Compass Installation Instructions

1. Overview

Compass is an AI agent that lives within Ursa Studio. In order to enable it in our environments, two things must be set up: a Compass database user and an LLM model name.

The required work by the customer depends on the Ursa Studio deployment type. For Ursa Cloud deployments, customers need not do any of these steps. For Customer Cloud deployments, customers need to take all of the steps. For Hybrid Cloud deployments, customers only need to set up the Compass DB user in co-ordination with the Ursa team.

2. Setting up the Compass DB user

AI agents are powerful and unpredictable! We need to give them enough database access them to get their job done, but not enough for them to destroy the things we love.

In practice, this means that Compass should be given a dedicated database user, with read-only permissions into the ursa schema, and free range in the compass schema.

Create the user with key pair authentication as documented in the Snowflake Installation Instructions.

The commands on Snowflake will look something like:

create user my_compass_account
  type = service
  default_namespace='MYDB.URSA'
  default_warehouse='MY_COMPASS_WH'
  default_role='MY_HUMAN_ROLE'
  rsa_public_key='MIIB...'
  network_policy=MY_URSA_STUDIO_POLICY;

create schema compass;
create role my_compass_role;
grant role my_compass_role to user my_compass_account;
grant role my_human_role to user my_compass_account;
GRANT USAGE ON DATABASE mydb TO ROLE my_compass_role;
GRANT USAGE ON SCHEMA compass TO ROLE my_compass_role;
GRANT USAGE ON WAREHOUSE MY_COMPASS_WH TO ROLE my_compass_role;
GRANT ALL ON FUTURE TABLES IN SCHEMA compass TO ROLE my_compass_role;
GRANT ALL ON FUTURE SEQUENCES IN SCHEMA compass TO ROLE my_compass_role;

Setup on other databases should follow a similar approach. Note that my_human_role needs to be the role referenced in the URSA_READONLY_ROLE environment variable and represents the role that's given read-only access to tables managed by the Ursa Studio ELT.

Customer cloud users will then need to add the new environment variables COMPASS_DATABASE_USER and COMPASS_SNOWFLAKE_PRIVATE_KEY (the latter by way of Secrets Manager or Key Vault) to the Fargate task description.

3. Setting up the LLM

You can just set the LLM_MODEL_NAME environment variable to dealers-choice to use whatever best-in-class model is hardcoded into the current version of Ursa Studio. If a new model comes out and you want to use it without an Ursa Studio bump, you can reference it in this environment variable, in the general format us.anthropic.claude-opus-4-6-v1

IAM access must be enabled for the “ECS task role” IAM role. Create a new IAM policy, granted to the ECS task role, with something like the following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "aws-marketplace:ViewSubscriptions",
                "aws-marketplace:Subscribe"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:us-east-1:<aws-account-id>:inference-profile/us.anthropic.claude-opus-4-6-v1",
                "arn:aws:bedrock:us-east-2:<aws-account-id>:inference-profile/us.anthropic.claude-opus-4-6-v1",
                "arn:aws:bedrock:us-west-1:<aws-account-id>:inference-profile/us.anthropic.claude-opus-4-6-v1",
                "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-opus-4-6-v1",
                "arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-opus-4-6-v1",
                "arn:aws:bedrock:us-west-1::foundation-model/anthropic.claude-opus-4-6-v1",
            ]
        }
    ]
}