diff --git a/docs/connector.mdx b/docs/connector.mdx
index 73356e7d..b912e582 100644
--- a/docs/connector.mdx
+++ b/docs/connector.mdx
@@ -37,7 +37,7 @@ Token lifetime is set by the requester. Snowflake accepts whole days only, and t
 </Warning>
 
 <Note>
-**Service users must have a granted default role.** For a user of type `SERVICE`, `SERVICE_AGENT`, or `LEGACY_SERVICE`, the connector restricts the issued token to the user's `DEFAULT_ROLE` and verifies that role is actually granted to the user first. If the user has no default role, or the default role is not granted, issuance fails before any token is created.
+**Service users must have a granted default role.** For a user of type `SERVICE`, `SERVICE_AGENT`, or `LEGACY_SERVICE`, the connector restricts the issued token to the user's `DEFAULT_ROLE`, and verifies that role is granted to the user when its own role can read the user's grants. If the user has no default role, issuance fails before any token is created. If the default role is not granted, issuance fails either on that check or on Snowflake's own rejection of the statement.
 </Note>
 
 <Note>
diff --git a/pkg/connector/users.go b/pkg/connector/users.go
index 10afa22a..83de0e1d 100644
--- a/pkg/connector/users.go
+++ b/pkg/connector/users.go
@@ -97,7 +97,7 @@ func (o *credentialUserBuilder) Issue(ctx context.Context, input *connectorbuild
 			// SHOW GRANTS TO USER needs privileges that creating the token does not.
 			// This check only turns a Snowflake rejection into a better message, so a
 			// role that cannot run it must still be allowed to issue.
-			ctxzap.Extract(ctx).Debug("baton-snowflake: skipping default-role check: insufficient privileges",
+			ctxzap.Extract(ctx).Warn("baton-snowflake: skipping default-role check: insufficient privileges",
 				zap.String("username", input.IdentityID.Resource))
 		case err != nil:
 			return nil, fmt.Errorf("baton-snowflake: verify service user's default role: %w", err)
@@ -167,8 +167,9 @@ func (o *credentialUserBuilder) Issue(ctx context.Context, input *connectorbuild
 		// locally computed expiry is never later than Snowflake's, so reporting it
 		// errs towards early rotation rather than towards a credential that outlives
 		// what C1 believes.
-		ctxzap.Extract(ctx).Debug("baton-snowflake: cannot read back token expiry: insufficient privileges",
-			zap.String("username", input.IdentityID.Resource))
+		ctxzap.Extract(ctx).Warn("baton-snowflake: reporting a locally computed token expiry: insufficient privileges to read it back",
+			zap.String("username", input.IdentityID.Resource),
+			zap.Time("estimated_expires_at", expiresAt))
 	default:
 		return nil, fmt.Errorf("baton-snowflake: read created programmatic access token expiry: %w", err)
 	}