What problem does it solve? Managing who can access what data in Databricks Unity Catalog is complex: grants require traversal privileges, external locations need storage credentials, and answering questions like "who can read this table" or "what did this query cost" requires knowing the privilege model and system table schemas. This Skill provides the operational guidance to perform these governance and observability tasks correctly. ## Core Features & Use Cases - Access Control & Privileges: Grant and revoke access with GRANT/REVOKE, transfer ownership, inspect effective grants with SHOW GRANTS, and reason about the securable hierarchy and privilege inheritance. - Fine-Grained Security: Implement row filters, column masks, and dynamic views using current_user() and is_account_group_member() to restrict which rows and column values users see. - Observability via System Tables: Query system.access audit logs and lineage, system.billing usage, system.query history, and system.lakeflow job runs for security monitoring, cost analysis, and impact analysis. - Use Case: A platform admin needs to give an analytics team read-only access to a gold schema while masking PII columns, then verify access via audit logs. This Skill walks through the GRANT statements, the column mask UDF, and the system.access.audit query to confirm. ## Quick Start Ask the AI to grant the data_readers group SELECT access on the analytics.gold schema in Unity Catalog and show who currently has access to a specific table.
