Re: Data Governance Unity Catalog: SELECT privileg...

Khaja_Zaffer · ‎11-01-2025

Hello @old_school

Good day!

I dont think its expected behaviour.

Table Privileges Summary

PrivilegeAllowsPrerequisites

SELECT	Read data (SELECT * FROM table)	USE CATALOG + USE SCHEMA
MODIFY	Write data: INSERT, UPDATE, DELETE, MERGE	SELECT + USE CATALOG + USE SCHEMA
MANAGE	Manage grants, ownership, drop/rename	USE CATALOG + USE SCHEMA
ALL PRIVILEGES	All above (expands dynamically)

You can look here for more details on the same: https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/privileges

USE CATALOG and USE SCHEMA are prerequisites—they don't grant read/write on their own. SELECT → read-only. INSERT requires MODIFY (plus prerequisites).

So we can check UI approach: Data → Catalog → Table → Permissions tab → Select your principal (user/group/SP).Shows full effective list (direct + inherited). If MODIFY listed → explains INSERT.

You can also do this by

SHOW GRANTS ON SCHEMA <catalog>.<schema>;SHOW GRANTS ON CATALOG <catalog>;

Revoke unwanted:

REVOKE MODIFY ON SCHEMA <catalog>.<schema> FROM `<principal>`;