The 311 team wants analysts to query curated ticket outcomes without seeing internal disposition codes stored on the base table. How should they expose the data?

The 311 team wanting analysts to query curated ticket outcomes without seeing internal disposition codes on the base table should publish a curated Delta table for outcomes and a view that projects only analyst-safe columns. The table remains the governed source of truth for stewards/pipelines, while the view exposes a least-privilege projection—hiding sensitive internal disposition fields from general analysts—aligned with municipal data-minimization practices.

Granting every analyst direct ownership of the raw bronze landing folder overexposes raw intakes and breaks separation of duties. Duplicating the entire metastore for each analyst laptop is operationally absurd and does not implement column minimization. Disabling column names so disposition codes cannot be queried by anyone including stewards breaks legitimate stewardship and is not a UC access pattern.

Exam caveat: views (and dynamic views/column masks where applicable) implement column-level minimization; do not confuse with row filters (row subsets). Curated silver/gold tables plus safe views are preferred over broad bronze access. Ownership ≠ SELECT—avoid granting ownership to consumers.

Operational check: materialize curated outcomes in UC, create a view selecting only analyst-safe columns, grant analysts SELECT on the view (not the base columns they must not see), and verify a test analyst cannot read internal disposition codes.