POST_START

Separating Human and Machine Access to Production Data

I recently had the task of ensuring that our production data was accessible to the right people and systems. As part of this, I needed to understand how access was currently configured in Databricks Unity Catalog. I started by checking the grants on the production catalog to get an overview of who had access and what permissions they had.

SHOW GRANTS ON CATALOG production;

I saw a representative result like this:

principal | actionType | objectType
data_analysts | SELECT | TABLE
data_engineers | MODIFY | TABLE

This showed me that the data_analysts group had SELECT access to tables, while data_engineers had MODIFY access. But I wanted to dig deeper into the specific schemas and tables to ensure that access was properly scoped and separated for human and machine users.

I next checked the grants on the production.sales schema to see what permissions were in place for that specific area of the catalog.

SHOW GRANTS ON SCHEMA production.sales;

I saw a representative result like this:

principal | actionType | objectType
data_analysts | SELECT | TABLE
data_engineers | MODIFY | TABLE

This confirmed that the same principal groups had the same permissions on the schema level. It was consistent with what I had seen at the catalog level. However, I wanted to verify this at the table level as well, to ensure that access was properly controlled down to the specific tables used by our systems.

I ran the command to check the grants on the production.sales.orders table to get the most granular view of access permissions.

SHOW GRANTS ON TABLE production.sales.orders;

I saw a representative result like this:

principal | actionType | objectType
data_analysts | SELECT | TABLE
data_engineers | MODIFY | TABLE

This final check confirmed that the access model was consistent across the catalog, schema, and table levels. It meant that human users, like data analysts, could read data, while machine users, like data engineers, could modify it. This separation helped ensure that our production data remained secure and that access was properly scoped for different types of users.

By reviewing these grants, I was able to validate that our access model was aligned with our security and operational requirements. This step was critical in ensuring that human and machine access to production data was properly separated and managed through Unity Catalog.