Question

A Generative AI team maintains a feature table in Unity Catalog that stores precomputed customer embeddings used by both a batch scoring job and a real-time agent serving endpoint. Compliance requires that data scientists can read the features for offline experimentation but must NOT be able to modify or delete the underlying feature table, while the automated pipeline service principal needs full write access to refresh features nightly. What is the most appropriate way to enforce this using Unity Catalog governance?

Accepted Answer

Grant the data scientists group SELECT on the feature table and grant the pipeline service principal ALL PRIVILEGES (or MODIFY plus SELECT) on the table, applying grants at the appropriate catalog/schema/table scope.

Answer

Grant the data scientists group MODIFY on the feature table so they can experiment, and rely on Delta table history to roll back any accidental changes they make.

Answer

Export the feature table to a workspace-local DBFS path and give data scientists read-only filesystem permissions, bypassing Unity Catalog privileges entirely.

Answer

Make the feature table owner a shared personal account used by both the data scientists and the pipeline so everyone inherits the same access automatically.