A city wants resident-services analysts to read gold 311 metrics while parks volunteers must not access that table. Which Unity Catalog action should administrators take?

Unity Catalog table privileges implement least privilege for shared municipal datasets. Administrators should GRANT SELECT on the gold 311 metrics table only to the resident-services analyst group so those analysts can read KPIs while parks volunteers—who have no business need—receive no grant and cannot query the table. Group-based grants scale better than one-off users and keep the guest list for the gold 311 ballroom explicit.

GRANT BROWSE on the gold 311 metrics table to the resident-services analyst group only lets principals see metadata without reading rows, so it fails the read-KPI requirement because analysts need SELECT to query data. GRANT MANAGE on the gold 311 metrics table to the resident-services analyst group only grants administrative control the analysts do not need, violating least privilege because the task is read-only KPI access. GRANT SELECT on the gold 311 metrics view to the resident-services analyst group only targets the wrong object, since the requirement is to read the gold 311 metrics table and a grant on the view does not grant query access to the table.

Exam caveat: SELECT enables read; BROWSE is metadata-only and MANAGE is admin-oriented and must stay with engineering or stewards. Absence of a grant is denial—volunteers need not be explicitly REVOKE'd if they never received SELECT, but review inherited group memberships. Operational check: grant SELECT to the resident-services group, confirm a member can query gold 311 metrics, confirm a parks volunteer account fails authorization, and review SHOW GRANTS on the table after change control.