After a mistaken truncate on 311 bronze landing tables, the platform team must correct who can change those tables. What Unity Catalog action is most appropriate?

After a mistaken truncate on 311 bronze landing tables, the platform team should review and tighten which groups hold MODIFY, limiting write privileges to the responsible platform team. Post-incident hardening reclaims excess write badges on the bronze loading dock so analysts who only need to read or debug cannot empty landings again. Pair the grant cleanup with audit review of who executed the truncate.

Granting MODIFY on bronze to every analyst group to speed future fixes amplifies the same failure mode. Removing ownership metadata and stopping privilege reviews after incidents abandons governance lessons. Disabling audit logging so truncates cannot be investigated again destroys forensic capability and violates good municipal operations practice.

Exam caveat: least privilege after incidents often means fewer writers on bronze, separate break-glass, and change management for destructive DDL/DML—not broader access. Consider table ownership, dynamic views for analysts, and job-only writers. Operational check: SHOW GRANTS on the bronze 311 tables, revoke analyst MODIFY, retain platform/job SP MODIFY, restore data from versioning/backups if available, re-run ingest, and document the privilege baseline in the incident report.