智能网络运营：从网络数据到代理式运营与更明智投资

From Network Data to Agentic Operations and Smarter Investment

Executive Summary

Telecommunications networks are becoming more software-defined, distributed and data-intensive; whilst operators are under sustained pressure to improve service quality, reduce operating expense and direct capital to the places where it creates the greatest return. The opportunity is no longer simply to collect more data. It is to turn network data into a continuously improving system of intelligence that helps people and systems observe, understand, decide and act.

This shift reflects a broader industry evolution. While network traffic continues to grow, revenue from connectivity alone has not kept pace. This makes the ability to generate intelligence from infrastructure not just an operational task, but also a strategic imperative. The conceptual leap is from operating a network to operating intelligence. An AI OpCo is not a telco that has added AI features, rather it is an operator engineered to run intelligence as a governed, metered, reliable operational workload. The Enterprise Intelligence Layer described in this paper provides the data, governance and agentic foundation that this transformation requires, connecting operational efficiency with entirely new forms of value creation.

This paper presents a functional, diagnostic, autonomous and strategic analytics framework; updated for the emergence of agentic AI and the latest Snowflake platform capabilities. The result is a single operating model that connects the day-to-day needs of engineers and NOC teams with the management questions faced by Network Operations Directors, CTOs and CTIOs.

Snowflake provides a common governed environment — an Enterprise Intelligence Layer — for heterogeneous network, OSS, service, customer and planning data. On top of that foundation, streaming and continuously refreshed data products support operational visibility; analytics and AI support anomaly detection, diagnosis and prediction; semantic context and agents make that intelligence accessible through natural language; whilst governed workflows can connect recommendations to operational or planning actions.

Two Snowflake capabilities are particularly relevant to this model. Snowflake CoWork gives operational and business users a conversational way to work with governed enterprise data and agents, thereby replacing dashboard hunting with evidence-based investigation and management summaries. Snowflake CoCo provides a data-native coding agent for the builders who create pipelines, analytics, ML applications and agents; accelerating development while keeping work close to enterprise data, catalog metadata, lineage and governance context. Together they help close a longstanding gap between the people who build network intelligence and the people who consume and act upon it.

1. The Network Is Becoming an Intelligence System

Network operations have traditionally been organised around specialised domains, tools and operational support systems. Radio, transport, core, cloud infrastructure, service assurance and field operations each generate large volumes of telemetry, alarms, events, logs, configuration data and operational records. These systems remain essential, but the growing complexity of modern networks makes it increasingly difficult to optimise performance by examining each domain independently.

At the same time, network leadership must manage a broader set of outcomes. Availability and latency remain fundamental, but they sit alongside customer experience, energy consumption, engineering productivity, regulatory obligations, investment efficiency and the speed at which new services can be introduced. A technical event can therefore have operational, commercial and financial consequences that extend far beyond the originating network element or function.

This expanding scope of consequence reflects a structural shift in the industry. Network traffic volumes continue to grow, but connectivity revenue has not kept pace. Operators are therefore looking beyond operational efficiency towards intelligence itself as a source of value — using governed network data, context and AI to power new services, data products and decision capabilities that create revenue beyond what growth in traffic alone can deliver. The intelligent network is both an operational model and a commercial one.

Network intelligence can be interpreted through four related analytical domains: functional and operational analytics; diagnostic and proactive analytics; autonomous operations; and strategic and prescriptive analytics. Each has value independently, but the important evolution is to connect them as one intelligence loop rather than treat them as separate use cases.

• Functional and operational analytics establish trusted visibility into network health, utilization, performance and service levels.
• Diagnostic and proactive analytics identify anomalies, accelerate root-cause analysis and predict failures or capacity issues before they become incidents.
• Strategic and prescriptive analytics translates network evidence into planning choices, scenario analysis and investment recommendations.
• Autonomous operations connect trusted insight to policy-controlled action, enabling progressively more closed-loop network management.

Why a shared data and AI foundation matters

An intelligent network depends on context. An alarm is more useful when it can be related to topology, recent changes, service dependencies, customer impact, historical incidents, asset characteristics and planned investment. The objective is not to replace domain systems; it is to create a governed analytical and AI layer — an Enterprise Intelligence Layer — in which information from those systems can be combined consistently and safely.

