Case study: partner access review
Aster Supply East partner review
The reporting manager has asked you to correct access for east_partner before sharing the monthly extract. Use bronze orders, customers and the recorded grants. The approved output contains only id and amount for completed East orders with a known amount. Done means a restricted view, the required namespace and view grants, zero remaining direct SELECT grants on the two sources, and a checked row-and-amount review.
Aster Supply's East partner should see order ids and known amounts for completed East orders. The current grants also allow that group to read raw orders and customer contact details. Your review needs to remove that bypass and publish a smaller reporting boundary.
Save the original grant evidence before changing it. Then define the approved view, remove direct source access and grant the namespace traversal and view read privileges the partner needs. The final checked report measures the approved rows and amount, along with the remaining source grants. Treat NULL region and missing amount as exclusions under this contract. The training catalog records grants but does not impersonate the partner or resolve an external identity provider. A real access review must also inspect inherited privileges, group memberships and applicable policies; the supplied case starts with only the two direct source grants shown here.
CREATE TABLE main.silver.partner_access_before USING DELTA AS SELECT privilege,object_type,object_name FROM main.bronze.dbx_grants WHERE principal='east_partner';
Capture the named partner group before changing access; evidence for another principal misses the exposed sources.