Great question.

While there are some general best practices, a lot of it comes down to how your organization already does some type of governance, when it comes to "deployment" and also "data governance".

For example Org1 might not already have a proper Governance strategy and so are learning via Databricks' permission model vs Org2 having a very structured way of doing this and "fitting" Databricks' permission model into their existing pattern.

A few years ago, I co-authored these blogs which tried to establish a mental model. [1] https://www.databricks.com/blog/2022/08/26/databricks-workspace-administration-best-practices-for-ac... and [2] https://www.databricks.com/blog/2022/11/22/serving-primer-unity-catalog-onboarding.html The second one links to a PDF of a worksheet which might help orient you.

That being said the platform changes quickly and Databricks introduces new permissions and roles from time to time so you always have to think of it as an iterative model vs something set in stone.

One thing I did want to address is that there are several organizations that leave the metastore admin role "empty". ie the metastore is "owned" by a group but members are added to that group on a just-in-time basis, either manually or via automation (if you do this you can make it an SP vs a user). That way you can link it to existing "request access" processes in your own org. You could of course do this for catalog owners and schema owners but that might be over-engineering it.

Feel free to reply and we can keep the discussion going.