Cortex LLM Content Safety: COMPLETE, TRY_COMPLETE, Cortex Guard and CLASSIFY_TEXT

1.COMPLETE and the Cortex Guard option

SNOWFLAKE.CORTEX.COMPLETE sends a prompt to a model you choose and returns the generated text. Access is controlled by role: the caller must use a role that has been granted the SNOWFLAKE.CORTEX_USER database role. Note that the function is now legacy. Snowflake points new work at AI_COMPLETE and says COMPLETE will be deprecated by the end of 2026. The exam guide still names COMPLETE, so learn its options.

You configure content filtering in the optional third argument, options. This object holds the model's hyperparameters and the guardrails switch. When guardrails is TRUE, Cortex Guard filters potentially unsafe or harmful responses. When it is left out, it is FALSE, so an application that never sets it gets no Cortex Guard filtering at all.

Adding an options object changes how the call works, even if the object is empty. The prompt must then be an array of role/content objects in chronological order rather than a plain string. The return value also becomes a JSON string with choices, created, model and usage keys, unless you supply response_format. Plan for this before you add guardrails to existing code, because the parsing logic has to change too.

Responsible AI is wider than the guardrails switch. Cortex Guard filters potentially harmful output, but filtering does not prove an answer is correct. Snowflake says that the accuracy of LLM responses is not guaranteed and that you should review answers before serving them to your users. Responsible AI therefore combines three layers: filter output (Cortex Guard), keep access under RBAC, and measure quality. For the third layer, AI Observability supports the LLM-as-a-judge approach. An LLM judge scores an application's output between 0 and 1 and gives an explanation. Built-in metrics include context relevance, groundedness, answer relevance, correctness and coherence. Groundedness checks whether a response is supported by the retrieved context. Correctness checks alignment with a ground truth. Judge scores are evidence for a human reviewer. They do not replace review of sensitive responses. The sources listed here do not name bias or toxicity metrics, so don't assume those exist as built-in metrics.

Sources123

2.TRY_COMPLETE: turning failures into NULL

TRY_COMPLETE has the same signature and the same options as COMPLETE, including guardrails. The difference is what happens on failure. COMPLETE raises an error. TRY_COMPLETE returns NULL. In a batch statement that runs an LLM over many rows, this means one bad row doesn't stop the whole job. Instead, it leaves a NULL that you can find later.

SNOWFLAKE.CORTEX.TRY_COMPLETE( <model>, <prompt_or_history> [ , <options> ] )

To use filtered responses safely, treat a NULL from TRY_COMPLETE as a signal and never as an empty answer. Keep the generated column next to its input. Send rows where the result IS NULL to a review or retry path, and don't pass them to downstream consumers. The documentation says when NULL is returned: when the operation cannot be performed. It doesn't describe exactly what a Cortex Guard-filtered response looks like. So check your NULL handling and your guardrails handling separately, and don't assume one covers the other.

Sources4

3.CLASSIFY_TEXT for sensitive-category tagging

Moderating model output is one half of the job. The other half is knowing which of your own text contains sensitive material. CLASSIFY_TEXT sorts free-form text into categories that you define, such as 'contains health data', 'contains payment details' and 'no sensitive content'. You then act on its output, for example by writing the label to a column or using it to decide which tag or masking treatment a record should get. Like COMPLETE, it is now legacy, and Snowflake directs new work to AI_CLASSIFY.

SNOWFLAKE.CORTEX.CLASSIFY_TEXT( <input> , <list_of_categories>, [ <options> ] )

The category list must contain between 2 and 100 unique categories. Both the input and the categories are case sensitive, so 'PII' and 'pii' count as different labels, and the same text written with different capitalisation can be classified differently. Categories can be plain strings or objects. With objects, a required label can have an optional description of about one or two sentences and an optional list of examples (up to 20 per category). Snowflake says this context can improve accuracy. For sensitive-data tagging, where a wrong label decides what gets protected, that improvement matters.

The exam guide pairs classification with anomaly detection. The sources for this lesson document CLASSIFY_TEXT only and don't describe an anomaly-detection function, so that part isn't covered here.

Sources5

4.Cortex Guard is not Cortex AI Guardrails

Two controls have similar names, and the exam relies on the difference. Cortex Guard is the per-request guardrails option you just set on COMPLETE or AI_COMPLETE. It filters harmful model output for that one call. Cortex AI Guardrails is an account-level control. You configure it through the AI_SETTINGS parameter, and it applies at request time to CoCo, Snowflake CoWork and Cortex Agents. It detects prompt injection and jailbreak attempts, including indirect injection hidden in a tool's output. It does not apply to the Cortex REST API or to TruLens External Agents.

ALTER ACCOUNT SET AI_SETTINGS = $$
  guardrails:
    advanced_prompt_injection:
      - enabled: true
$$;

Only ACCOUNTADMIN can configure Cortex AI Guardrails. The feature also has a prerequisite: it is available only to Commercial accounts that have cross-region inference enabled, with CORTEX_ENABLED_CROSS_REGION set to one of the allowed values. Check the configuration with SHOW PARAMETERS LIKE 'AI_SETTINGS' IN ACCOUNT, and disable it with ALTER ACCOUNT UNSET AI_SETTINGS.

Sources6

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.COMPLETE filters harmful output by default, so no extra configuration is needed.Why is that wrong?

   The guardrails option defaults to FALSE. Cortex Guard filtering only happens when you set it to TRUE in the options argument.

   Covered in COMPLETE and the Cortex Guard option

2. 2.Once Cortex Guard filters the output, the response is safe to serve without review, which is all responsible AI requires.Why is that wrong?

   Filtering harmful content does not make an answer accurate. Snowflake says LLM accuracy is not guaranteed and that you should review answers before serving them.

   Covered in COMPLETE and the Cortex Guard option

3. 3.Setting guardrails: TRUE on AI_COMPLETE is the same as enabling Cortex AI Guardrails for the account.Why is that wrong?

   The per-request Cortex Guard option is a separate control from account-level Cortex AI Guardrails, which you configure through AI_SETTINGS.

   Covered in Cortex Guard is not Cortex AI Guardrails