Skip to main content

GRANT DATA_ADMIN

Description​

Make a principal a data admin for the organization. A data admin is allowed on every Lake, Database, and Table in the organization, for every operation — no per-object privilege is consulted. See the permissions documentation for more details.

Data adminship is org-wide, so there is deliberately no ON <object> clause. To grant a privilege on one object, use GRANT PRIVILEGE.

Only a data admin can add a data admin

Only an existing data admin can add or remove a data admin. Being an account admin or project admin does not by itself let you change this list.

By default, your account admins and project admins, and groups holding either role, are data admins. Review the list and remove anyone who should not have org-wide access to your data.

Syntax​

GRANT DATA_ADMIN TO <principal_type> '<principal_identifier>'

Examples​

GRANT DATA_ADMIN TO USER 'steve@apple.com'

GRANT DATA_ADMIN TO GROUP 'data_platform'

GRANT DATA_ADMIN TO SERVICE_PRINCIPAL 'governance_sp'

Required parameters​

  • principal_type: Specify one of {USER|GROUP|SERVICE_PRINCIPAL}.
  • principal_identifier: Specify one of {<user_email>|<group_id>|<service_principal_id>}.

If the principal cannot be resolved, the statement fails with Principal not found: <principal_identifier>.

What a data admin can do​

Object typeData admin access
LakeAny operation
DatabaseAny operation
TableAny operation

Data adminship covers those three object types only. It says nothing about Clusters, Jobs, or any other Onehouse resource — those are still governed by roles.

Adminship held through a group counts: granting DATA_ADMIN to a group makes every member of that group a data admin.

What changes when data admins are enabled​

Worth knowing before you enable the governed model:

  • Being an account admin or project admin no longer by itself grants access to Lakes, Databases, and Tables. Access to those three object types comes from data adminship or an explicit privilege grant.
  • Onehouse adds your account admins and project admins, and groups holding either role, as data admins. This list is a one-time snapshot taken when Onehouse sets it up — admins added or removed afterwards are not reflected. Before enabling data governance, review the list and correct it with GRANT DATA_ADMIN / REVOKE DATA_ADMIN.
  • Organizations created after that start with only their creator as a data admin. Add anyone else with GRANT DATA_ADMIN.
  • Adminship held through a group stays current: a user added later to a data-admin group is a data admin.
  • If your data admin list is empty, contact Onehouse support — only a data admin can add another, so an empty list cannot be fixed from the console.
  • From then on, only an existing data admin can appoint or remove another.

Roles on other Onehouse resources, such as Clusters and Jobs, are unaffected.

To remove a data admin, use REVOKE DATA_ADMIN.