The correct answer is B. OWNERSHIP on the database role .
A database role is a securable object within a database. To grant a database role to another role, the granting role must have the authority to manage that database role. The OWNERSHIP privilege on the database role gives full control over the database role, including the ability to grant it.
Why B is correct:
The owner of a database role can grant that database role to another database role or account role, depending on the supported grant relationship.
Example concept:
GRANT DATABASE ROLE database1.db_role1 TO ROLE account_role1;
To perform this action, the executing role must have appropriate authority over database1.db_role1, such as OWNERSHIP.
Why the other options are incorrect:
A. USAGE on the database allows access to the database namespace, but it does not grant authority to grant a database role.
C. CREATE ROLE applies to creating account roles, not granting database roles.
D. MANAGE GRANTS can allow broad grant management, but the specific required object-level privilege in this question is OWNERSHIP on the database role.
Official Snowflake documentation reference:
Snowflake documentation explains that database roles are securable objects and that ownership provides full control over the object, including grant management.
[Reference: Snowflake Documentation — Database roles; Snowflake Documentation — GRANT DATABASE ROLE; Snowflake Documentation — Access control privileges; SnowPro Core Study Guide — Security and Access Control., ========================]
