A table privilege without the parent usage path
A fictional Databricks account uses the supplied Unity Catalog privilege model. An analyst has a SELECT grant on prod.sales.orders, but the provided effective-permission review shows no USE CATALOG on prod and no USE SCHEMA on sales. The user is already a member of the intended workspace, and the observed query fails with an authorization error. A colleague proposes making the analyst an account administrator. Another proposes checking the specific required parent usage path and any relevant workspace binding, then applying only an authorized minimal change. The exercise makes no query and changes no grant. It tests the difference between workspace membership, table privilege and the complete governed path needed for a particular operation.
1. Why is the table grant not enough here?
Read the worked answer
Under the supplied model, reading requires the relevant parent usage privileges as well as SELECT and other applicable controls. Workspace membership is not a substitute.
2. What should an authorized remedy target?
Read the worked answer
Verify the intended principal, parent objects and binding, then grant only justified missing rights through the approved process. Account administration is an unnecessary broad escalation for this supplied gap.