Qry refreshes endpoint SQL from the warehouse and serves verified snapshots to downstream callers. The warehouse identity should therefore be able to read the specific schemas or models used by the endpoint, but should not be able to write data or change warehouse configuration.
Before connecting a warehouse:
- create a dedicated service identity for Qry;
- grant read access only to approved schemas, marts, or views;
- deny write, DDL, ownership, and account-administration privileges;
- apply the warehouse’s own network, statement-timeout, and cost controls;
- record the credential owner and rotation process.
Qry’s current MVP documentation intentionally does not promise vendor-specific adapter support. Use the connection types presented in your workspace and confirm the current release notes before planning a provider- specific rollout.