In this guide, we will use the Posit Team Native App to build an interactive Python dashboard over Home Mortgage Disclosure Act (HMDA) data. In Posit Workbench you will open the Positron Pro IDE, connect to Snowflake with Ibis, and use Posit Assistant with a Snowflake Cortex AI model to explore the data. Then you will build a Shiny for Python dashboard and publish it to Posit Connect with one-click deployment, so your whole team can use it.

The deployed dashboard respects Snowflake's own security and authorization settings. Because you attach Connect's Snowflake integration to the content before publishing, each viewer's queries run under their own Snowflake identity, so they see only the data they have been granted.

By the end you will have a working dashboard where users filter mortgage applications by loan type, state, and loan amount, and see the resulting distribution of loan amounts, three headline metrics, and a year-over-year trend.

This guide is the Python counterpart to Build and Deploy an Interactive Shiny Dashboard with the Posit Team Native App and Snowflake Cortex AI, which covers the same process within R.

In this guide we will use the HMDA dataset from Snowflake's free public database. It holds mortgage application and origination records: loan types, applicant demographics, property characteristics, loan amounts, and outcomes, across U.S. geographic areas.

The table is at:

In Snowsight, click + > SQL File and run:

Ten rows should come back. If they do not, ask your account administrator to grant you access to the database.

In Snowsight, click Apps in the left sidebar, select the Posit Team Native App, then click Launch app.

If you do not see the app, ask your Snowflake account administrator to install the Posit Team Native App from the Marketplace, configure it, and grant you access.

From the Posit Team landing page, click Posit Workbench.

You may be prompted to sign in to Snowflake with your usual credentials.

Workbench offers several IDEs, including Positron Pro, VS Code, RStudio Pro Jupyter Notebook, and JupyterLab. This guide uses Positron Pro, Posit's data science IDE for Python and R.

1. Click + New Session.

2. Select the Positron Pro IDE. You can give the session a name.

3. Check the Snowflake credential under Session Credentials. It is listed by account and role, and it is selected when it shows a check mark. If a lock is displayed instead, click it and complete the sign-in prompts. To use a different role, open the drop-down arrow on the right of the credential and choose one that is signed in. Pick a role that can read SNOWFLAKE_PUBLIC_DATA_FREE and use the DEFAULT_WH warehouse. Your session then inherits that role, so your queries use your own identity and grants. See Workbench-managed credentials and Workbench-managed Snowflake credentials for how this works.

4. Click Launch.

This guide uses three extensions, all shipped with Positron as bootstrapped extensions, so they should already be present:

Open the Extensions view from the activity bar and search for each by name. An installed and enabled extension shows a gear icon; otherwise click Install. If they are disabled and you cannot enable them, ask your administrator.

You can also confirm that the extensions loaded from the activity bar. Posit Assistant and Posit Publisher each add an icon there, highlighted below.

Posit Assistant is Positron's AI assistant for data science. Beyond being able to read your active files, selected code, and project structure, it uses context from your interactive work: loaded data, plots, and console history. That is what makes it useful for exploratory analysis rather than only for writing code. The agent works in the same session as you, in much the same way as you would.

Positron's AI features use a bring-your-own-key model, and Snowflake Cortex is one of the available providers. We don't need to manage any credentials because we opened our Workbench session through the Posit Team Native App. Positron will read those credentials, derive your Cortex endpoint from your account, and authenticate the provider for you. Your prompts and your data go to Cortex inside your own Snowflake account, under the same identity your queries use.

Open Posit Assistant, which appears in the sidebar or as an editor panel depending on your configuration. Then open the model selector in the chat input area and choose a Snowflake Cortex model. Models from other providers appear in the same list and display names repeat across providers, so pick deliberately rather than relying on whichever model is selected by default. When the chat form is narrow the selector collapses into an overflow (...) menu, where the models are grouped under each provider's name.

The code in this guide lives at https://github.com/posit-dev/snowflake-posit-python-dashboard-cortex.

1. Open a terminal in Positron. If one is not already open, use the Command Palette (Ctrl/Cmd+Shift+P) and select Terminal: Create New Terminal.

2. Clone the repository:

   git clone https://github.com/posit-dev/snowflake-posit-python-dashboard-cortex/
   

   Note: This uses HTTPS for git authentication, so your standard git credentials apply.

3. Open the folder: Command Palette > File: Open Folder > snowflake-posit-python-dashboard-cortex.

The analysis uses Ibis for querying Snowflake, plotnine for plots, Shiny for Python for the dashboard, and posit-sdk for the Connect credential exchange. They are listed in requirements.txt.

Run the following commands in the Positron terminal (not in a Quarto chunk). Create a virtual environment and install the packages:

Then select that interpreter in Positron: Command Palette > Python: Select Interpreter > the .venv entry.

The narrative version of this analysis is a Quarto document, quarto.qmd. Think of it as a Markdown document that can also run code. Click Run Cell above any chunk to execute it, or click Preview to render the whole document to HTML. Learn more at https://quarto.org/.

Open quarto.qmd and run the first code chunk.

Ibis is a dataframe library that compiles Python expressions into SQL and runs them on a backend, in this case Snowflake. connection_name="workbench" is the important part. When you signed in to the Snowflake credential, Workbench wrote a connections.toml file containing a profile named workbench with your account and a short-lived OAuth token, and pointed SNOWFLAKE_HOME at it. Naming that profile is all it takes, so no account identifier, user, or password appears anywhere in your code.

mortgage_data is a lazy table expression, not data. Filters and aggregations build up a query, and rows come back only when you ask for them:

This matters for a dashboard over a table this size. Aggregate first, collect second. To see what Ibis sends to Snowflake, use ibis.to_sql():

Posit Assistant already has con and mortgage_data in its context, so we can have it help us with some of the analysis. Since it can read the variables in your live Python session, so you can refer to them by name.

