Troubleshooting App Installs & Runs

First-line triage for app install and run failures: the grant chain, symptom-to-owner table, and how to file an issue.

Start here: the one question

Most install and run failures are a broken link in the grant chain or a timing race. Before anything else, capture the exact error, the org, the app, and the table. Then check: does anything show OBSERVED or FAILED for this org in the Sync Engine visualizer?

The grant chain

An app run reads data through a chain. If any link is missing, the run fails with Object '<table>' does not exist or not authorized.

Source db, schema, table exist and are fresh (D&A pipelines)
MTA_ADMIN_ROLE has the necessary permissions to them.
Proxy role has read access to them (D&A).
Sync Engine grants the proxy role to the org's app-runner role (Platform)
The run reads as the org's service user

The number one recurring failure

When a pipeline rebuilds a source table, Snowflake silently drops the permissions on it. If the pipeline does not re-apply the MTA_ADMIN_ROLE and the proxy role's access, every app reading that table starts failing with "Object does not exist or not authorized." This has recurred since May (DA-2919, PLAT-171). First-line fix: D&A re-grants access, then run Reset failed or an ad hoc sync.

The runner-up: A new source table added to an existing app

When a new table is added to an app that is already installed, the Sync Engine may try to grant the table's proxy role before D&A has created it. The engine tries 3 times, then parks the grant as FAILED and stops retrying, permanently. Creating the role afterward does not fix anything on its own: nothing retries a FAILED grant automatically, and rerunning the variant does not either. This is why a run can keep failing even after the proxy roles look correct in Snowflake. The fix is Retry failed in the visualizer, described below.

Symptom → likely stage → owner

Symptom	Likely stage	Owner
"Object does not exist or not authorized" on run	MTA_ADMIN_ROLE, Proxy role or grant chain	D&A (MTA_ADMIN_ROLE, proxy roles) / Platform (Sync Engine)
Grant never created, retry does not help	Install, is_bundled mismatch	Creator team
New org/variant cannot open dashboard right after install	Reconciliation not finished yet	Platform team
Dashboard renders but data is wrong or missing	Model logic or RLS params	D&A Data Scientists / Creator team
Warehouse error or empty controls in dashboard	Sigma coherence	Report as Sigma coherence (eng)
409 Conflict on embed-path right after deploying	Embed not in a ready state yet	Creator team
Grants were fixed but reruns still fail with the same error	Grant parked as FAILED before the fix	D&A: verify roles, then Retry failed in the visualizer

Who does what (tool by tool)

Question	Tool	Who
What failed? Capture error, org, app, table	IC variant run status; Bug Capture	Whoever hits it
Is the source table there? Do the MTA_ADMIN_ROLE and proxy role still have access?	Snowflake console (SHOW GRANTS)	D&A
Anything OBSERVED or FAILED for this org?	Sync Engine visualizer	D&A or eng
Reset failed / trigger an ad hoc sync	Sync Engine admin actions	Eng, or D&A after the cause is fixed
Run infrastructure status	Prefect	Eng
Deep logs and traces	Logfire	Eng only
File and track the issue	Contact Us (Issues & Suggestions)	Everyone

Fixing a FAILED grant

If the visualizer shows a FAILED grant and its error says a role "does not exist or not authorized," you can fix this without engineering. Verify your side first, in this order:

The MTA_ADMIN_ROLE needs USAGE / SELECT grants to each DB / SCHEMA / TABLE / VIEW in each source database WITH GRANT OPTIONS. If that database is a share, it needs IMPORTED PRIVILEGESat the DB level.
1. MTA_ADMIN_ROLE always retains USAGE on all source DB's WITH GRANT OPTIONS.
  1. If you believe more tables and views will be added in the future, please also add SELECT - FUTURE TABLE WITH GRANT OPTIONS and/or SELECT - FUTURE VIEW WITH GRANT OPTIONS
2. MTA_ADMIN_ROLE always retains USAGE on all source SCHEMA's WITH GRANT OPTIONS
  1. If you believe more tables and views will be added in the future, please also add SELECT - FUTURE TABLE WITH GRANT OPTIONS and/or SELECT - FUTURE VIEW WITH GRANT OPTIONS
3. MTA_ADMIN_ROLE always retains SELECT on all source TABLES's WITH GRANT OPTIONS
4. MTA_ADMIN_ROLE always retains SELECT on all source VIEW's WITH GRANT OPTIONS
5. MTA_ADMIN_ROLE always retains IMPORTED PRIVILEGES on all shared DB's
6. this is applied for any source data used by an app
The proxy role exists as a role, with the exact name <db>__<schema>__<table>__role. Grants alone are not enough; the role itself must exist.
1. The proxy role has USAGE on the database and schema, and SELECT on the table.
If the table was rebuilt recently, re-check the steps above. Rebuilds may silently drop roles and grants.

Next. Only after all three steps check out: click Retry Failed on the FAILED item in the Sync Engine Visualizer (it moves to TRANSIENT), and then Run analysis on the variant. The grant should turn green within seconds.

Two rules.

If it fails again after a retry, stop and file a report; that means something on the platform side needs engineering.
And if the engine is visibly backed up with pending items, hold off on manual retries, since they add to the queue.

How to file it

Use the Contact Us button. See the "Insight Cloud: Issues & Suggestions" article for the full steps. Do not create Linear tickets directly; the product team triages daily and routes work into Linear. Include the error text, org, app, table, and urgency.

Rule of thumb

D&A's job is first-line triage: capture the error, check the things D&A owns (pipelines, MTA_ADMIN_ROLE, proxy roles, source tables), and file a report. Anything requiring the Sync Engine internals, prod Postgres, Logfire, or code changes is engineering's job. If the same manual fix keeps recurring, that is a bug to prioritize, not support.

The Sync Engine, Explained for D&A
How Insight Cloud Apps Fit Together
Insight Cloud: Issues & Suggestions