Unity Catalog Security and PII Protection

What it is

Unity Catalog governs data access in Databricks. Every table, view, volume and function is secured in one hierarchy, and every query from any tool is checked against it.

Workspace objects such as dashboards and Genie Agents have their own sharing settings. These control who can open the object; Unity Catalog still decides which data they see.

How it works

The three level namespace

Objects are named catalog.schema.object. A catalog is the top container, often one per business unit or environment, and a schema groups related objects inside it. The third level holds tables, views, volumes, functions and models.

SELECT order_id, amount
FROM sales.gold.orders     -- catalog.schema.table
WHERE amount > 100;

Volumes hold files rather than tables and use paths such as /Volumes/sales/raw/landing/. All catalogs sit in a metastore, which is attached to the workspaces of a region.

Privileges and inheritance

Privileges inherit downward: SELECT granted on a schema applies to every current and future table in it.

GRANT USE CATALOG ON CATALOG sales TO `analysts`;
GRANT USE SCHEMA ON SCHEMA sales.gold TO `analysts`;
GRANT SELECT ON SCHEMA sales.gold TO `analysts`;
REVOKE SELECT ON SCHEMA sales.gold FROM `contractors`;
SHOW GRANTS ON SCHEMA sales.gold;

Unity Catalog has no DENY statement. REVOKE removes only that principal's own grant, so access through another group remains.

Roles and ownership

Every object has one owner. The owner has all privileges on it and can grant them to others. Account admins and metastore admins manage the metastore, and workspace admins manage the workspace and its objects.

Best practice is to make a group the owner of catalogs, schemas and production tables, so access does not depend on one person.

ALTER TABLE sales.gold.orders OWNER TO `data_engineering`;

Sharing settings for workspace objects

Dashboards, queries, notebooks and Genie Agents use levels such as CAN VIEW, CAN RUN, CAN EDIT and CAN MANAGE. Grant them to groups, and keep CAN MANAGE for the object's owners.

A published AI/BI dashboard can use shared data permissions, so viewers see its data through the publisher's credentials without their own table grants. With individual data permissions, each viewer needs their own Unity Catalog access.

Storage best practices

Prefer managed tables: Unity Catalog controls their files and lifecycle, and predictive optimization can maintain them. External tables and volumes read paths through secured external locations, so users never need direct cloud storage keys.

Use MANAGED LOCATION on CREATE CATALOG or CREATE SCHEMA when managed data must be stored in a specific place; a schema location overrides the catalog location.

Protecting PII

Row filters and column masks are SQL functions attached to the table, so they apply in every tool; is_account_group_member() decides what each user sees.

CREATE FUNCTION sales.gold.mask_email(email STRING)
RETURN CASE WHEN is_account_group_member('hr') THEN email ELSE '***' END;
ALTER TABLE sales.gold.customers ALTER COLUMN email SET MASK sales.gold.mask_email;

CREATE FUNCTION sales.gold.emea_only(region STRING)
RETURN is_account_group_member('admins') OR region = 'EMEA';
ALTER TABLE sales.gold.orders SET ROW FILTER sales.gold.emea_only ON (region);

How the exam asks about this

• "Analysts can see the schema but get a permission error on the table." Grant SELECT on the table or the schema.
• "Support staff must see customers but not full email addresses." Add a column mask on the email column.
• "The table owner is leaving the company." Transfer ownership to a group with ALTER TABLE ... OWNER TO.