Snowflake can consolidate structured, semi-structured and unstructured information while separating storage and compute, allowing different operational, analytical and AI workloads to use the same governed data without requiring a single monolithic workload. Dynamic Tables and Snowpipe Streaming maintain continuously refreshed operational views at the cadence required by the operational process — from near-real-time event feeds through to hourly or daily KPI reports. Snowpark provides an environment for advanced analytics close to the data, whilst Cortex AI services provide search, language understanding, summarization and agent capabilities grounded in governed enterprise context.

Where Snowflake fits on the latency spectrum

Network operations span timescales from sub-second fault detection and protection switching through to multi-year capital planning. Snowflake is not positioned to replace the real-time OSS, element management or orchestration systems that must act within milliseconds. Its role is to provide the governed analytical and AI layer for decisions that require cross-domain context — typically operating at timescales from seconds to minutes for operational analytics, minutes to hours for diagnostic and predictive workloads, and hours to weeks for strategic planning. Snowpipe Streaming and Dynamic Tables allow data freshness to be tuned to the operational requirement without re-architecting the platform.

2. From Network Data to Network Intelligence

The network intelligence loop interconnects four disparate analytical domains into a single operating model. Rather than treating observation, diagnosis, decision and action as separate workloads, the intelligent network cycles continuously through each stage — with governed context flowing between them so that every step builds on what came before.

Observe: establish a common operational picture

The first requirement is reliable visibility. Network performance monitoring, fault management, capacity analysis, service quality and SLA management all depend on bringing together data from network elements and OSS platforms at the speed required by the operational process. A shared analytical layer can provide consistent definitions and cross-domain views while preserving the specialised systems used to operate individual technologies.

• Detect faults, degradation and emerging capacity bottlenecks across radio, core, transport and cloud domains.
• Provide consistent network health, utilization and KPI reporting to engineering and management teams.
• Relate service-level performance to infrastructure and operational conditions.
• Maintain governed semantic definitions so that KPIs have consistent meaning across engineering, operations and management audiences.

Understand: move from symptoms to causes and predictions

Once operational data is available in context, AI and machine learning can help operators move beyond threshold-based monitoring. Models can identify unusual patterns across large event volumes, correlate apparently unrelated symptoms and estimate the probability of future equipment or service degradation. Cortex AI can then make those findings easier for engineers to interrogate — through search over operational documentation, summarization of incident patterns, and conversational interaction with governed network data via CoWork.

• Anomaly detection and event correlation to reduce noise and focus engineering attention.
• Root-cause analysis using network events, topology, configuration and historical incident evidence.
• Predictive maintenance and failure forecasting to reduce avoidable outages and site visits.
• Capacity and congestion forecasting to identify where intervention is required before customer experience deteriorates.

Decide: turn analysis into an operational or investment choice

The same evidence that helps an engineer diagnose an incident can help management make better decisions. Prescriptive models can compare remediation options, evaluate capacity scenarios or recommend where scarce capital should be deployed. This is where network intelligence becomes a business capability: operational data is connected to demand, customer, financial and market context so that technical choices can be assessed in terms of enterprise outcomes.

Act: connect intelligence to controlled execution

The final stage is action. In some cases, the right action is a recommendation to an engineer. In others it may be the creation of a ticket, a workflow, a change request or an automated orchestration step. Closed-loop operation should therefore be understood as a spectrum of autonomy, with policy, confidence thresholds, approvals, auditability and rollback determining how far automation is allowed to proceed.

3. One Network, Different Questions

A defining characteristic of the intelligent telco is that different roles can work from the same governed evidence while asking questions at the level appropriate to their responsibilities. This reduces the translation gap between network engineering, operations leadership, planning and executive management.

This is more than a reporting improvement. When the semantic meaning of network measures is governed and reusable — through Snowflake semantic models and governed data products — an engineer and an executive can examine the same underlying reality through different abstractions. CoWork makes this practical: the same conversational interface serves the engineer investigating a specific cell cluster and the Director asking about aggregate trends in MTTR or repeat incidents. Role-based access controls ensure that each user sees only the data they are permitted to access, while the semantic layer ensures that terms like “availability”, “utilization” or “customer-impacting” mean the same thing regardless of who is asking.

