Drop table - permission management

[PiotrM]

Hello,

I'm trying to wrap my head around the permission management for dropping tables in UC enabled schemas.

According to docs: 

To drop a table you must have the MANAGE privilege on the table, be its owner, or the owner of the schema, catalog, or metastore the table resides in.

So more or less you'd have to had some kind of ownership/management level privilages to do it.

The issue I seem to have with it is as follows - I'd like to give the developers permission to conduct all necessary tasks in the schemas they can access: like table creation/modyfing/droping etc. without them having the ability to grant other users permissions on the schema level. 

The perfect solution that I can envision would be a seperate DROP privilage on either catalog/schema/table level.

What are the best practices to approach this matter?

BR

[Alberto_Umana]

Hi @PiotrM,

Thanks for your questions. 

Given the current capabilities of Unity Catalog, there is no separate DROP privilege that can be granted independently of the MANAGE privilege. It is best practice to assign access to groups rather than individual users. This simplifies identity management and ensures that permissions are consistently applied. You can create groups for developers and assign the necessary permissions to these groups, however to drop tables you will need manage permission. I will raise a feature request for your use-case.

[PiotrM]

Hey @Alberto_Umana,

thank you for reaching out. 

Greatly appreciated. Could you please let me know in case there is any response from product team, be it positive or negative?

[Alberto_Umana]

Hi @PiotrM,

I see there is a feature request already in place. It's been considered for the future: https://databricks.aha.io/ideas/ideas/DB-I-7480

[pablo_paez]

It will be nice to have this feature, I really want  to manage separetly the permission to add or edit records and the preivlegue to delete records. Nowdays are all in the same box