Question

A GenAI engineer builds a customer support RAG application. Source documents are uploaded as raw PDFs to a Unity Catalog volume, then parsed and stored as chunked text in a Delta table that backs a Vector Search index. The compliance team requires that only the 'support-engineers' group can query the deployed agent, while a separate 'legal-reviewers' group must be able to open and inspect the original PDF files but must NOT be able to read the parsed chunk table. Which Unity Catalog access-control configuration meets these requirements?

Accepted Answer

Grant SELECT on the chunk Delta table to 'support-engineers', grant READ VOLUME on the volume to 'legal-reviewers', and do not grant the chunk table to 'legal-reviewers'.

Answer

Grant READ VOLUME on the volume to both groups and rely on the model serving endpoint's built-in filtering to restrict the chunk table.

Answer

Grant SELECT on the chunk Delta table to both groups, since the volume permissions are automatically inherited from the table.

Answer

Grant ALL PRIVILEGES on the catalog to 'legal-reviewers' and USE SCHEMA to 'support-engineers' so each group gets scoped access.