GES-C02 Gen AI deep review — September 29, 2026

The guide now separates data authorization, tool prechecks, execution failures, parser return types and measured extraction quality. Its exact public Python workbook passed 43 local checks; 48 answered original study prompts support eight proposed cloud labs. Independent human review and actual Snowflake execution remain pending.

Scope and primary evidence

The complete public certification page supplies four abilities and recommends one or more years of enterprise Snowflake Gen AI experience. Python is described as possible proficiency, while prior SQL/data-engineering knowledge is assumed. The embedded detailed-guide request form was inspected but not submitted; targeted primary-domain searches did not recover a current detailed PDF. No weights, question count, duration or real-exam language were inferred.

The objective digest remains c6dcc5ab29e74f1ba7c2778039589727d42e249a5b732ff57bbbd323cf002a25. The previously missing lifecycle baseline was explicitly initialized after review at b565c133e609b421cbbfc40fe150e7b6e30375fb9cea2a1aaef4f867e3c34dad; the post-initialization monitor reported both unchanged. The current certification catalog independently verifies USD 225 Specialty pricing. Program policies, practice terms and exam booking details remain distinct.

The actual five-page GenAI training PDF was fully read and retained with a binary/page receipt. It carries code 26F15/copyright 2026 despite the older filename. Fourteen teaching areas span GenAI, functions, multimodal work, Cortex Code, documents, Search, Analyst, CoWork, Agents, knowledge extensions, fine-tuning, observability, security and cost. Its two-day role course and prerequisite modules support learning, not detailed exam weights. The public course listing separately supplies 16 hours; no class was booked or attended.

Product contracts and dated changes

Cortex Search query access is an owner’s-rights boundary. Service usage can expose indexed data to callers who cannot select the source tables. The guide therefore requires a restricted corpus/service audience or trusted application enforcement without direct bypass; a freely selected tenant filter is not sufficient. The local example applies trusted-role authorization before ranking and limiting, while explicitly avoiding a claim to emulate Search.

The general Agents page contains inconsistent shorthand about inaccessible tools. The dedicated handling reference, read throughout its main content, resolves it: accept is the default, reject and legacy are optional, and the precheck excludes some execution-time failures. Discovery can omit unavailable tools silently. Serving named versions must be updated intentionally. The access setup reference establishes the documented default-role/default-warehouse path; broad inherited privileges must be considered.

September 16 agent-object enhancements distinguish secure specification metadata from actual tool/data authorization. The August 28 Analyst transition is a recommendation for Agents, not retirement of the existing Analyst REST API. Both main announcements were read.

The AI_PARSE_DOCUMENT SQL contract has default OCR mode and a JSON-formatted string result, with row failures normally returning null. Error-detail mode instead returns an object wrapper with value/error/metadata. Selected page ranges imply splitting and retain original page provenance. The legacy function remains a compatibility surface with end-of-2026 deprecation documented; the guide uses the canonical function for new work. No SQL/parser request was executed.

Extraction scores are optional, with per-entity-field but aggregate list/table scores. Their May 22 GA notice includes fine-tuned extraction models and no additional score charge; the underlying call still consumes resources. Our application guidance distinguishes confidence from correctness and measures labeled accepted precision and coverage. The September 21 AI Function Evaluation announcement is public preview, not GA or inspected account availability. Generated labels and model judges need a validated rubric and repeatability evidence.

Selected container lifecycle and Model Registry privilege sections establish finite jobs without automatic container restart, long-running services, warehouse USAGE versus container/metadata READ, and UI visibility versus API-supported model types. Previously reviewed primary function-access, model-transition, bundle, legacy-notebook and resource-monitor sources were re-fetched; reading boundaries and same-session reuse are recorded per source. No account grants, bundle settings, containers, notebooks, logging or resource controls were changed.

Executed local workbook

The exact public standard-library code ran on Python 3.13.14 with an in-memory SQLite database. All 43 checks passed. The code hash, stdout, interpreter, final values and scope are attached to ADLC_Docs/operations/2026-09-29-ges-c02-deep-review.json.

Two synthetic tenants demonstrate why filtering an unrestricted top-one result can discard the allowed candidate. The fixed retrieval query authorizes before ranking, caches by trusted role/revision/limit and clears cached text after successful changes. Exact replay does not alter state. A fault after writes but before commit rolls back; stale publication and tenant reassignment fail without changing the cache. A newer version replaces old chunks, deletion removes A’s chunks, and revocation prevents B retrieval and current citations. The remaining B chunk stays stored but inaccessible to its revoked role.

Citation checks establish current source/chunk/version access, not semantic entailment. Hostile document text remains opaque: no model was tested for injection resistance. Four invented extraction tuples yield one-half accepted precision, one-half coverage and one false acceptance, illustrating a high-score wrong value without asserting production performance.

This is one connection, controlled fixtures, trusted caller/admin identities, manual ranking and one fixed query. Hashing identifies payloads rather than authenticating publishers. Approval, concurrent writers, process durability, distributed caches, real embeddings/search, parsers, LLMs and external effects were not tested. SQLite key enforcement differs from standard Snowflake tables. There were no credentials, network calls, GPU jobs or cloud execution in the workbook.

Catalog and remaining limits

Thirty-one registered sources are cited: twenty-nine reachable and two Udemy pages returned HTTP 403. Their earlier durations/revision dates are now explicitly unverified; neither course's paid lessons or current quality were reviewed. The public training PDF and course overview were read, not their live instruction. Practice terms were reviewed without opening exam questions: one attempt, 24 hours from purchase to completion, and the missed-window re-registration boundary at 48 hours from purchase. English practice availability does not establish real-exam languages.

Eight account labs and three integrated scenarios remain proposed. Each lab identifies input, access/failure evidence, reconciliation and cleanup. The report's per-source record distinguishes full main pages from selected sections; it does not claim the entire linked documentation catalog was read. Detailed-guide access, blocked commercial catalogs, actual account availability/execution and human review remain limits. Repository, unit, catalog, strict-site, generated-site and diff results are attached only after completion. The five reserved GitHub guides and disabled notification pilot remain untouched.