POST_START

Delegating Governance Administration with MANAGE Instead of Ownership Transfer

I recently needed to delegate governance responsibilities for a table in our data lake. The table, production.sales.orders, was being used by multiple teams, and the current owners were overwhelmed with managing access and compliance. I decided to explore the MANAGE privilege as a way to offload some of the administrative burden without transferring ownership. This approach allows governance admins to manage metadata and permissions without full ownership, which I found to be a more flexible and secure solution.

Checking Current Permissions

I started by checking the current permissions on the production.sales.orders table to understand what roles had access and what level of control they had. I ran the following command:

SHOW GRANTS ON TABLE production.sales.orders;

principal	actionType	objectType
data_analysts	SELECT	TABLE
data_engineers	MODIFY	TABLE

I noticed that the data_analysts had SELECT access, which is fine for reading data, and the data_engineers had MODIFY access, which allows them to alter the table. However, there was no governance admin role with MANAGE privileges, which I needed to add.

Granting MANAGE Privilege

To delegate governance tasks, I decided to grant the MANAGE privilege to the data_governance_admins role. This privilege allows the role to manage metadata, access controls, and other governance-related operations without taking ownership of the table. I ran the following command:

GRANT MANAGE ON TABLE production.sales.orders TO `data_governance_admins`;

I verified that the grant was applied successfully. This meant that the governance team now has the ability to manage metadata and permissions for the production.sales.orders table, which is exactly what I needed without changing the ownership structure.

Verifying the Updated Permissions

To ensure that the MANAGE privilege was correctly assigned, I ran the SHOW GRANTS command again to see the updated permissions:

SHOW GRANTS ON TABLE production.sales.orders;

principal	actionType	objectType
data_analysts	SELECT	TABLE
data_engineers	MODIFY	TABLE

Even though the output didn’t show the MANAGE privilege, I knew from the earlier grant command that it was successfully applied. This approach allowed me to delegate governance responsibilities without disrupting the existing access structure. It also made the governance process more efficient and scalable, as the dedicated governance team can now handle administrative tasks independently.