Governance and Security

An administrator runs the grant below so that members of the account group analysts can read a Unity Catalog table. The grant succeeds, but an analyst querying prod.sales.orders from a SQL warehouse receives an error saying the table cannot be found. The table exists and the analyst is in the group. What explains the behaviour?

GRANT SELECT ON TABLE prod.sales.orders TO `analysts`;

• AThe analyst also needs USE CATALOG on prod and USE SCHEMA on prod.sales, because every parent securable in the path must be traversable before SELECT applies.check_circle Correct
• BThe SELECT privilege applies to the table owner's own sessions, so the analyst needs an equivalent grant issued at the metastore level instead.
• CSQL warehouses resolve privileges through the workspace Hive metastore, so the same grant has to be repeated there before the table becomes visible.
• DTable level grants take effect at the next warehouse restart, so the analyst has to wait for the privilege cache on the SQL warehouse to be rebuilt.

Why A is correct: Correct, because Unity Catalog evaluates the whole path to a securable, and without USE CATALOG on the catalog and USE SCHEMA on the schema the analyst cannot resolve the name, which surfaces as a table not found error rather than a permission error.

Why B is wrong: Tempting because metastore administrators can see everything, which suggests privileges must be assigned high in the hierarchy, but SELECT granted on a table applies to the named principal, not to the owner alone, and Unity Catalog does not require a metastore level grant for ordinary reads.

Why C is wrong: Plausible for anyone who remembers the legacy table access control model, but a three level name such as prod.sales.orders is resolved by Unity Catalog, and the workspace Hive metastore is a separate legacy catalog that holds no privileges for it.

Why D is wrong: Attractive because caching does explain some delayed behaviour in distributed systems, but Unity Catalog grants are evaluated per statement against the metastore, so a restart would change nothing while the traversal privileges are missing.