Databricks Unity Catalog Permissions

Key insights

• Unity Catalog: Centralized governance layer in Databricks that controls access to governed assets like catalogs, schemas, tables, views, volumes, functions, external locations, and models.
  It standardizes permissions across workspaces for easier auditing and compliance.
• Three-level namespace: Datastore hierarchy of catalog → schema → table.
  To read a table, a principal needs USE CATALOG on the catalog, USE SCHEMA on the schema, and SELECT on the table.
• Permission inheritance: Grants given on a container (catalog or schema) can flow down to current and future child objects, reducing repetitive grants.
  Design inheritance carefully—broad catalog-level grants can expose new objects unintentionally.
• BROWSE and discoverability: The BROWSE privilege lets users see metadata (names, descriptions, tags) without granting data access.
  This separates discovery from access so teams can find datasets before requesting read rights.
• Troubleshooting checklist: Follow the outside-in checks shown in the demo—missing USE CATALOG, then missing USE SCHEMA, then missing SELECT—and inspect grants with SHOW GRANTS and revoke when needed.
  Also verify workspace catalog binding, row filters, column masks, and ABAC policies when access still fails.
• Service principals & least-privilege: Assign permissions to groups and service principals for CI/CD and automation; integrate with identity providers (Microsoft Entra ID) for scalable provisioning.
  Apply least-privilege and isolate sensitive data into dedicated catalogs or schemas.

Keywords

Databricks Unity Catalog permissions, Unity Catalog access control, Databricks permissions management, Unity Catalog role-based access, Databricks Unity Catalog governance, Unity Catalog ACLs, Databricks access policies, Unity Catalog permission best practices