Namespace includes volumes
Security questions rest on catalog / schema / table or volume. You need USE CATALOG and USE SCHEMA to traverse, then SELECT (tables/views) or READ VOLUME (files). Missing USE SCHEMA is the “I have SELECT but still cannot query” failure.
Privileges inherit down unless designed otherwise. Groups beat one-off user grants.
Ownership
Every UC object has an owner. Owners grant and alter. Transfer ownership off personal users. Dashboard share ≠ GRANT SELECT.
Sharing settings
Delta Sharing / Marketplace distribute with governance. Workspace ACLs on queries/dashboards are a second layer on top of UC.
sqlGRANT USE CATALOG ON CATALOG prod TO `analysts`;
GRANT USE SCHEMA ON SCHEMA prod.gold TO `analysts`;
GRANT SELECT ON TABLE prod.gold.fact_orders TO `analysts`;