MANAGE ACCESS CONTROL

In the Ultra Transcenders books

DBX-DEP

Each book explains MANAGE ACCESS CONTROL in context, with comparison tables and the common traps.

Terms in this definition

• MANAGE

  A Unity Catalog privilege allowing a principal to grant and revoke access on an object, hand over its ownership and drop it, all without being the owner. It gives no data access by itself and is not part of ALL PRIVILEGES.

• OVER

  Gives a T-SQL window function its window: PARTITION BY, ORDER BY and, if wanted, a ROWS or RANGE frame. Rankings and running totals can then be worked out while every row is kept.

• Object owner

  Every Unity Catalog securable, and every workspace object such as a job or warehouse, has exactly one owner (IS OWNER), which can be a user, a group or a service principal. That owner holds every capability on the object, though child objects do not inherit the ownership.

• ABAC

  An access-control approach in Unity Catalog where governed tags determine what a policy covers. A single policy set on a metastore, catalog, schema or table can therefore filter rows, mask columns, or grant or deny access across many objects at once.

• ABAC DENY policy

  A Beta policy type that blocks MANAGE ACCESS CONTROL wherever a securable carries matching governed tags; even ownership or an explicit grant can't get round it. The legacy Hive metastore's SQL DENY is a different thing.

Related terms

• Composite privileges

  In Unity Catalog, a privilege that breaks down into narrower ones covering a slice of what it allows: MANAGE, for example, contains MANAGE ACCESS CONTROL and READ METADATA. Each level can be given or taken away separately.

• DENY policy

  A Beta ABAC policy type that takes a privilege away rather than granting one; at the moment it can only block MANAGE ACCESS CONTROL. It applies wherever governed tags match and beats every grant, ownership too, though it never restricts metastore admins.