4. The Agentic Network Operations Model

The emergence of agentic AI changes how network intelligence is built and consumed. Traditional dashboards require users to know where to look and how information has been organised. Agents can instead start from an intent expressed in natural language, identify relevant governed information and tools, perform multi-step analysis, and return an explanation, visualization or recommended next action.

CoWork: an intelligence interface for operators and leaders

Snowflake CoWork provides a conversational environment for working with enterprise information through governed agents. For telecom network operations, this creates the potential for a common interaction layer across technical and management roles.

• Engineers can investigate incidents by asking questions across alarms, topology, configuration, change history and past incidents — without navigating multiple OSS screens or building ad-hoc queries.
• NOC leaders can generate standardized morning health reviews, overnight incident summaries and SLA risk assessments through repeatable agent-driven workflows.
• Operations Directors can ask about recurring failure patterns, engineering effort consumption, customer exposure trends and operational cost drivers — grounded in the same governed data their teams use daily.
• Persistent chart and table artifacts can be refreshed and shared while applying the viewer’s own data permissions, making agent-generated insight more reusable in operational and management workflows.

CoCo: an agentic engineering environment for the builders

Snowflake CoCo is Snowflake’s data-native coding agent. It works with Snowflake context — catalog metadata, lineage, role-based access controls, table definitions and usage patterns — to assist with building data pipelines, analytics, machine-learning workflows, applications and agents. For network data and AI teams, CoCo can:

• Accelerate SQL development for network KPI computations, event-correlation logic and operational reporting.
• Help reverse-engineer and modernize legacy analytics (SAS, Hadoop, OSS-embedded reporting) into governed Snowflake-native implementations.
• Assist in building ML pipelines for anomaly detection, predictive maintenance and capacity forecasting close to the operational data.
• Support the development of domain-specific agents and applications that encode operational knowledge for reuse.

The complementary model

CoWork and CoCo serve different users working on different sides of the same problem. CoWork reduces friction for the people who need to consume and act on network intelligence. CoCo reduces friction for the people who build it. Both operate within the same governance boundary, which means an agent built in CoCo inherits the same access controls that govern what a CoWork user can see, thus ensuring that the intelligence loop is trusted end to end.

5. A Day in the Intelligent Network

Consider a mobile service area in which customer traffic is increasing and latency begins to deteriorate during the evening busy hour. In a conventional operating model, the symptoms may appear across several dashboards and alarm streams, with engineers manually correlating information before management can understand the broader impact. In an intelligent operating model, the event becomes a continuous decision loop.

1. Observe

Streaming network performance and OSS events flow through Snowpipe Streaming into Dynamic Tables that maintain a cross-domain operational view. An emerging latency and utilization anomaly is identified in a cluster of cells by a Cortex-powered anomaly detection model running against continuously refreshed data.

2. Understand

Analytics correlate the anomaly with topology, traffic growth, recent configuration changes and historical incidents. The evidence indicates that demand growth rather than a new fault is the dominant cause, while identifying a smaller configuration issue that is amplifying the impact.

3. Assist the engineer

An engineer opens CoWork and asks: “What is driving the latency degradation in the South-East cluster and what has changed recently?” The operational agent searches across governed alarm, topology, configuration and incident data, summarizes the relevant signals and recommends a low-risk configuration remediation for review — citing the evidence that supports its recommendation.

4. Inform management

The Network Operations Director uses the same CoWork environment to ask how often the pattern has occurred, the engineering effort consumed and the customer exposure. The governed semantic model translates the same underlying data into operational-management language: customer-impacting hours, repeat-incident cost, engineering FTE consumed, as opposed to raw network telemetry.

5. Act

The approved short-term remediation is passed to the appropriate operational workflow or orchestration platform, with the execution and resulting network behaviour captured for audit and learning.

6. Optimize investment

Planning analysis shows that traffic growth will exhaust engineered headroom within the planning horizon. Scenario modelling — potentially assisted by CoCo for rapid model iteration — compares augmentation options and their expected service, cost and investment impact.

7. Close the loop

The CTO or investment forum sees the proposed capital intervention alongside operational evidence, customer exposure and alternative scenarios, creating a traceable path from network signal to investment decision.

