Databricks Catalog, Schema & Table Permissions (RBAC)

🔐 A Simple Story — “Too Many People, Too Much Data”

Imagine a company where:

• Analysts need access to Gold tables
• Data engineers need access to Bronze/Silver
• Data scientists need feature tables
• Finance wants restricted datasets
• Interns should not see sensitive customer info

Without proper access controls, your Databricks environment becomes:

⚠️ Messy
⚠️ Risky
⚠️ Hard to audit

What you need is a clean, structured permission system that controls who can access what — and keeps everything consistent.

This is where RBAC (Role-Based Access Control) in Databricks shines.

---

🗂 Understanding the Structure: Catalog → Schema → Table

Databricks organizes storage and permissions in three layers:

CATALOG
└── SCHEMA
└── TABLE / VIEW / FUNCTION

Think of it like:

• Catalog = entire building
• Schema = floor inside the building
• Table = rooms inside the floor

You can set permissions at any level.

---

🏢 1. Catalog — The Top Level

A catalog contains schemas and tables.
In Unity Catalog, this is the highest namespace.

Example:

hive_metastore
main
sales_catalog
ml_catalog

Permissions Often Set Here:

• USE CATALOG
• CREATE SCHEMA
• OWN
• READ FILES (for external locations)

Example:

GRANT USE CATALOG ON CATALOG sales_catalog TO analyst_team;

This allows the team to see and navigate the catalog.

---

🗄 2. Schema — Organizing Tables

A schema groups related objects.

Examples:

sales_catalog
    ├── bronze
    ├── silver
    └── gold

Permissions Often Set Here:

• USE SCHEMA
• CREATE TABLE
• SELECT
• MODIFY
• OWN

Example:

GRANT USE SCHEMA ON SCHEMA sales_catalog.gold TO bi_team;

Now BI users can query tables inside the Gold schema.

---

📊 3. Table — The Most Detailed Level

Tables hold actual data.

Examples:

sales_catalog.gold.daily_revenue
sales_catalog.silver.cleaned_orders

Permissions Often Set Here:

• SELECT (read data)
• MODIFY (insert/update/delete)
• OWN (full control)

Example:

GRANT SELECT ON TABLE sales_catalog.gold.daily_revenue TO finance_team;

Now finance users can read the Gold revenue table — and only that table.

---

🧠 Important RBAC Concepts

✔ Ownership

Every object (catalog, schema, table) has an owner.

Owners can:

• Modify
• Grant permissions
• Drop objects

You typically assign ownership to:

• Admin groups
• Data engineering teams

---

✔ Principle of Least Privilege

Always give only the access required:

• Analysts → Gold
• Data Scientists → Feature tables
• Engineers → Bronze/Silver
• Finance → Restricted Gold tables
• Interns → Only learning datasets

This keeps your environment safe and compliant.

---

✔ Inheritance

If you grant a privilege at a higher level, it flows downward.

Example:

GRANT SELECT ON SCHEMA sales_catalog.gold TO bi_team;

This gives read access to all tables inside gold.

---

🧪 Practical Real-World Permission Patterns

Pattern 1 — BI/Analytics Teams

Only Gold data is needed.

GRANT SELECT ON SCHEMA sales_catalog.gold TO bi_team;

---

Pattern 2 — Data Engineers

Full control of Bronze/Silver.

GRANT MODIFY ON SCHEMA sales_catalog.bronze TO data_eng;
GRANT MODIFY ON SCHEMA sales_catalog.silver TO data_eng;

---

Pattern 3 — Secure Financial Data

Only the finance group can read.

GRANT SELECT ON TABLE sales_catalog.gold.finance_metrics TO finance_team;

---

Pattern 4 — External Tables

Need READ FILES privilege.

GRANT READ FILES ON EXTERNAL LOCATION finance_location TO finance_team;

---

🛡 Unity Catalog Makes RBAC Easy

Unity Catalog centralizes permissions across:

• Databricks SQL
• Notebooks
• Jobs
• MLflow
• Delta Lake

So the same RBAC rules apply everywhere — clean, consistent, reliable.

---

📘 Summary

• Databricks uses Catalog → Schema → Table for organizing data.
• RBAC (Role-Based Access Control) lets you define who can do what.
• You can control access at any level: catalog, schema, or table.
• Permissions include: USE, SELECT, MODIFY, CREATE, OWN, etc.
• Unity Catalog provides centralized, secure, enterprise-grade permission management.
• Always follow the least privilege model for safety and compliance.

RBAC ensures the Lakehouse stays clean, secure, and easy to manage as your organization grows.

---

👉 Next Topic

Databricks LakeFlow — Unified ETL, Orchestration & Governance