Courts must land sealed PDFs to a volume, extract metadata, load a Unity Catalog table, then share a restricted view. What order is correct?

Multi-store municipal document pipelines should follow a control-friendly order: land sealed PDFs on a volume, extract metadata, load a Unity Catalog table, then share a restricted view. Courts need the binary artifacts secured first, structured metadata second, governed table access third, and least-privilege sharing last. That sequence prevents loading structured metadata into a Unity Catalog volume and keeps sealed content behind a restricted view rather than sharing a materialized view. Loading the Unity Catalog table before extracting metadata and then sharing the restricted view fails by concept: the table is populated without its structured metadata, and consumers get a view built on an incorrectly ordered pipeline. Loading the Unity Catalog volume after extracting metadata fails by concept: a volume holds unstructured files, so structured metadata never lands in a governed Unity Catalog table for SQL and access control, leaving the restricted view without a proper table to query. Loading the Unity Catalog table and then sharing the materialized view misses the requirement: a materialized view persists a full result copy instead of enforcing least-privilege restricted sharing, so sealed court documents lose the dynamic filtering and masking of a governed restricted view. Exam caveat: restricted views still need careful grants—row filters/column masks may be required beyond "a view exists." Operational check: land sample sealed PDFs to the volume, run metadata extract into the UC table, grant only the restricted view to a test principal, confirm that principal cannot list raw volume files or base table rows beyond policy, and verify the shared object is the restricted view rather than a materialized view.