Unity Catalog access, governed as code
Access changes shouldn’t be clicks nobody can trace. I built a policy-as-code tool that applies Unity Catalog grants from version-controlled YAML through the Databricks SDK, so every change is reviewed in a pull request before it lands.
- Drift detection flags excess or orphaned grants against the declared policy.
- Row filters and column masks protect PII.
- A Databricks SQL audit dashboard shows who accessed which data, and when.
Repository link: pending publication.
catalog: finance
grants:
- principal: finance_analysts
privileges: [USE_CATALOG, SELECT]
- principal: finance_engineers
privileges: [USE_CATALOG, SELECT, MODIFY]✓ finance_analysts matches policy
✓ finance_engineers matches policy
✕ contractors_tmp SELECT not in policy
→ flagged for revoke in PR #42Illustrative example, not production data.