Open Posit Assistant and try.

It will write and run code to show columns, types, and basic statistics.

You might need to ask it to do some of the work in the database explicitly. This way it will stop reaching for to_pandas() which would pull the whole table into memory.

Posit Assistant has many of the affordances other AI agents have, such as plan mode and memory. It additionally have built-in skills to work specifically with Posit Products and their open source packages. Hence why it is able to work on the shiny for Python app so easily.

When you are done exploring you can use the /report skill to create a Quarto document from the conversation. This is especially useful as it is a document we can work with in the future if we need to.

For the full feature set, see the Posit Assistant documentation.

Now build the dashboard. The complete app is app.py in the repository you cloned. Open it and read through it. The remainder of this section will explain some of the specifics.

The same file has to work in two places. In Workbench it uses the managed credentials, exactly as the Quarto document did. On Connect, the viewer's identity arrives as the Posit-Connect-User-Session-Token header on their Shiny session, and PositAuthenticator exchanges it for a Snowflake OAuth token.

Because that token is per viewer and arrives on the session, credentials(session) is called from inside server(), not at the top of the file. Every connection in the app is built from its result, so every query the dashboard runs is attributed to the person looking at it. This is all done to make sure the people looking at the dashboard have the right permissions.

filtered() returns an Ibis expression, not a dataframe. No rows have moved. Each output then narrows it further and materializes only what it needs, so we don't have to move the data in and out of the database, instead only fetching what we need.

That query returns one row regardless of how many applications matched.

The histogram is the one output that needs individual rows rather than an aggregate, so it is capped explicitly.

If we didn't do this, the dashboard would try to fetch the entire table into the app process. This would not only be very time consuming with larger datasets, leading to significant hangs, but could also try to pull in more data than the session has room for.

Note that for this dashboard we have decided to return the first 50,000 rows Snowflake happens to produce. This may or may not be what you want in your application.

From the terminal:

Or open app.py and click the Run App button in the editor toolbar. The dashboard opens in the Viewer pane. The --reload flag enables auto-reload, meaning that it will watch for changes in app.py and restart the app accordingly.

The dashboard is deliberately plain. Use Posit Assistant to take it further. It can see app.py, and the built-in shiny-bslib skill in Posit Assistant loads automatically when it is relevant to your request. Try:

Keep iterating until you are happy with it.

Because Workbench and Connect run inside the Posit Team Native App, publishing does not involve any network or authentication setup.

1. Open Posit Connect from the Posit Team Native App.

2. Click your account in the upper right, then Manage Your API Keys.

3. Click Add API key. In the drawer that opens, name the key, select the Publisher role, and choose when it expires. Then create it.

4. Copy the key somewhere safe. Once you close, it is not shown again.

1. In Positron, click the Posit Publisher icon in the tool menu.

2. Under Deployment, click Select... and create a new deployment. Choose app.py as the entrypoint.

3. Select the Connect server, or add a new one with the URL https://connect/, and paste in your API key.

4. Include these files:

The .python-version file that selected your session interpreter also travels into the deployment, so confirm it sits alongside app.py and reads 3.12. Publisher reads it when generating the deployment manifest, which records >=3.12 as an explicit version constraint rather than just noting whichever interpreter you happened to author with. Connect then picks a matching Python installation. It ships in the repository; if you are adapting this pattern in a project of your own, create it with:

5. Click Integration requests > + > the available Snowflake integration.

6. Click Deploy your project and watch the log.

See Publishing from VS Code or Positron for more on this step.

When the deployment succeeds, click the link to your content at the end of the deployment log. This opens the app in Connect, where the remaining settings live.

One step does not travel in the bundle. Open Content Settings, go to the Runtime tab, and in the Integrations section click Add Integrations and select the Snowflake integration. Clicking Integration requests in Publisher records a request in the bundle; associating the integration is a separate action in Connect.

If the dashboard errors on first load, this is almost always why: without the association Connect reports No OAuth integrations have been associated with this content item.

Attaching the integration also sets SNOWFLAKE_ACCOUNT on the content, which is where the app's connection gets its account identifier. You do not have to add it yourself.

Finally, decide who can open the dashboard. Connect defaults a new deployment to specific users or groups, so only you (and anyone you add) can see it. Still in Content Settings, open the Access tab and change the setting to All users - login required. Anyone with an account on this Connect server can then open the dashboard, and each viewer's queries still run under their own Snowflake identity.

1. In Connect, open the Content tab and click your dashboard.

2. Exercise the filters and confirm the metrics and plots update.

3. To share it, open the Content Settings pane in the upper right, and on the General tab copy the URL from the Content URL section. Send that to your team.

Because you attached the Snowflake integration, the dashboard uses viewer-level authentication: each person who opens it connects to Snowflake as themselves. Two colleagues with different grants on SNOWFLAKE_PUBLIC_DATA_FREE will see different results from the same dashboard, with no filtering logic in your code. Your Snowflake RBAC policy decides what data each person sees.

You connected to Snowflake from Positron Pro in Workbench using managed credentials, queried the data from Python with Ibis without moving it out of the database, explored it with Posit Assistant backed by a Cortex model, built an interactive Shiny for Python dashboard, and published it to Connect where it runs under each viewer's own Snowflake identity.