Governance that survives an audit
Unity Catalog designed so the grants actually hold
We design and implement Unity Catalog: catalogue and schema structure, grants that match how teams really work, migration off the Hive metastore, and lineage that survives a refactor. Built so applications and agents inherit those permissions rather than routing around them with a shared service account.
Most Unity Catalog rollouts stop halfway. The catalogues exist, half the estate is still external tables against the old metastore, and the one thing everybody remembers is the service principal with access to everything because a deadline was coming.
- Who it is for
- Platform and security leads who have to defend the setup to somebody else
- Bench
- 115+ engineers, 80 Databricks-certified
What we look at first
- What is still on the Hive metastore, and what it would take to move each piece
- Grants as they exist against how teams actually work, which are rarely the same shape
- Service principals with more access than anyone remembers granting
- External locations and storage credentials, and who can create them
- Whether lineage survives the transformations you actually run
- What an agent or application currently uses to read data, and under whose identity
What we build
- Catalogue and schema design that matches the organisation rather than the storage layout
- A grant model expressed through groups, so joining a team is what changes access
- Hive metastore migration in stages, with external tables where a full move costs more than it returns
- Applications and agents running under their own service principals with bounded grants
- Lineage and audit queries somebody can run when asked, rather than a screenshot from the rollout
- The written record of what was decided and why, which is what the next platform lead needs
FAQ
Unity Catalog consulting: common questions
What does Unity Catalog consulting involve?
Deciding who can see what, proving it, and keeping lineage intact as data moves. In practice: catalogue and schema design, a grant model built on groups rather than individuals, migration off the Hive metastore, and making sure applications and agents inherit those permissions instead of routing around them.
Should we migrate from the Hive metastore to managed tables?
Eventually, and rarely all at once. External tables in Unity Catalog are the pragmatic first step for an existing estate, because moving to managed tables costs real compute and time. Managed is the right target because predictive optimization only applies there, so the question is sequencing rather than whether.
How long does a Unity Catalog implementation take?
The design is weeks. The migration depends entirely on how much is on the old metastore and how much of it anyone still uses, and the second half of that sentence is usually the surprise. The first thing worth doing is the inventory, because it often shrinks the job.
Can agents and applications use Unity Catalog permissions?
Yes, and they should. An agent running under its own service principal is bounded by the same grants as a human analyst, which makes its data access a platform property rather than a prompt instruction. The alternative is a shared credential with broad access, which is the thing every audit eventually finds.