Data permissions
See and change who can read a warehouse, namespace, or table.
This page covers the Permissions tab in the Data Catalog: reading grants, and — if you may — making them.
Data grants are a separate layer from the five feature permissions: opening a feature grants you no data. See how access works.
Read who has access
Open the Permissions tab on any warehouse, namespace or table — every level is its own scope. It has two parts:
- Direct grants — people and catalog roles granted on this exact object.
- Inherited — access reaching this object from a grant made further up. A warehouse grant reaches every namespace and table under it; a namespace grant reaches its tables. Inherited grants are read-only here — change them where they were made.
Make a grant
If you may grant on an object, its Permissions tab has an Add user or role button. Search for a person or catalog role and choose what they get: Select (read the data, the common grant) or Describe (see the object and its metadata without reading rows).
Grant on the smallest object that covers the work. Grants cascade downward, so a warehouse-wide grant hands out every table beneath it — often more than intended.
Catalog roles
A catalog role is a named group you grant data access to, so you grant a table to the group once instead of to each person. Manage them from the Roles section in the catalog sidebar.
Catalog roles are not the roles that bundle feature permissions: a catalog role grants data access only.
When a grant takes effect
Data permissions are checked on every query, as the signed-in user, so a new grant applies to your next query — nothing to restart, no need to sign out. If the catalog does not show a fresh grant yet, use Check again on the No rights yet screen, or Refresh in the catalog header.