Granting, revoking, and denying access with SQL and the UI

Unity Catalog secures data using standard SQL GRANT/REVOKE syntax applied across a hierarchy: metastore, catalog, schema, table/view, and column/row levels. Privileges can be assigned to users, groups, or service principals, and access can also be managed visually through the Catalog Explorer UI. Effective access is determined by combining grants inherited from higher levels with grants at the specific object level.

1 · Learn the must-know

• 1Privileges granted at a catalog or schema level are inherited by all objects nested beneath them, so granting USE CATALOG and USE SCHEMA plus SELECT at the catalog level cascades down to all schemas/tables within it.
• 2GRANT SELECT ON TABLE catalog.schema.table TO group_name is the standard syntax; REVOKE removes a previously granted privilege using the same object path.
• 3Common privileges include USE CATALOG, USE SCHEMA, SELECT, MODIFY, CREATE TABLE, and ALL PRIVILEGES, and the correct privilege must exist at every level of the hierarchy (catalog, then schema, then table) for a query to succeed.
• 4Unity Catalog does not support DENY; access control is additive only through GRANT and REVOKE, so restricting access means revoking or simply never granting a privilege rather than explicitly denying it.
• 5The Catalog Explorer UI's Permissions tab lets admins grant/revoke the same privileges as SQL commands, making it interchangeable with running GRANT/REVOKE statements in a notebook or SQL editor.
• 6Service principals are treated as principals just like users and groups, and are the recommended identity type for granting access to automated jobs and pipelines rather than granting access to individual user accounts.

2 · Check your understanding