Skip to main content

Groups and catalog access

Who: organization owners and administrators.

Start with the role​

Human roleBroad application permissions in the reviewed backend
Organization owner / AdministratorWorkspace read/write and organization management.
Data engineerWorkspace read/write and organization overview.
Analyst / ViewerWorkspace read and organization overview; no workspace-write permission.
AuditorOrganization overview and audit-read permission; not ordinary workspace read/write.

Catalog authorization adds a second layer. A matching catalog grant does not bypass role restrictions, MFA, or revoked membership. Conversely, a workspace role is not a blanket guarantee of access to every catalog resource.

SQL submission currently requires workspace-write permission, even for a SELECT query. Assigning Analyst or Viewer does not enable query execution.

Create a group and add members​

  1. Open Administration → Groups.
  2. Enter a Group name and optional Description, then select Create group.
  3. Select the group and an organization member, then choose Add to group.
  4. Review the membership list. Use Remove from group when a member no longer needs the group's access.

Grant access to a named resource​

Open Administration → Catalog access and complete the grant form:

  1. Choose Group or Member as the principal type, then choose the principal.
  2. Select the resource type and enter its exact Resource name.
  3. Select only the permissions needed for the task.
  4. Choose ALLOW or DENY and decide whether descendants are included.
  5. Select Create grant, refresh if needed, and verify access using the intended member's session.

For example, an approved training group may need DISCOVER and SELECT on iceberg.training with resource type SCHEMA and descendant scope. This is an illustrative name: use your actual catalog and schema, and verify both metadata visibility and query permissions in your deployment.

How conflicts are handled​

Matching explicit DENY rules take precedence over ALLOW. Without applicable permission, access is denied. Check both direct member grants and group grants when investigating an unexpected denial.

Use Delete on a grant only after checking the impact. Deleting an access rule removes that rule; it does not delete the database or table it names.