Sources

Sources is the first tab of Knowledge: where the workspace's knowledge comes from. Connect a source once; sign-ins refresh and schemas sync on their own, and each person's questions run as them. Its tabs are All sources, Snowflake and Salesforce, and everyone has a Your sign-ins section.

Workspace admins manage sources; analysts can view them. Everyone else sees only Your sign-ins.

All sources

All sources lists every connection with its readiness. The strip at the top, Which sources can answer, counts:

Tile	Meaning
Connected sources	Every configured source.
Ready	Sources whose connection, catalog and test-query checks passed recently, for you. An expired check doesn't count.
Action required	Connections that need configuration or your authorization, or whose last test failed.
Check due	Sources still being set up, only partly working, or whose last check is out of date.

A source counts as ready only when its latest check passed. The sign-ins counted here are yours; nobody else's are shown.

Each row shows its readiness and, in its menu, Test Connection, Run readiness check, Check for Drift (compare the live schema with the stored one) and Delete. Deleting removes the connection and what was learned from it, and saved reports built on it stop refreshing. Select Explore or the source to open its page.

Add a source

1. Select New connection. Add a data source opens in three steps: Choose, Configure, Connect.

2. Pick the connector, give the connection a name, and fill in its fields.

   • Snowflake: the account (paste your Snowflake URL), database and warehouse. Keep Username as NEXATRON_SVC: it's the setup user the script creates, not your own login. Generate a key for me makes the key in your browser and fills in the setup script your Snowflake admin runs; copy it or select Download .sql to send it. You can connect before they run it: the connection's page keeps the script, and Check again there tries the sign-in once they have. The full Snowflake side is in Connect Snowflake.
   • Salesforce: your My Domain URL, and the consumer key of the External Client App registered in your Salesforce org. The app's callback URL includes the connection's id, so you can save first and add the key afterwards; the steps, in order, are in Connect Salesforce. Each person authorizes Salesforce for themselves after that.

   Each connector with a guide links it from the dialog as Step-by-step guide.

3. Select Connect. For Snowflake, Nexatron verifies the source and starts answer setup.

The new connection is turned on for No one yet until you decide who can use it.

A source's page

From top to bottom, a source's page shows:

• Connection readiness: what the last check measured (Configuration, Identity, Reachability, Catalog, Query execution, Freshness) and its overall state. Nexatron reports readiness only from a check it actually ran; select Run readiness check to run one.
• Answer setup (Snowflake and Salesforce): setup reads the connection's tables, finds how they relate, proposes business definitions and lists the questions only your data owner can answer. Select Run setup (or Run setup again after the data changes). You can leave the page while it runs. When it finishes it shows the Tables understood, Relationships found, Definitions proposed and Conventions learned, with a link to the owner questions on Metrics.
• Who can use it and, for Snowflake, Snowflake sign-in (below).
• Connected members: who has connected their own account, as which source identity, and when it was last used.

Who can use it

People see only the connections turned on for them, and every answer runs as the person who asked. Choose:

• Everyone: every member can ask about it, as themselves.
• Selected groups and people: only the workspace roles and people you choose.
• No one yet: nobody can ask about it until you turn it on.

Then select Save access.

For Snowflake, Who signs in is Each person signs in with their own Snowflake login. Linking people to another Snowflake user is for development and test only; a production workspace refuses it, and there is no way to ask as someone else. Changing how people sign in ends everyone's current sign-in on the connection.

Signed in now lists who holds a sign-in. Revoke ends one person's; Revoke everyone's sign-in ends them all and deletes their stored tokens.

Snowflake sign-in

Set this up once per Snowflake connection, with your Snowflake admin. Under Who runs the sign-in page, choose:

• Snowflake OAuth: people sign in on Snowflake's own page. Needs only your Snowflake admin, and no identity provider.
• Your identity provider (Okta / Microsoft Entra ID / other): people sign in with your company login, and your identity provider issues their Snowflake tokens (External OAuth). Fill in its Issuer, Signing keys (JWKS) URL, Authorize URL and Token URL (and, for Microsoft Entra ID, the audience).

Enter your Snowflake account identifier and select Show the statement. Your Snowflake admin runs the statement once in Snowsight as ACCOUNTADMIN; it grants Nexatron no data access of its own. Paste the Client ID and Client secret it returns (or, for External OAuth, those of Nexatron's app in your identity provider) and select Save and turn on sign-in. Switching provider, or saving a different client, ends the sign-ins made with the current one.

The step-by-step for both sides is in the Pilot quick start and Connect Snowflake.

Snowflake

The Snowflake tab checks the health of your Snowflake account, from its query history. Select Check account health (the first Snowflake connection is already chosen; pick another if you have several). Each signal says whether it ran:

Signal	What it finds
Most expensive queries	The queries with the most total elapsed time over the last 7 days.
Approved measures on unused tables	Approved metrics whose source tables haven't been read in 60 days.
Queries worth precomputing	The same query run at least 5 times in the last 30 days.
Unused tables	Largest tables with zero reads in the last 30 days.
Queries getting slower	Repeated queries whose slowest runs are getting slower.

The digest reads only metadata, so it costs no warehouse credits. Running it is limited to workspace admins. If it fails, the most common cause is that the Snowflake role lacks IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE: the page shows the statement to run.

Salesforce

The Salesforce tab shows what answer setup learned from your Salesforce org: the objects and fields it understood, the relationships it found, the definitions it proposed and the conventions it learned. It only reads what Salesforce lets the person running setup see. Decide the proposed definitions on Metrics, and read the business objects on Ontology.

Your sign-ins

Your sign-ins lists the sources that answer as you. Connect your own login to each one: you see exactly what you can see there, nothing more, and nobody else's sign-in is used on your behalf.

• For Snowflake, select the Sign in with button. It names where you sign in: Snowflake, or your company's Okta or Microsoft page. Once connected, the card shows which Snowflake user you are connected as and until when your sign-in renews by itself.
• For Salesforce, select Connect Salesforce and authorize Nexatron in Salesforce. Your questions then run as your Salesforce user.
• Disconnect (for example Disconnect Snowflake) stops your questions using that source until you connect again.

Nothing to sign in to yet means no source in the workspace needs your own sign-in.