Databricks · One-Pager · Governance

Unity Catalog governed

The unified governance layer for data and AI on Databricks — one permission model, one lineage graph, one audit trail across every workspace.

GA catalog.schema.object Verified June 2026 docs

In one line

Unity Catalog is Databricks' centralized governance layer that manages access, lineage, and auditing for all data and AI assets through a three-level namespace (catalog.schema.object) rooted in a metastore.

Why it matters

Without it, each workspace governs its own metadata and permissions in isolation. Unity Catalog defines access rules once at the account/metastore level and enforces them everywhere — so you grant on a catalog, not on N copies of a table, and lineage and audit come for free.

Core concepts

Metastore

Top-level container of metadata and the access-control model; one per region, attached to workspaces and shared across them.

Three-level namespace

You address every object as catalog.schema.object — catalog and schema replace the legacy two-level schema.table.

Securable object

Anything you can grant on: catalogs, schemas, tables, views, volumes, functions, models — plus metastore-level storage credentials, external locations, connections, shares.

Privileges & GRANT

GRANT <priv> ON <type> <name> TO <principal>; USE CATALOG/USE SCHEMA are required to traverse into any child object.

Privilege inheritance

Grants cascade downward — SELECT on a schema applies to all current and future tables and views in it.

Lineage

Captured automatically to column level and aggregated across all workspaces on the metastore, covering notebooks, jobs, pipelines, queries, and dashboards.

The object hierarchy

Click a level — grants cascade top → bottom

Metastore Catalog Schema Table / Volume / Model

Metastore — top-level container of all metadata and the access model; one per region, shared across the workspaces attached to it.

Minimal example

SQL · grant + three-level name-- traversal privileges: needed to reach any child object
GRANT USE CATALOG ON CATALOG main TO `finance-team`;
GRANT USE SCHEMA  ON SCHEMA  main.sales TO `finance-team`;

-- SELECT on the schema cascades to all current + future tables
GRANT SELECT ON SCHEMA main.sales TO `finance-team`;

-- now query by fully qualified catalog.schema.table
SELECT * FROM main.sales.orders;

Gotchas & limits

USE CATALOG / USE SCHEMA are mandatory: a SELECT grant on a table is useless without traversal rights on its parents.
USE CATALOG grants no data access by itself — it only opens the door to objects you're separately granted.
Lineage is not preserved across renames of a catalog, schema, table, view, or column, and column-level lineage breaks when data is referenced by path instead of by table name.
Lineage system tables keep a rolling 1-year window; data captured before Sept 1, 2024 is not available.

Interview soundbites

Say this out loud

"Unity Catalog is the unified governance layer — one metastore defines access, lineage, and audit once and enforces it across every workspace."
"It introduces the three-level namespace catalog.schema.object; everything you can grant on is a securable object, and privileges inherit down the tree."
"You always need USE CATALOG and USE SCHEMA to reach an object — table grants alone don't work without traversal rights on the parents."

References

Verified against docs.databricks.com · June 2026