ExamFinch.com My Study

Study guide

12.1 Unity Catalog Privilege Model & Grants

Practice this exam

Databricks Certified Data Analyst Associate Exam

Track your progress as you read

Finished sections get a check mark.

1 Platform Overview & Unity Catalog Foundations

1.1 Databricks Architecture & Compute Concepts 1.2 Databricks Marketplace & Data Sharing Basics 1.3 Unity Catalog Namespace & Object Hierarchy 1.4 Governed Asset Discovery & System Tables

2 Managing & Cleaning Governed Data

2.1 Dataset Discovery & Asset Tagging 2.2 Lineage Inspection & Data Traceability 2.3 SQL Data Cleaning & Transformation Techniques

3 Data Ingestion & Import Patterns

3.1 Workspace Uploads & Cloud File Ingestion 3.2 Incremental File Ingestion with Auto Loader 3.3 Ingesting Data via Delta Sharing & External Connections

4 Databricks SQL Warehouses & Core Querying

4.1 Databricks SQL Interface & SQL Assistant 4.2 SQL Warehouses Sizing & Management 4.3 Table Creation & Data Modification in Databricks SQL

5 Advanced SQL Authoring & Time Travel

5.1 Advanced Aggregations, Window Functions & Analytics 5.2 Complex Joins, CTEs & Set Operations 5.3 Views, Materialized Views & Delta Time Travel

6 Query Performance Analysis & Photon Engine

6.1 Photon Engine Architecture & Acceleration 6.2 Query History & Execution Profile Inspection 6.3 Delta Lake Audit History & Commit Logs

7 Liquid Clustering, Caching & Performance Troubleshooting

7.1 Caching Hierarchy in Databricks SQL 7.2 Data Layout Optimization: Liquid Clustering vs Partitioning & Z-Ordering 7.3 Troubleshooting Slow & Failing Queries

8 AI/BI Dashboards & Visualization Design

8.1 AI/BI Dashboards Overview & Canvas Layout 8.2 Chart Types & Visualization Selection 8.3 Notebook & SQL Editor Visualizations

9 Dashboard Interactivity, Publishing & Alerts

9.1 Dashboard Parameters & Interactive Filtering 9.2 Publishing, Sharing & Access Control 9.3 Scheduled Refresh, Email Subscriptions & Alerts

10 Developing & Maintaining AI/BI Genie Spaces

10.1 AI/BI Genie Architecture & Space Setup 10.2 Curation via Instructions, Descriptions & Sample Questions 10.3 Trusted Assets & Parameterized Functions 10.4 Monitoring, Benchmarks, Feedback & Maintenance

11 Data Modeling & Medallion Architecture

11.1 Dimensional Modeling Fundamentals 11.2 Medallion Architecture for Analytics 11.3 Constraint Enforcement & Relationships in Unity Catalog

12 Securing Data & Unity Catalog Governance

12.1 Unity Catalog Privilege Model & Grants 12.2 Ownership, Inheritance & Access Control Patterns 12.3 Fine-Grained Security: Row Filters & Column Masks

12.1 Unity Catalog Privilege Model & Grants

Key Takeaways Explain This Topic AI

Unity Catalog uses ANSI SQL standard syntax GRANT <privilege> ON <securable-type> <securable-name> TO <principal> and REVOKE for access management.

Securable objects are organized in a 3-level namespace (catalog.schema.table_or_view), requiring USE CATALOG on the parent catalog and USE SCHEMA on the schema for any child object access.

The SELECT privilege allows reading data from tables or views, while MODIFY allows INSERT, UPDATE, DELETE, and TRUNCATE operations on Delta tables.

Account-level principals (users, groups, and service principals) are managed at the account level and assigned access across workspaces via Unity Catalog.

The ALL PRIVILEGES statement grants all applicable privileges on a securable object to a principal, but does not grant object ownership.

Last updated: July 2026

Databricks Unity Catalog provides a unified, centralized governance solution for data and AI assets across the Databricks Data Intelligence Platform . It delivers consistent access control, auditing, data lineage, and asset discovery across multiple Databricks workspaces within an organization. For candidates preparing for the Databricks Certified Data Analyst Associate exam, understanding the Unity Catalog privilege model, object hierarchy, ANSI SQL authorization commands ( GRANT and REVOKE ), and privilege evaluation rules is essential.

Securable Objects & The 3-Level Namespace

In Unity Catalog, all assets managed by governance policies are designated as securable objects . These objects are arranged in a hierarchical structure using a 3-level namespace : catalog.schema.table_or_view (for example, production_catalog.finance_schema.quarterly_revenue ).

Securable Object Scope Level Description & Governed Assets

Metastore Top-Level Container The highest-level container in Unity Catalog. It stores metadata, privileges, and object definitions across an entire account.

Catalog Namespace Level 1 The primary grouping container for data assets. A metastore can host multiple catalogs (e.g., dev , staging , prod ).

Schema (Database) Namespace Level 2 A logical container inside a catalog that holds tables, views, volumes, functions, and machine learning models.

Table Asset Level 3 Governed tabular data stored in Delta Lake or external file formats.

View Asset Level 3 Saved SQL query definition providing a virtual table interface without physical data duplication.

Volume Asset Level 3 Governed storage location for unstructured or semi-structured non-tabular files (e.g., images, PDFs, JSON files).