The important point is not that a single agent performs every step. The value comes from shared context and governed hand-offs between analytics, agents, people and operational systems. Each participant sees the level of detail needed for their decision while the underlying evidence remains consistent.

6. From NOC Metrics to Board Metrics

Network transformation programmes often struggle to demonstrate business value because technical and financial measures are reported separately. The intelligent network makes the relationship explicit. Engineering measures become leading indicators of customer, cost, risk and investment outcomes.

Investment intelligence

Strategic network planning can combine historical utilization, demand forecasts, service performance, market context and financial assumptions to compare investment scenarios. Digital-twin and what-if approaches can further reduce risk by allowing planners to test capacity expansions, modernization options or failure scenarios before physical changes are made. The objective is to direct capital where it produces the strongest combination of service improvement, resilience and economic return rather than simply where a technical threshold has been crossed.

From operational intelligence to new revenue

The same governed intelligence foundation that improves operational efficiency can also enable entirely new sources of revenue. When network data is unified, semantically governed and accessible through secure collaboration mechanisms, operators can package telemetry, coverage, performance and mobility insights as billable data products via Snowflake Marketplace; expose quality-on-demand and network slicing capabilities through APIs informed by internal capacity analytics; offer device intelligence, location verification and fraud-detection services to financial institutions and digital platforms; and share governed data with equipment vendors, infrastructure companies and enterprise customers for joint analytics without compromising sovereignty.

Turning telecom data into consumable, billable products at scale requires the same semantic governance, access control and cataloguing that underpins operational intelligence — the Enterprise Intelligence Layer therefore serves a dual purpose: improving how the network is run, and enabling what the network can sell. For CTOs and CTIOs, this reframes the investment case from OPEX efficiency alone to the foundation of an AI OpCo model in which intelligence generates measurable business outcomes beyond connectivity.

7. An Architectural Framework for the Intelligent Telco Network

The target architecture is best understood as a set of cooperating layers rather than a replacement for the operational systems already running the network.

Network and operational sources

RAN, core, transport, cloud/network functions, probes, telemetry, alarms, logs, configuration, OSS, inventory, incidents and field operations.

Enterprise context

Service, customer, product, location, finance, market, energy, workforce and investment data that gives technical events business meaning.

Data ingestion and processing

Batch and streaming ingestion via Snowpipe Streaming and connectors. Transformation through Dynamic Tables and Snowpark for continuously refreshed data products that make operational information available at the required freshness; from seconds-latency streaming through to scheduled batch materializations.

Governance and semantics

Snowflake Horizon provides access control, policy, metadata, lineage and classification. Semantic models define reusable business meaning for network KPIs and operational measures, ensuring consistency across human users and AI agents.

Analytics and AI

Operational analytics via SQL and Snowpark. Anomaly detection, prediction and optimization through Snowflake ML and Snowpark ML. Cortex AI for search over operational documentation, language understanding, summarization and agent orchestration — all grounded in governed network context.

Experiences

Dashboards and applications (Streamlit in Snowflake) alongside conversational experiences: CoWork for domain and business users investigating, explaining and acting on network intelligence; CoCo for builders developing pipelines, analytics, ML workflows and agents.

Action and orchestration

Human workflows, OSS processes, tickets, change systems, APIs and network orchestration platforms through which approved actions are executed. Snowflake connects intelligence to action boundaries but does not replace the operational platforms that execute changes on the network.

Data sharing and collaboration

Snowflake Secure Data Sharing and the Snowflake Marketplace enable governed data exchange between operators, equipment vendors, tower companies, MVNOs and partners without data movement. This supports use cases such as vendor-provided RAN analytics, shared infrastructure monitoring between tower company and MNO, regulatory reporting and cross-operator benchmarking; thereby extending the intelligence layer beyond organizational boundaries.

Coexistence and open formats

Many operators have invested in Hadoop, Spark or cloud-native data lake architectures. Apache Iceberg Tables on Snowflake allow these environments to coexist with the governed intelligence layer, where data can be shared across engines using open table formats while Snowflake provides governance, semantic meaning and AI capabilities on top. This creates a practical migration and coexistence path rather than requiring a wholesale platform replacement.

