Skip to content

ADR-0012 — URL-first notifications — 4 Snowflake Admin Contact types

Update date : 2026-05-27 21:55

Status: accepted Date: 2026-05-27 Applies to: Pluto products (multi-tenant)

Context

Notification systems default to email-first. For a SaaS product with a portal, email is the expensive channel (deliverability, unsubscribe, GDPR) — the portal is the natural home for non-critical notifications. SYSTEM$SEND_EMAIL has a cost and a deliverability risk; URLs do not.

Decision

URL-first: notifications route to the PLUTO_ADMIN notification centre by default. SYSTEM$SEND_EMAIL is reserved for critical alerts only: failed payment, quota exceeded, confirmed unsubscription.

4 contact types, mirroring Snowflake native Admin Contacts:

Type Channel Pointer
STEWARD Email Client's verified email (Snowflake USER)
SUPPORT URL Product support page (FAQ / chatbot)
APPROVER URL /admin/users in PLUTO_ADMIN (additional users)
SECURITY_COMPLIANCE URL /admin/security in PLUTO_ADMIN (compliance)

Contacts are created per client schema at provisioning (PROVISION_CLIENT()):

CREATE CONTACT IF NOT EXISTS DATA_PRODUCT__{APP}.{client_id}.STEWARD
    EMAIL = '{email}';

CREATE CONTACT IF NOT EXISTS DATA_PRODUCT__{APP}.PUBLIC.SUPPORT
    URL = 'https://pluto.ai/support?app={app_id}';

CREATE CONTACT IF NOT EXISTS DATA_PRODUCT__{APP}.{client_id}.APPROVER
    URL = 'https://pluto.ai/admin/users?client={client_id}&app={app_id}';

CREATE CONTACT IF NOT EXISTS DATA_PRODUCT__{APP}.{client_id}.SECURITY_COMPLIANCE
    URL = 'https://pluto.ai/admin/security?client={client_id}&app={app_id}';

ALTER SCHEMA DATA_PRODUCT__{APP}.{client_id}
    SET CONTACT STEWARD             = DATA_PRODUCT__{APP}.{client_id}.STEWARD,
                SUPPORT             = DATA_PRODUCT__{APP}.{client_id}.SUPPORT,
                APPROVER            = DATA_PRODUCT__{APP}.{client_id}.APPROVER,
                SECURITY_COMPLIANCE = DATA_PRODUCT__{APP}.{client_id}.SECURITY_COMPLIANCE;

Contacts are resolved at runtime via SNOWFLAKE.CORE.GET_CONTACTS() — no hardcoded email or URL in the pipeline code.

Consequences

  • Email volume is minimal — only critical events trigger SYSTEM$SEND_EMAIL.
  • All non-critical notifications surface in PLUTO_ADMIN, the natural entry point for the client.
  • The 4-type schema mirrors Snowflake native contacts — no custom contact resolution logic needed.
  • SUPPORT is scoped to PUBLIC (shared across clients); STEWARD, APPROVER, SECURITY_COMPLIANCE are scoped per client schema.
  • DROP SCHEMA {client_id} = offboarding — contacts are dropped with the schema, no orphaned records.