Scanned bill-of-lading images, some containing a shipper's signature and contact details, are stored in a Unity Catalog volume that several teams' notebooks read from for OCR extraction. The compliance team wants to ensure only the extraction pipeline's service principal can read the raw scans, while downstream teams work only with the extracted, masked text. What is the appropriate control?

Unity Catalog volumes are governed objects with their own grants, independent of any table, so the correct control is to restrict read access on the raw-scan volume itself to the extraction pipeline's service principal, and have that pipeline publish only the extracted and masked text to a separate table that downstream teams are granted access to. This gives every other team exactly what they need, clean text, without ever exposing them to the raw scans containing signatures and contact details. Relying on folder-naming conventions is not access control at all, and the premise is wrong besides, volumes absolutely support their own Unity Catalog grants distinct from any table. Granting every team read access to the volume and trusting notebooks not to display the content is not a control, it is hoping nobody writes a display statement, and it does nothing to stop a notebook from extracting the sensitive fields directly. Moving the scans to a plain cloud bucket outside Unity Catalog gives up governance entirely, permissions, lineage and audit logging all live in Unity Catalog, and volumes are the intended mechanism for governing exactly this kind of unstructured file data, not just structured data. Exam framing: Unity Catalog governance extends to volumes holding raw files, not only to tables.