Privileges

Overview

The privileges view lists every grant in the metalake by object, so a reviewer can answer "what can be done to this, and through which role" without opening each role in turn. Each row is one role's grant on one object: the object, its type, the role, the privileges the role allows there, and the privileges it denies. The view can be searched and filtered by object, type, and role.

Grants are changed on the role that holds them rather than here. See Roles.

Quick Start

1. Find the object. Search for it by name, or filter by type.

2. Read its rows. Each row names a role and what it allows and denies on the object.

3. See who holds each role. Roles are granted to users and to groups, so the people behind a row are the role's members. See Users and Groups.

Reading a Row

A row shows a grant where the role records it. Grants reach downward, so a grant on a catalog appears once, on the catalog's row, while applying to every schema and table beneath it. To see everything that applies to a table, read the rows for the table, its schema, its catalog, and the metalake.

DENY wins over ALLOW wherever the two meet, so a privilege denied on any of those rows is denied on the table, whatever another row allows. See Access Control.

What the View Does Not Show

Ownership is not a grant, so owners do not appear here. An owner holds administrative rights over an object and everything beneath it without any role, which is worth checking separately in a review.

Membership is not shown either. The view names roles, and who holds each role is recorded on the users and groups it is granted to.