All labs
Governance & Security · Databricks · Executable lab · 75 min
Design Unity Catalog permissions for a data mesh
Three domains (Sales, Finance, Supply) share one metastore. Auditors flagged broad ALL PRIVILEGES grants.
Implementation challenges · 0/4
1. Model the hierarchy
Catalog per domain, schema per layer (bronze/silver/gold).
2. Write grants
Producers get MODIFY on their schemas; consumers SELECT on gold only.
3. Add a row filter
Create a SQL UDF using is_account_group_member().
4. Audit
Query system.access.audit for denied requests.
Expected result
Zero user-level grants; consumers cannot read silver.
Validation tests
- SHOW GRANTS matches the matrix
- Denied access logged
Anti-patterns reviewers look for
- Granting on metastore
- Owner = individual user