An assignment is not the full picture
An access list often shows roles or grants assigned directly to an object. A person may also gain access through group memberships, nested groups or permissions inherited from a broader scope.
Effective access describes the actions an identity can perform on a resource after relevant rules and relationships are considered. It is a harder question than simply finding a person’s name in a list of assignments.
Follow the chain from identity to resource
Consider a user who belongs to a project group. That group holds a platform role applying to a particular scope. Explaining the user’s access requires every link in the chain and a source for each relationship.
Identity → group membership → role or grant → scope → resource
This is an analysis model, not a promise that every platform behaves the same way. Directory roles, Azure RBAC and Unity Catalog grants have different rules, which need to be evaluated using each platform’s semantics.
Important boundaries
A Reader role on an Azure subscription establishes permission to read management-plane information. It does not, by itself, establish permission to read file contents in every storage account. Data-plane permissions, network restrictions and other controls may affect the result.
Similarly, a Databricks grant alone cannot prove that every operation can be performed. Required parent privileges, workspace context and other restrictions also need consideration.
Four questions for an access review
- Which identity and stable ID are we examining?
- Is the access direct, group-based or inherited?
- Which scope and resources are documented?
- Which controls or data sources are missing from the analysis?
A useful analysis makes the chain visible and clearly states when a link is undocumented. That provides better decision support than a confident conclusion from incomplete evidence.
Visit the resource centre