A data governance team is tagging tables in Unity Catalog to support a new data classification initiative. A data steward needs to add a tag with key pii_category and value contact_info to the customers.profiles.email_address column of an existing Delta table. The steward has been granted APPLY TAG on the table, USE SCHEMA on customers.profiles, and USE CATALOG on customers, but is NOT the table owner. Additionally, a junior engineer asks whether they can tag multiple columns on the same table in a single SQL ALTER TABLE statement. Which of the following statements is CORRECT?
Show answer & explanation
Correct answer: B
WHY B is correct: The Databricks documentation states that to add tags to Unity Catalog securable objects as a non-owner, you must have all three of: APPLY TAG on the object, USE SCHEMA on the parent schema, and USE CATALOG on the parent catalog. The data steward has all three — so the operation is authorized. The APPLY TAG privilege on a table covers both table-level and column-level tagging for that table. Tagging can be done via Catalog Explorer (visually, on the column detail page) or via SQL ALTER TABLE ... SET TAG ON COLUMN. Regarding bulk column tagging, the documentation explicitly states: 'You cannot assign tags to multiple columns in a single ALTER TABLE command. You must assign tags to each column separately. This differs from the COMMENT clause, which does support multiple columns in one command.' This is a documented constraint the junior engineer must be aware of.
WHY NOT A: APPLY TAG on a table does cover column-level tagging for that table — there is no separate APPLY TAG ON COLUMN privilege. The claim about comma-separated bulk column tagging in a single statement is false; the documentation explicitly prohibits multi-column tagging in one ALTER TABLE command.
WHY NOT C: USE SCHEMA and USE CATALOG are documented as required (not just navigational) components of the minimum privilege set for applying tags as a non-owner. They are part of the three-privilege requirement. Claiming these permissions are automatically granted to all users is also incorrect — they must be explicitly granted in Unity Catalog, which operates on a least-privilege model.
WHY NOT D: Tag keys in Unity Catalog ARE case-sensitive — pii_category and PII_CATEGORY are two distinct tags. The documentation states: 'Tag keys are case sensitive.' Additionally, there IS a cap: a table can have at most 1,000 column tags in total across all its columns, and a single securable object supports at most 50 tags. There is no WHERE clause syntax in ALTER TABLE SET TAG for filtering by column name pattern.
WHY NOT E: Unity Catalog does not automatically encrypt tag values, regardless of whether they are applied to PII-related columns. The documentation explicitly warns: 'Tag data is stored as plain text and may be replicated globally. Do not use tag names, values, or descriptors that could compromise the security of your resources.' There is no VIEW ENCRYPTED METADATA privilege, no AES-256 tag encryption, and no tag approval workflow for bulk tagging operations.