Troubleshooting App Installs & Runs

First-line triage for app install and run failures: the grant chain, symptom-to-owner table, and how to file an issue.

Start here: the one question

Most install and run failures are a broken link in the grant chain or a timing race. Before anything else, capture the exact error, the org, the app, and the table. Then check: does anything show OBSERVED or FAILED for this org in the Sync Engine visualizer?

The grant chain

An app run reads data through a chain. If any link is missing, the run fails with Object '<table>' does not exist or not authorized.

  1. Source table exists and is fresh (D&A pipelines)

  2. Proxy role has read access to it (D&A)

  3. Sync Engine grants the proxy role to the org's app-runner role (Platform)

  4. The run reads as the org's service user

The number one recurring failure

When a pipeline rebuilds a source table, Snowflake silently drops the permissions on it. If the pipeline does not re-apply the proxy role's access, every app reading that table starts failing with "Object does not exist or not authorized." This has recurred since May (DA-2919, PLAT-171). First-line fix: D&A re-grants access, then run Reset failed or an ad hoc sync.

Symptom → likely stage → owner

Symptom

Likely stage

Owner

"Object does not exist or not authorized" on run

Proxy role or grant chain

D&A (proxy roles) / Platform (Sync Engine)

Grant never created, retry does not help

Install, is_bundled mismatch

Creator team

New org/variant cannot open dashboard right after install

Reconciliation not finished yet

Platform team

Dashboard renders but data is wrong or missing

Model logic or RLS params

D&A Data Scientists / Creator team

Warehouse error or empty controls in dashboard

Sigma coherence

Report as Sigma coherence (eng)

409 Conflict on embed-path right after deploying

Embed not in a ready state yet

Confirming with eng (Platform/Subscriber)

Who does what (tool by tool)

Question

Tool

Who

What failed? Capture error, org, app, table

IC variant run status; Bug Capture

Whoever hits it

Is the source table there? Does the proxy role still have access?

Snowflake console (SHOW GRANTS)

D&A

Anything OBSERVED or FAILED for this org?

Sync Engine visualizer

D&A or eng

Reset failed / trigger an ad hoc sync

Sync Engine admin actions

Eng, or D&A after the cause is fixed

Run infrastructure status

Prefect

Eng

Deep logs and traces

Logfire

Eng only

File and track the issue

Contact Us (Issues & Suggestions)

Everyone

How to file it

Use the Contact Us button. See the "Insight Cloud: Issues & Suggestions" article for the full steps. Do not create Linear tickets directly; the product team triages daily and routes work into Linear. Include the error text, org, app, table, and urgency.

Rule of thumb

D&A's job is first-line triage: capture the error, check the things D&A owns (pipelines, proxy roles, source tables), and file a report. Anything requiring the Sync Engine internals, prod Postgres, Logfire, or code changes is engineering's job. If the same manual fix keeps recurring, that is a bug to prioritize, not support.

Confirming with eng

  • The intended 409 embed-path behavior (finish readiness during deploy, or show "still preparing" instead of an error).

  • Sync Engine visualizer URL and who has access.

  • The exact roles that can set or edit RLS params.

Related

  • The Sync Engine, Explained for D&A

  • How Insight Cloud Apps Fit Together

  • Insight Cloud: Issues & Suggestions