The pattern
Teams spend weeks perfecting Unity Catalog hierarchies, grants, and tags. Six months later they are drowning in over-permissioned service principals, orphaned tables, and governance debt no one wants to touch.
What breaks in practice
- Service principals with god-mode access “because it was easier.”
- Catalog structures that worked for one team but collapse when shared across business units.
- Policies that live only in Confluence or a one-time architecture diagram.
- No clear ownership for schemas or key tables.
- Lineage that looks pretty but is never actionable when something changes downstream.
What production-grade governance actually looks like
- Catalog strategy that mirrors the business, not the org chart. Separate raw, curated, and consumption layers. Sensitive domains (finance, HR, customer PII) get their own tightly controlled catalogs.
- Governance as code from day one. Every grant, schema, tag, and access pattern lives in Git, reviewed in PRs, and deployed via CI/CD. Manual UI grants are treated as technical debt.
- Explicit ownership baked in. Every schema and high-value table has a named owner (team or individual) accountable for quality, access requests, and deprecation.
- Least privilege by default. Dynamic views and row/column-level security used surgically. Service principals get narrow, time-bound access via automated just-in-time mechanisms.
- Observable governance. Usage monitoring, cost attribution per catalog, and automated audit reports make bad patterns visible before they become crises.
The blunt rule
If you cannot answer in under 30 seconds who owns a particular schema and what its data classification is, your Unity Catalog governance is not production-ready.
How to fix it
Start simple: define 3–4 top-level catalogs with clear purpose. Implement IaC for governance immediately. Assign owners before you grant broad access. Monitor usage aggressively in the first 90 days. The teams that treat Unity Catalog governance as ongoing platform engineering, not a one-off project, keep their Databricks environment clean, secure, and actually useful years later.