A city tags open-data tables as public and needs anonymous-facing service principals to read only those datasets. What should governance use?

Tags marking tables as public plus policies that allow anonymous-facing service principals to read only those tagged public datasets are the correct governance pattern. The city separates open-data products from private resident tables via tags, then binds service-principal read authorization to the public tag so internet-facing identities cannot wander into non-public civic data.

Tags marking schemas as public plus policies that allow the anonymous-facing service principals to read tagged public schemas authorize at schema scope instead of table scope, so any private resident table inside a public-tagged schema becomes readable rather than confining that identity to only individually tagged public tables. Tags marking tables as public plus row filters that restrict the anonymous-facing service principals to tagged public datasets do not authorize table reads; row filters only shape which rows return after SELECT is already granted, so without a tag-based policy the principal gains no read access to the public-tagged tables. Tags marking tables as public plus storage credentials that allow the anonymous-facing service principals to read tagged public datasets do not enforce tag-based authorization—storage credentials grant direct cloud-path read that bypasses Unity Catalog governance entirely, so reading from storage ignores the public tag and any policy built on it.

Exam caveat: Public tags without binding policies do not authorize or restrict anyone; policies without reliable tagging will under- or over-share. Anonymous-facing service principals should still be least-privilege identities—not metastore admins—and should never receive blanket SELECT on untagged or private schemas. Open-data publication review should precede applying the public tag.

Operational check: Ensure only approved open-data tables carry the public tag, attach policies that grant the anonymous-facing service principals read on public-tagged datasets, attempt reads on a private resident table as that principal and expect denial, and monitor audit logs for enumeration beyond public objects.