Governance at Scale: A Guide to Databricks Unity Catalog

For years, Databricks permissions were a mess. You had to manage them separately for each Workspace. If you had a “Prod” workspace and a “Dev” workspace, you had to define who could see the “Sales” table twice.

Unity Catalog fixes this. It is a unified governance layer that sits above your workspaces.

One Metastore to Rule them All

With Unity Catalog, you define your users and data permissions once, at the Account level.

• GRANT SELECT ON TABLE sales TO group finance; This applies everywhere. It doesn’t matter which workspace the Finance team logs into; the rule holds.

Capabilities

1. Data Lineage: It automatically tracks how data moves. You can see a column in a dashboard and trace it all the way back to the raw S3 file it came from. This is magic for debugging.
2. Fine-Grained Access: You can filter rows and masks columns.
   • “Analysts can see the customers table, but mask the email column.”
   • “German employees can only see rows where country = 'DE'.”
3. Audit Logs: You get a complete log of who accessed what data and when.

The Migration

Moving to Unity Catalog usually requires upgrading your Hive Metastore. It’s a non-trivial migration, but essential for security.

Cloud costs out of control? Cut your GCP and cloud bill by 20% in 30 days. We help enterprises master their spend. Get a FinOps Audit.