Unity Catalog becomes much easier to reason about when you stop treating it as a list of grants. It is a hierarchy of governed objects, identities and privileges. A request is allowed only when the identity has the required permission at every relevant boundary.
Start at the metastore
A Unity Catalog metastore is the top-level governance boundary assigned to one or more workspaces. Beneath it sit catalogs, schemas and objects such as tables, views, volumes, functions and models. The familiar three-part table name—catalog.schema.table—is therefore an address inside that hierarchy, not merely a naming convention.
Storage and governance are different jobs
A managed table is governed by Unity Catalog and its files are placed in managed storage. An external table is still governed as a table, but its files remain at an external location. Storage credentials and external locations authorize access to cloud storage; table privileges authorize people and workloads to use the governed object. Mixing these layers is a common source of confusing access errors.
A cloud-storage permission and a Unity Catalog privilege answer different questions. Production access often requires both layers to be correct.
Design catalogs around boundaries
Catalogs are useful when they represent meaningful isolation—for example a business domain, environment or regulatory boundary. Creating a catalog for every team or project can produce administrative noise; placing everything in one catalog can make ownership unclear. Start with who owns the data, who may administer it and which environments must be isolated.
-- Illustrative hierarchy
GRANT USE CATALOG ON CATALOG analytics TO `data_engineers`;
GRANT USE SCHEMA ON SCHEMA analytics.sales TO `data_engineers`;
GRANT SELECT ON TABLE analytics.sales.orders TO `data_engineers`;The exact grants depend on your access model. The example shows why access to a table is evaluated in the context of its parent catalog and schema.
Govern for discovery as well as denial
Governance is not only about blocking access. Owners, descriptions, tags, lineage and consistent naming help engineers discover the right data and understand whether it is safe to use. A technically secure table that nobody can interpret still creates risk because consumers build their own copies and assumptions.
The best governance model makes the approved path easier to find than the workaround.
Go to the source
Keep learning with the official documentation.
Databricks: Unity Catalog concepts ↗Databricks: securable objects and privileges ↗