Data permissions
See and change who can read or change a warehouse, namespace, or table.
This page covers the Permissions tab in the Data Catalog: reading grants, and — if you may — making them.
Data grants are a separate layer from the five feature permissions: opening a feature grants you no data. See how access works.
Read who has access
Open the Permissions tab on any warehouse, namespace or table — every level is its own scope. It has two parts:
- Direct grants — people, catalog roles and applications granted on this exact object.
- Inherited — access reaching this object from a grant made further up. A warehouse grant reaches every namespace and table under it; a namespace grant reaches its tables. Inherited grants are read-only here — change them where they were made.
Make a grant
If you may grant on an object — you hold Manage grants or ownership on it — its Permissions tab lets you add a grant. Search for the principal (Search users and roles…):
- a person;
- a catalog role (see below);
- an Application — a machine identity, such as the one a pipeline runs as. Grant it like a person.
The Permissions dialog then groups what you can give:
| Group | Options | Meaning |
|---|---|---|
| Data access | None, Describe, Select, Modify | A ladder: each level includes the ones before it. Describe sees the object and its metadata; Select reads the data; Modify writes data and changes the object. |
| Grant authority | None, Pass grants, Manage grants | Pass grants lets them pass on what they already hold, and nothing on its own. Manage grants lets them grant and revoke anything here. |
| Object creation | Create | Create namespaces and tables underneath. Only on warehouses and namespaces. |
| Ownership | Make owner / Remove | Everything, including handing ownership on. An object can have several owners. |
Select Save to apply. If part of the change is beyond your own rights, the dialog says You may not change: … for that part.
Grant on the smallest object that covers the work. Grants cascade downward, so a warehouse-wide grant hands out every table beneath it — often more than intended.
What cascades and what does not
- Describe, Select, Modify, Create and Manage grants travel down the tree: a namespace grant applies to every table in it.
- Ownership and Pass grants stay on the object where they were set.
- Managed access is a switch on a warehouse or namespace. When on, owners below it cannot hand out grants — only Manage grants can. It does not stop data access from cascading; it only limits who may grant.
Catalog roles
A catalog role is a named group you grant data access to, so you grant a table to the group once instead of to each person. Manage them from the Roles section in the catalog sidebar: a role has Members and Settings tabs.
Catalog roles are not the roles that bundle feature permissions: a catalog role grants data access only.
When a grant takes effect
Data permissions are checked on every query, as the signed-in user, so a new grant applies to your next query — nothing to restart, no need to sign out. If the catalog does not show a fresh grant yet, use Check again on the No rights yet screen, or Refresh in the catalog header.