Governance is part of the architecture, not a final control

Network data can be commercially sensitive, operationally critical and subject to privacy or regulatory requirements. Agentic systems add a further requirement: the organisation must govern not only who can see data, but what an agent is allowed to reason over, which tools it can invoke, which actions require approval and how decisions can be audited. Role-based access controls, policy, lineage, observability and human-in-the-loop controls should therefore be designed into the intelligence loop from the beginning.

8. Security, Sovereignty and Compliance

Telecommunications networks carry commercially sensitive, operationally critical and personally identifiable data. Regulatory frameworks — including the UK Telecommunications Security Act (TSA), the EU NIS2 Directive and national data protection laws — impose specific obligations on how network management data is secured, where it resides and who can access it.

An intelligent network must therefore be built on a platform that addresses infrastructure security, data sovereignty and regulatory compliance as foundational capabilities — not as afterthoughts applied at the perimeter.

Platform security architecture

Snowflake enforces a zero-trust security model in which every user, service and system is strictly verified before access is granted. The platform provides multiple layers of protection that directly support telecom regulatory requirements:

Network isolation and private connectivity. Network Policies and Private Link (AWS PrivateLink, Azure Private Link, Google Cloud Private Service Connect) ensure that all traffic between the operator’s environment and Snowflake remains within the cloud provider’s private network backbone. No network management data needs to traverse the public internet. Pinned Private Endpoints further reduce the attack surface by ensuring that only an authorized private endpoint can route traffic to a specific Snowflake account, thus preventing lateral movement or credential misuse from unauthorized network paths.

Encryption in transit and at rest. All data in transit is encrypted using TLS 1.2. Data at rest is encrypted using AES-256. For operators requiring additional key control, Tri-Secret Secure provides a dual-key encryption model combining a Snowflake-maintained key with a customer-managed key (CMK) held in the operator’s own KMS (AWS KMS, Azure Key Vault or Google Cloud KMS). Private connectivity to the KMS ensures that key material never leaves the operator’s security boundary. The composite master key protects the full key hierarchy, such that if either key is revoked data becomes inaccessible.

Data exfiltration prevention. Account-level controls prevent ad-hoc data unload operations and require the use of governed storage integrations for all external stage operations. Outbound Private Link ensures that any approved data egress also remains within the cloud provider’s network. These controls help operators demonstrate that network intelligence data cannot be extracted outside governed channels.

Granular access control. Role-based access control operates at account, database, schema, table and column level. Dynamic data masking, row-access policies and object tagging allow fine-grained governance of sensitive network, customer and operational data. User-level and account-level network policies can restrict access to approved IP ranges and corporate networks.

Data sovereignty and residency

Customer data remains within the operator’s chosen deployment region. For example, for UK operators, this means network intelligence data stays in UK cloud regions without requiring cross-border data movement. Snowflake’s architecture separates storage and compute within a single region, ensuring that analytical and AI workloads process data in the same jurisdiction where it resides.

For operators with multi-national operations, Snowflake’s cross-region replication and Snowgrid capabilities allow controlled data sharing across borders where business requirements demand it — but only when the operator explicitly configures it. The default posture is regional containment.

Compliance and certification

Snowflake maintains certifications and attestations relevant to regulated telecommunications environments:

• SOC 2 Type II (security, availability, confidentiality)
• ISO 9001 (quality management)
• Cyber Essentials Plus (UK government-backed cybersecurity standard)
• Cloud Computing Compliance Controls Catalog (C5)
• TISAX (trusted information security assessment)
• PCI-DSS, HIPAA and HITRUST CSF
• FedRAMP High and DoD IL5 (US public sector and regulated commercial)

These certifications demonstrate that Snowflake’s operational practices, access controls, incident response and encryption management meet the standards expected by regulated infrastructure operators.

Governance for agentic systems

The introduction of AI agents into network operations creates an additional governance requirement. It is no longer sufficient to control who can see data, rather the organisation must also govern what an agent is permitted to reason over, which tools and data sources it may access, which actions require human approval and how every agent decision can be audited.

