READ METADATA privilege supported in compliance security profiles

The Unity Catalog READ METADATA privilege is now supported across all Databricks compliance security profile standards. It is available by default in any workspace that has the compliance security profile turned on.

Use cases

Imagine your organization operates in a regulated industry and uses the compliance security profile to satisfy strict regulatory standards. Previously, such restricted environments could not use this specialized auditing privilege.

With READ METADATA, you can:

• Allow security and governance teams to view permissions, row filters, column masks, and ABAC policies on tables and schemas.
• Provide visibility into data asset structures and security controls without exposing the underlying table data (SELECT).

How to use

You grant the privilege via SQL on Unity Catalog securable objects, such as catalogs, schemas, or the metastore itself:

GRANT READ METADATA ON CATALOG meu_catalogo TO `grupo_seguranca`;

What happens in this code:

1. Grants READ METADATA on meu_catalogo to the grupo_seguranca group.
2. Members of this group can inspect metadata, permissions, and security rules on the catalog and its child objects.
3. Data reading remains prevented since no SELECT privilege was granted.

Limitations and requirements

• Workspaces must have the compliance security profile enabled.
• The ALL PRIVILEGES bundle does not automatically include READ METADATA; it must be granted explicitly.
• Unlike most metastore-level privileges, READ METADATA inherits down to all subordinate objects when granted directly on the metastore.