads done out of 19. Each read is recorded with its status and its reason; a value that was not read stays empty, never 0.

Id	View	Status	Reason	Rows	Latency
S03	TABLE_STORAGE_METRICS	not read	missing privilege; limits: active bytes and history (F05, F06, F07, ranges)	not read
S04	STORAGE_USAGE	not read	missing privilege; limits: average billed storage	not read
S05	METERING_DAILY_HISTORY	not read	missing privilege; limits: credits per service	not read
S06	WAREHOUSE_METERING_HISTORY	not read	missing privilege; limits: credits per warehouse	not read
S07	TABLE_DML_HISTORY	not read	missing privilege; limits: latest writes (movement)	not read
S08	TABLE_QUERY_PRUNING_HISTORY	not read	missing privilege; limits: fallback for reads per table (F05)	not read
S12	TASK_HISTORY	not read	timed out; limits: task runs and failures (F11)	not read
S13	QUERY_HISTORY	not read	privilege level not requested; limits: query families, replayability, observed writes (F03)	not read
S14	ACCESS_HISTORY	not read	privilege level not requested; limits: reads per object: F05 not computed; edition not determined (Standard or missing privilege)	not read
S15	POLICY_REFERENCES	not read	privilege level not requested; limits: applied policies (F10)	not read
S16	TAG_REFERENCES	not read	privilege level not requested; limits: tags (F10)	not read
S17	GRANTS_TO_ROLES	not read	privilege level not requested; limits: owner roles with no holder (F04)	not read
S18	GRANTS_TO_USERS	not read	privilege level not requested; limits: owner roles with no holder (F04)	not read
S19	SHARES	not read	privilege level not requested; limits: external consumers (F09)	not read
S01	TABLES	read		10	1.5 h
S02	COLUMNS	read		10
S09	VIEWS	read		10
S10	PROCEDURES	read		10
S11	TASKS	read		10

Privileges used

Level 3: SNOWFLAKE.OBJECT_VIEWER, SNOWFLAKE.USAGE_VIEWER, SNOWFLAKE.GOVERNANCE_VIEWER, SNOWFLAKE.SECURITY_VIEWER. Never requested: IMPORTED PRIVILEGES, MANAGE GRANTS, IMPORT SHARE, USAGE on functions, READ on stages.

Cost of the scan

Item	Value	Nature and basis
Queries sent	12 queries one read = one query	computed · S01, S02, S03, S04, S05, S06 … reads attempted, read or refused by the platform
Read time	Not read: duration not provided by collection.	not read

Safeguards

Every SQL statement sent goes through a read-only guard: only SELECT, SHOW, DESCRIBE and ALTER SESSION SET statements go out. No write, no API activation, no parameter change.
Query users and roles pseudonymized with HMAC, using a salt drawn for this scan and never written; tag values hashed; locations reduced to the bucket.
Raw SQL text is never written: only normalized forms, with literals masked, leave collection.

Rules

Movement: recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read.
Storage with no read: actual window of the view read, compared with 365 days; the blind spots of each view are listed in the finding.
Copy time: assumed throughput of 20 to 80 MB/s.
List prices are dated and sourced; they do not replace your contract price.

Next steps

This report describes your platform; it recommends neither leaving nor staying.

To measure an exit on a chosen scope: canot drill copies to Apache Iceberg, compares source and copy, and signs an evidence report.

To go further, the q4o assessment, from €22,000 excl. VAT: your contract rate, actual execution, scenarios, the steps to follow. canot.io

Exit scan: Snowflake

CIO

CFO

CISO