Function Asset Level 3 User-Defined Functions (UDFs) registered within Unity Catalog for query modularity or security masking.

External Location / Storage Credential Infrastructure Level Cloud object storage paths (AWS S3, ADLS Gen2, GCS) and cloud IAM identity credentials governed by Unity Catalog.

Principals in Unity Catalog

A principal is an identity that can be granted access privileges to securable objects within Unity Catalog. Unity Catalog distinguishes between three types of account-level principals:

Account Users : Individual human identities provisioned at the Databricks account level. Users can log into workspaces and execute queries.

Account Groups : Collections of users and service principals managed centrally at the account level. Databricks strongly recommends assigning privileges to groups rather than individual user accounts to ensure scalable administration and easy onboarding/offboarding.

Service Principals : Automated non-human identities used for production jobs, CI/CD pipelines, and automated reporting scripts.

Metastore Admin : A specialized administrative principal designated at the metastore level with unrestricted capabilities to manage catalog creation, security policies, and ownership assignments.

Core Unity Catalog Privileges

Access to securable objects is enforced through granular SQL privileges. A principal cannot interact with an object unless explicit or inherited privileges have been granted.

USE CATALOG : Grants traversal access into a specified catalog. Without USE CATALOG on a catalog, a principal cannot access any child schema or table inside it, regardless of table-level grants.

USE SCHEMA : Grants traversal access into a specified schema. Required alongside USE CATALOG to read or write any child objects within that schema.

SELECT : Grants read access to data stored within tables, views, materialized views, or streaming tables.

MODIFY : Grants write access to execute Data Manipulation Language (DML) operations—including INSERT , UPDATE , DELETE , MERGE INTO , and TRUNCATE —on Delta Lake tables.

CREATE TABLE / CREATE VIEW / CREATE VOLUME / CREATE FUNCTION : Grants permissions to create new securable objects inside a target schema.

CREATE CATALOG / CREATE SCHEMA : Grants permissions to instantiate new top-level or second-level namespaces.

EXECUTE : Grants authorization to invoke scalar or tabular User-Defined Functions (UDFs).

READ VOLUME / WRITE VOLUME : Governs unstructured file access within Unity Catalog Volumes.

ALL PRIVILEGES : Grants all valid privileges applicable to the target securable object to the specified principal (note: this does not confer object ownership).

SQL Grant & Revoke Syntax

Unity Catalog utilizes standard ANSI SQL syntax for managing privileges. The core syntax forms are: -- Granting traversal and read access to an analytics group

  • GRANT USE CATALOG ON CATALOG production_catalog TO GROUP bi_analysts;
  • GRANT USE SCHEMA ON SCHEMA production_catalog.finance_schema TO GROUP bi_analysts;
  • GRANT SELECT ON TABLE production_catalog.finance_schema.quarterly_revenue TO GROUP bi_analysts;
  • - Granting full data modification capabilities to a service principal
  • GRANT MODIFY ON TABLE production_catalog.finance_schema.quarterly_revenue TO `sp-etl-pipeline@company.com`;
  • - Revoking write permissions from a contractor group
  • REVOKE MODIFY ON TABLE production_catalog.finance_schema.quarterly_revenue FROM GROUP temporary_contractors;
  • Privilege Traversal: The Two-Gatekeeper Rule

A critical exam concept in Unity Catalog is the privilege traversal rule (often called the two-gatekeeper rule). To successfully read data from a table such as prod.sales.orders , Unity Catalog requires the querying principal to satisfy three simultaneous conditions:

Hold USE CATALOG on the parent catalog ( prod ).

Hold USE SCHEMA on the parent schema ( sales ).

Hold SELECT on the target table ( orders ) or its parent container.

If an analyst possesses SELECT on prod.sales.orders but lacks USE CATALOG on prod or USE SCHEMA on sales , any query against orders will fail immediately with a Permission Denied error indicating missing parent traversal privileges. Access Request -> [USE CATALOG Check] -> [USE SCHEMA Check] -> [SELECT Check] -> Data Returned

  • Real-World Exam Scenarios & Troubleshooting
  • Scenario 1: Resolving Unexpected "Permission Denied" Errors

Problem : A data analyst executes SELECT * FROM marketing_catalog.campaigns.conversions; and receives an authorization failure, despite the data lead confirming that GRANT SELECT ON TABLE marketing_catalog.campaigns.conversions TO GROUP analysts; was executed.

Diagnosis : The analyst's group lacks traversal privileges on the parent hierarchy.

Resolution : Execute GRANT USE CATALOG ON CATALOG marketing_catalog TO GROUP analysts; and GRANT USE SCHEMA ON SCHEMA marketing_catalog.campaigns TO GROUP analysts; .

Scenario 2: Distinguishing DML vs DDL Privileges

Problem : An engineer needs to add a new column to a Delta table via ALTER TABLE sales ADD COLUMN region STRING; . Is MODIFY sufficient?

Diagnosis : No. MODIFY governs DML data changes ( INSERT / UPDATE / DELETE ). Altering table schema (DDL) requires table ownership or ALTER TABLE privileges.

Summary Checklist for Exam Readiness

Remember that Unity Catalog objects use catalog.schema.object naming.

Understand that account-level groups are the recommended principal target for privileges.

Always verify USE CATALOG and USE SCHEMA traversal permissions when debugging read/write failures.

Memorize the distinction between SELECT (read) and MODIFY (write/DML).