Kevin Keller

Senior Architect & Field CTO

Personal blog about AI, Observability & Data Sovereignty.

Hands-on with Snowflake, PostgreSQL & DuckDB — strategy, architecture, security, AI, and code.

Not feeling like reading? Try my interactive playgrounds!

SQL, Python, Streamlit, JWT & more — right in your browser

Snowflake-related articles explore the art of the possible and are not official Snowflake solutions or endorsed by Snowflake unless explicitly stated. Opinions are my own. Content is meant as educational inspiration, not production guidance.

Building the Agentic Enterprise: From Protocol Hype to Production-Grade AI Agents

19 March 2026·3523 words·17 mins

AI Agents Ai-Agents Agentic-Ai Mcp Enterprise-Ai Strategy Ai-Governance Production

The agentic enterprise is real. But getting there requires a shift from generic protocol-based integrations to purpose-built agents with native tooling, embedded security, and domain-specific intelligence.

Governing AI Inference in the Data Cloud: A Security Architecture Guide for EMEA Enterprises

17 March 2026·5914 words·28 mins

AI Agents Security & Encryption Ai-Governance Security Snowflake Eu-Ai-Act Dora Nis2 Mcp Compliance

A defense-in-depth security architecture for AI agents and inference workloads — covering network isolation, identity propagation, authorization, data protection, and auditing under the EU AI Act, DORA, and NIS2.

Architectural Blueprints

Coming soon — industry-specific and cross-industry architecture patterns.

AI Agents

Cortex Proxy: Use Any AI Coding Agent with Snowflake Cortex - Prompt Policy Enforcement Included

18 March 2026·2253 words·11 mins

AI Agents Snowflake Cortex Rust Proxy Ai-Agents Claude-Code Security Policy-Enforcement

A high-performance Rust proxy that lets Claude Code, Continue.dev, ZeroClaw, Mistral Vibe — or any AI coding agent — use Snowflake Cortex AI models as their backend. Optional prompt policy enforcement included.

Nanocortex: A Blueprint for Building Custom Snowflake Cortex Agents

16 March 2026·4391 words·21 mins

AI Agents Snowflake Cortex Agents Python Llm

How a 1,600-line Python file can teach you everything about the Cortex Agent API

Code Blueprints

Nanocortex: A Blueprint for Building Custom Snowflake Cortex Agents

16 March 2026·4391 words·21 mins

AI Agents Snowflake Cortex Agents Python Llm

How a 1,600-line Python file can teach you everything about the Cortex Agent API

Data Sovereignty

Data Sovereignty First: Integrating an On-Premise Apache Iceberg into Snowflake Through a Direct Outbound Tunnel

16 March 2026·2842 words·14 mins

Data Sovereignty Data-Sovereignty Snowflake Iceberg Duckdb Privacy Compliance

Some data cannot move to the cloud. Here’s how to bring Snowflake’s analytics power to the data — without surrendering control of it.

Query Your On-Premise DataLake Through a Private Tunnel with Snowflake

10 December 2024·3457 words·17 mins

Data Sovereignty Snowflake Hybrid-Cloud Ssh Iceberg Duckdb Spark Spcs Data-Sovereignty

Hybrid Cloud Architecture Series with Snowflake Part 1 — How to setup an SSH tunnel from Snowflake Container Services to query on-premise Iceberg data lakes, databases, APIs, or AI models behind your firewall.

Infrastructure

SPCS Dev Container: A Full Linux IDE Running Inside Snowflake

14 March 2026·1083 words·6 mins

Infrastructure Snowflake Spcs Containers Devcontainer Vscode Development Cloud-Ide

Turn Snowflake Container Services into your personal cloud development environment — VS Code in the browser, web terminal, persistent storage, and direct Snowflake access.

Running Apache NiFi on Snowflake Container Services

13 March 2026·1253 words·6 mins

Infrastructure Snowflake Spcs Nifi Data-Ingestion Containers Jdbc Oauth Cdc

A patched, ready-to-deploy Apache NiFi 2.6.0 on SPCS — with fixes for ingress compatibility, a token debug UI, and a sample PostgreSQL-to-Snowflake CDC flow.

