User

A user is an identity that can authenticate and run queries under granted roles. Users carry no charge of their own. They still determine two things that shape the bill: who spend gets attributed to, and which forgotten identities can still wake compute up.

Free objects, live privileges

A dormant user holding USAGE on a warehouse can still log in and resume it, and auto-resume handles the rest. Departed-employee accounts that keep their grants are simultaneously an access-hygiene problem and a latent cost trigger: a single scheduled task left running under a forgotten identity is enough to keep a warehouse cycling indefinitely, with nobody recognizable on the attribution line.

Attribution starts with identity

Credits are burned by queries, and queries run as users. ZopNight inventories users from SHOW USERS (account-scoped, with no database parent) and enriches them with team, cost-center, and environment tags from TAG_REFERENCES, which is what lets warehouse spend roll up to owners instead of to an anonymous account total.

One identity per robot

Discovery itself follows the pattern this page argues for: ZopNight connects as a dedicated ZOPNIGHT_SVC service user with scoped roles, so its own queries are attributable and its privileges are auditable. Shared human credentials driving automation are how attribution dies.

Spot the dormant ones

SELECT name, last_success_login, disabled, has_password
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE deleted_on IS NULL
ORDER BY last_success_login NULLS FIRST;

Identities that have never logged in, or not in months, surface at the top. Review their role grants before dropping anything. Expect rows in this view to trail live changes by up to 3 hours.