Snowflake addresses this through:

• Tool-use policy. Agents operate within defined tool boundaries. An investigation agent may be permitted to query governed data and summarize findings, but not to invoke an action without explicit approval.
• Confidence thresholds. Recommendations can be gated by model confidence, requiring human review when certainty falls below a defined level.
• Human-in-the-loop controls. Approval gates determine where in the Observe-Understand-Decide-Act loop a human must intervene before the system proceeds.
• Full observability and audit. Every agent interaction, data access, tool invocation and recommendation is logged and auditable, thereby creating a complete trail from network signal through analysis to action or decision.
• Role-based agent access. Agents inherit the permissions of the user or service account invoking them. An agent serving an engineer sees only engineer-permissioned data; an agent serving a Director sees aggregated operational views.

Implications for management-plane security

For operators subject to TSA or equivalent regulations, the combination of private connectivity, encryption with customer-managed keys, regional data residency, exfiltration controls and granular access governance creates an environment in which network management intelligence can be analysed and acted upon without compromising the isolation of the management plane.

Snowflake is not positioned within the management plane itself — it does not control or configure network elements. Its role is to provide a governed analytical and AI layer that can receive, process and reason over management-plane data within a security perimeter that meets the isolation, encryption and access-control requirements of modern telecommunications security regulation.

9. A Practical Path to the Intelligent Telco

Operators do not need to begin with a fully autonomous network. A staged approach creates value earlier and builds the data quality, trust and governance required for greater autonomy.

1. Unify

Prioritise a small number of high-value network domains and create governed data products that combine the operational evidence needed for cross-domain analysis. Establish ownership, quality expectations and common KPI definitions. Use Dynamic Tables to maintain freshness at the cadence required by the operational process.

2. Understand

Add anomaly detection, root-cause analysis, forecasting and predictive maintenance where the operational cost of manual diagnosis is high. Measure improvement in detection, resolution and avoided incidents. CoCo can accelerate the development of these analytical workloads by working with the catalog context and existing pipeline definitions.

3. Assist

Introduce governed agents via CoWork for well-bounded questions and workflows. Start with read-oriented use cases such as incident investigation, network performance explanation and management summaries before extending tool access. Persistent artifacts allow successful analyses to become repeatable operational workflows.

4. Automate

Connect high-confidence recommendations to workflows with explicit policy and approval gates. Automate repetitive tasks first and maintain complete observability of actions and outcomes.

5. Optimise

Connect operational evidence to capacity, investment and strategic planning. Use scenario analysis and prescriptive modelling to continually improve where resources and capital are deployed.

Where to start

• Select a problem with measurable operational and business value — for example recurring incidents, congestion, engineer dispatches, or capacity investment.
• Define the minimum cross-domain context needed to make a materially better decision.
• Create a governed semantic model so technical terms and KPIs have consistent meaning across engineering, operations and management.
• Use CoWork agents first to accelerate investigation and explanation, then expand toward recommendations and controlled actions as confidence grows.
• Use CoCo to accelerate the build: pipelines, KPI logic, event-correlation rules, ML models, whilst keeping development close to governed data context.
• Measure both technical outcomes (MTTD, MTTR, avoided incidents) and business outcomes (cost, customer exposure, investment return) from the beginning.

Conclusion: From Data Platform to Network Intelligence

The next stage of telecom network transformation is not defined by another dashboard or isolated AI model. It is defined by the ability to connect network signals, operational knowledge, business context and action through a governed intelligence system.

For engineers, that means less time finding and correlating evidence and more time resolving the problems that matter. For Network Operations Directors, it means a clearer view of the operational patterns driving cost, resilience and service quality. For CTOs and CTIOs, it creates a traceable connection between the behaviour of the network and the choices made about automation, modernization and capital investment. For network data and AI builders, it means faster development with less friction between coding, data, governance and deployment.

Snowflake provides the data, analytics, AI and governance foundation for this model — the Enterprise Intelligence Layer. CoWork changes how people interact with network intelligence: replacing fragmented dashboard navigation with governed, conversational investigation and explanation. CoCo changes how teams build it: accelerating pipelines, analytics, ML and agents with an engineering agent that understands the enterprise data and governance context. Together, they create a practical path from fragmented network data to an intelligent telco network in which data becomes context, context becomes decisions, and decisions become governed action.