Scoped Delegation (Privilege Separation).

A fundamental security principle in cloud governance is Separation of Concerns. Direct cloud access keys (IAM Roles/Access Keys) are "High Privilege" assets; possessing them usually grants access to an entire storage account or bucket. If you give a user this key directly, you cannot easily restrict them to just a specific sub-folder. This creates a "Blast Radius" risk where a user authorized for "Finance Data" might accidentally or maliciously access "HR Data" if both live in the same storage account but different paths. We need a way to delegate the capability to access storage without revealing the credentials that enable it.

Application: Unity Catalog implements this via a Two-Tier Object Hierarchy.

Storage Credential: This is the "Root of Trust." It encapsulates the high-privilege IAM Role. It is strictly controlled by Metastore Admins and never granted to end-users directly.

External Location: This is the "Scoped Access Point." It wraps a specific S3/ADLS URI (e.g., s3://bucket/finance) and links it to the Credential. Crucially, permissions like READ FILES are granted on the Location, not the Credential. This architecture ensures that the Databricks engine acts as the gatekeeper. When a user runs LIST 's3://bucket/finance', Unity Catalog checks if they have rights on that specific Location object. It then temporarily "borrows" the power of the Storage Credential to execute the request on the user's behalf, without ever exposing the underlying cloud keys to the user workspace. This enforces strict data isolation at the path level.

Topic: Unity Catalog