That's correct, unlike table access control using credential passthrough all the user will see all the databases and table/view (but they wont be able to query some one else's table/view as it will fail with access error) , but then there is no control over dropping someone else's table from Hive, so based on my example above User2 will be able to run drop table on Database1.Table even though he can not run Select * From Database1.Table because it is created on a mounting point which user2 dont have access, but user2 can change hive megastore e.g. drop tables