Observability

Ingest OpenTelemetry Logs, Traces and Metrics Directly into Snowflake

9 November 2024·3091 words·15 mins

Observability Opentelemetry Snowflake Observability Iceberg Siem Apm

Build your next generation security and observability Iceberg data lake by ingesting OpenTelemetry data directly into Snowflake

How to Let Snowflake Raise Security Incidents in Your SIEM or XDR Automatically

25 July 2024·2728 words·13 mins

Observability Snowflake Siem Xdr Security Splunk Sentinel Automation

A step-by-step guide to having Snowflake automatically detect failed login attempts and raise incidents in your SIEM or XDR — no external code required.

Security & Encryption

Snowflake OAuth & PAT Toolkit: JWT-to-PAT Exchange for MCP Authentication

15 March 2026·1701 words·8 mins

Security & Encryption Snowflake Oauth Pat Mcp Authentication Security Jwt Python

How to exchange OIDC JWT tokens for short-lived Snowflake PATs and use them as Bearer tokens for MCP server authentication — with automatic rotation and cleanup.

Column-Level Encryption for Snowflake Using Postgres as an On-Premise Crypto Proxy

20 December 2024·1786 words·9 mins

Security & Encryption Snowflake Encryption Postgres Security Data-Sovereignty Aes Compliance

How to use Postgres 17 as a transparent encryption proxy so that data stored in Snowflake is always AES-256 encrypted at the column level — with your own key, under your own control.

Decrypting PGP Files Inside Snowflake: Zero-Infrastructure MFT Ingestion

14 December 2024·2910 words·14 mins

Security & Encryption Snowflake Pgp Gpg Encryption Mft Python-Udf Data-Ingestion Security

How to decrypt PGP/GPG-encrypted files directly inside Snowflake using Python UDFs and the pgpy library — no external compute, no middleware, no key in transit.

Python Camouflage: Format-Preserving Encryption for Snowflake Using FF3-1

15 November 2024·1742 words·9 mins

Security & Encryption Snowflake Encryption Tokenization Fpe Ff3 Python-Udf Masking-Policy Compliance Data-Sovereignty

Tokenize PII in Snowflake so that encrypted data still looks and behaves like real data — joinable, sortable, format-correct — all with your own AES-256 key, enforced through tag-based masking policies.

↑

Kevin Keller

Senior Architect & Field CTO

Strategic Whitepapers

Building the Agentic Enterprise: From Protocol Hype to Production-Grade AI Agents

Governing AI Inference in the Data Cloud: A Security Architecture Guide for EMEA Enterprises

Architectural Blueprints

AI Agents

Cortex Proxy: Use Any AI Coding Agent with Snowflake Cortex - Prompt Policy Enforcement Included

Nanocortex: A Blueprint for Building Custom Snowflake Cortex Agents

Code Blueprints

Nanocortex: A Blueprint for Building Custom Snowflake Cortex Agents

Data Sovereignty

Data Sovereignty First: Integrating an On-Premise Apache Iceberg into Snowflake Through a Direct Outbound Tunnel

Query Your On-Premise DataLake Through a Private Tunnel with Snowflake

Infrastructure

SPCS Dev Container: A Full Linux IDE Running Inside Snowflake

Running Apache NiFi on Snowflake Container Services

Observability

Ingest OpenTelemetry Logs, Traces and Metrics Directly into Snowflake

How to Let Snowflake Raise Security Incidents in Your SIEM or XDR Automatically

Security & Encryption

Snowflake OAuth & PAT Toolkit: JWT-to-PAT Exchange for MCP Authentication

Column-Level Encryption for Snowflake Using Postgres as an On-Premise Crypto Proxy

Decrypting PGP Files Inside Snowflake: Zero-Infrastructure MFT Ingestion

Python Camouflage: Format-Preserving Encryption for Snowflake Using FF3-1

AI Agents

Containing AI Agents: A Defense-in-Depth Architecture for Production