Role-based access control (RBAC) grants permissions according to assigned user or service roles. In lakehouse architectures, it centralizes authorization for namespaces, tables, and operations instead of duplicating policies across storage systems and query engines. section 4.3.3 section 7.6
A catalog authenticates users and engines, evaluates roles, and can issue short-lived, scoped credentials for authorized queries or jobs. This improves portability across engines while reducing long-lived storage access and security risk. section 7.2.2 section 7.6
Apply RBAC with these architectural boundaries:
- Assign roles such as analyst or engineer to control read, write, and administrative permissions on specific namespaces or tables. section 7.2.2
- Integrate the catalog with enterprise identity providers so platform permissions inherit consistent user identities and access contexts. section 4.4.3 section 7.2.2
- Keep row-level security and column masking aligned with the query or federation engine when the catalog provides only coarse-grained controls. section 4.3.3 section 9.2.2
- Log table creation, schema updates, rollbacks, initiating identities, and origins to support auditing and root-cause analysis. section 7.2.2
Healthcare analytics
A regional healthcare provider uses role-based access for sensitive clinical metrics while Power BI and JupyterHub consume region-bound, policy-enforced datasets. The catalog tags locality, Dremio enforces policies during query planning, and masking plus query logs support compliance. section 9.5.6
Figure 7.6 Catalogs can have different levels of access control, allowing you to control who has access to which namespaces or tables.
Use the access-control figure to compare how catalogs restrict visibility across namespaces and tables. section 7.2.2
