A single domain agent at a single factory is one floor of this architecture. One level up, each factory has its own leadership agent — an orchestrator that sits above that site's domain agents and can answer a question spanning multiple agents without the person asking needing to know which specialist actually holds the answer. Higher still, for users with broader authority — that is, power users who need visibility beyond a single factory — a global agent sits above every factory's leadership agent, deciding on the fly which one to route a question to and combining results from more than one factory into a single coherent answer.
The catch is that, at the time this was built, Snowflake did not yet offer a native agent-to-agent mechanism. Rather than wait, the team engineered its own approach: at every tier, the agent above talks to the agents below it through a Model Context Protocol (MCP) server managed directly by Snowflake, where each subordinate agent is exposed as a separate, described tool. A leadership agent's MCP server exposes that factory's domain agents; the global agent's MCP server exposes every factory's leadership agent in turn. Each orchestrating agent, which is itself a Cortex agent, receives routing instructions; for example, “route maintenance questions to the maintenance agent, production questions to the operations agent, and if a question spans both, use both and combine the answers”. It makes that decision automatically, within a single conversation with the user.
Crucially, this orchestration layer never bypasses the governance model described earlier. When an agent calls a subordinate agent through an MCP server, that subordinate executes under the permissions of the person who asked the original question, not under some shared service identity. Someone holding only reader rights at one factory can use that factory's leadership agent and, through it, its domain agents, but they cannot reach another factory's agents unless separately granted access there, and. A global agent is itself only usable by someone explicitly granted a global role. Multi-agent orchestration is layered on top of role-based access control (RBAC), not routed around it.