Ensuring Data Security and Compliance
Least privilege in Unity Catalog
Privileges are granted on securables: metastore, catalog, schema, table, view, volume, function. Understand inheritance (a grant on a schema applies to its objects) and USE CATALOG/USE SCHEMA - a user can hold SELECT on a table yet still be denied because they lack USE on the parent schema. Ownership implies all privileges on the object and the ability to grant them. Account-level vs workspace-level admin is a recurring confusion. External locations and storage credentials isolate cloud IAM from user identity; credential passthrough-style access is legacy.
Row/column level controls
For fine-grained control use dynamic views with current_user(), is_account_group_member(), or mapping tables, or the newer ABAC row-filter and column-mask policies. Column masks must preserve the type of the masked column - a mask returning a different type is rejected. Views that reference current_user() must be owned appropriately to avoid the definer's privileges leaking.
Compliance mechanics
Audit logs record access and privilege changes and feed system.access.audit. Secrets belong in secret scopes, never in notebooks. Encryption at rest is default; customer-managed keys add control. For "right to be forgotten", remember DELETE + VACUUM (past retention) removes data physically, and time travel/RESTORE windows extend the exposure period.
Rule of thumb: if a requirement says "only some rows or some columns", reach for a dynamic view or ABAC policy, not table-level grants.