Lutril needs your account identifier and a programmatic access token (PAT) to list, create, and disable Snowflake users and grant roles through the Snowflake REST API. Create the token on a dedicated service user restricted to SECURITYADMIN.
SECURITYADMIN role restriction on the token (covers listing users, CREATE USER, disabling users, and granting roles)
A network policy on the token's user (Snowflake requires one before a PAT can be used)
Setup steps
Sign in to Snowsight as an account administrator. Open Snowsight
In a worksheet, create a dedicated service user and allow it to act as SECURITYADMIN: CREATE USER LUTRIL_SVC TYPE = SERVICE; then GRANT ROLE SECURITYADMIN TO USER LUTRIL_SVC;
Attach a network policy to that user (required for programmatic access tokens): CREATE NETWORK POLICY if you have none, then ALTER USER LUTRIL_SVC SET NETWORK_POLICY = '<policy_name>'. Network policies guide
Go to Governance & Security → Users & Roles, open LUTRIL_SVC, and under Programmatic access tokens click Generate new token. Set the role restriction to SECURITYADMIN, pick an expiry, and copy the token secret immediately (it is shown only once).
Copy your account identifier in the orgname-account_name form: account menu (bottom left) → Account → View account details. Identifier formats
In Lutril, connect Snowflake and paste the Account Identifier and the Programmatic Access Token. Rotate the token before it expires (15 to 365 days).