Sources Warehouses

Operator connects a Snowflake source by giving Hightouch the ACCOUNTADMIN role 'to avoid permission errors'. The warehouse is shared with finance production data outside the sync scope.

Create a dedicated HIGHTOUCH_ROLE granted only USAGE on the warehouse + database + schema, plus SELECT on the specific marts views the syncs read; for Lightning diff, also CREATE TABLE on a dedicated HIGHTOUCH schema for snapshots. Never grant ACCOUNTADMIN or SYSADMIN — Hightouch docs recommend lea…

Hightouch connects to Databricks via PAT belonging to a power user. The PAT carries the user's full Unity Catalog grants including production gold tables outside the sync scope.

Connect via a dedicated service principal (or scoped PAT) with USE CATALOG / USE SCHEMA / SELECT only on the specific Unity Catalog objects Hightouch reads, and CREATE on a dedicated schema if Lightning diff snapshots are enabled. Tie warehouse compute to a cluster sized for the workload.

Operator pastes a long-lived BigQuery service-account JSON key into the Hightouch source config and emails it to a teammate to 'mirror' the config in staging.

Use a service account with bigquery.dataViewer on the specific datasets Hightouch reads plus bigquery.jobUser at project level for query execution; prefer workload-identity federation where supported; rotate the JSON key on a schedule and never send it over email. Hightouch stores it encrypted, but…