# Data permissions (/catalog/data-permissions)

See and change who can read or change a warehouse, namespace, or table.

This page covers the **Permissions** tab in the Data Catalog: reading grants, and — if you may —
making them.

<Callout type="warn">
  Data grants are a separate layer from the five feature permissions: opening a feature grants you no data.
  See [how access works](/access/how-access-works).
</Callout>

## Read who has access

Open the **Permissions** tab on any warehouse, namespace or table — every level is its own scope. It
has two parts:

- **Direct grants** — people, catalog roles and applications granted on this exact object.
- **Inherited** — access reaching this object from a grant made further up. A warehouse grant reaches
  every namespace and table under it; a namespace grant reaches its tables. Inherited grants are
  read-only here — change them where they were made.

## Make a grant

If you may grant on an object — you hold **Manage grants** or ownership on it — its Permissions tab
lets you add a grant. Search for the principal (**Search users and roles…**):

- a **person**;
- a **catalog role** (see below);
- an **Application** — a machine identity, such as the one a pipeline runs as. Grant it like a
  person.

The **Permissions** dialog then groups what you can give:

| Group | Options | Meaning |
| ----- | ------- | ------- |
| Data access | None, **Describe**, **Select**, **Modify** | A ladder: each level includes the ones before it. Describe sees the object and its metadata; Select reads the data; Modify writes data and changes the object. |
| Grant authority | None, **Pass grants**, **Manage grants** | Pass grants lets them pass on what they already hold, and nothing on its own. Manage grants lets them grant and revoke anything here. |
| Object creation | **Create** | Create namespaces and tables underneath. Only on warehouses and namespaces. |
| Ownership | **Make owner** / **Remove** | Everything, including handing ownership on. An object can have several owners. |

Select **Save** to apply. If part of the change is beyond your own rights, the dialog says
**You may not change: …** for that part.

Grant on the smallest object that covers the work. Grants cascade downward, so a warehouse-wide grant
hands out every table beneath it — often more than intended.

### What cascades and what does not

- **Describe, Select, Modify, Create and Manage grants** travel down the tree: a namespace grant
  applies to every table in it.
- **Ownership and Pass grants** stay on the object where they were set.
- **Managed access** is a switch on a warehouse or namespace. When on, owners below it cannot hand
  out grants — only **Manage grants** can. It does not stop data access from cascading; it only
  limits who may grant.

## Catalog roles

A **catalog role** is a named group you grant data access to, so you grant a table to the group once
instead of to each person. Manage them from the **Roles** section in the catalog sidebar: a role has
**Members** and **Settings** tabs.

Catalog roles are not the [roles that bundle feature permissions](/access/managing-access): a catalog
role grants data access only.

## When a grant takes effect

Data permissions are checked on every query, as the signed-in user, so a new grant applies to your
next query — nothing to restart, no need to sign out. If the catalog does not show a fresh grant yet,
use **Check again** on the **No rights yet** screen, or **Refresh** in the catalog header.