What Unity Catalog grants and system.* schemas gate which queries — so you can tell in advance what will run — and what to do when a query returns nothing, a band reads NOT ASSESSED, or the dollars look off.
system.* tables are not uniformly available. A query can legitimately return nothing, or fail with TABLE_OR_VIEW_NOT_FOUND / insufficient_privileges, because a schema is in preview, was never enabled, you lack SELECT, or the feature simply hasn’t run in your look-back window. None of that is a bug — before you conclude an account is clean, confirm the table is actually enabled and populated. The full per-table reference (what writes each row, and exactly why it would be empty) is documented in the library’s COVERAGE.md ↗, and encoded per-query as the gap reasons below.system catalog — no UC-enabled workspace means no system.* at all.USE CATALOG on system + USE SCHEMA + SELECT sees zero rows, not an error.Only billing and compute are on without a deliberate enable step. The rest are opt-in — the single most common reason a query here returns nothing.
| System schema | Enabled? | How it’s turned on |
|---|---|---|
billing | Always on | Cannot be disabled — the account billing baseline. |
compute | Default-on | On in all UC workspaces (since the March 2025 release). |
access, query, serving, storage, lakeflow, ai_gateway | Opt-in | Enabled per-schema by an account/metastore admin via the system-schemas API — see the recipe below. |
information_schema | Auto-provisioned | Exists in every UC catalog — no enable step (privilege-aware). |
data_classification | Opt-in + per-catalog | Schema enabled and Data Classification turned on per catalog. |
Preview status is per-table, not per-schema: even inside an enabled schema, tables such as query.history, serving.*, storage.*, parts of access, and ai_gateway.usage are still Public Preview / Beta, so they can be empty until Databricks rolls them out to your account and region.
system.* schema the query needs.databricks system-schemas list <metastore_id>
databricks system-schemas enable <metastore_id> serving
# ...or access / query / storage / lakeflow / ai_gatewayGRANT USE CATALOG ON CATALOG system TO `data-team`;
GRANT USE SCHEMA ON SCHEMA system.serving TO `data-team`;
GRANT SELECT ON SCHEMA system.serving TO `data-team`;NOT_ASSESSED, never a fake 0.Common trap: serving / gateway tables look empty even though endpoints exist. system.serving.endpoint_usage only covers Model Serving endpoints with AI Gateway usage tracking on — not Vector Search, feature serving, or agent endpoints. Vector Search spend lands in system.billing.usage under billing_origin_product = ‘VECTOR_SEARCH’, which the cost_vector_search_spend query reads directly.
Each query reads one or more system.* schemas. Granting SELECT on a schema (and enabling it for the metastore where it’s in preview) unlocks every query that reads it.
| System schema | Queries it unlocks | Domains |
|---|---|---|
system.billing | 37 | Cost & Billing, Compute, Jobs & Pipelines, Model Serving & AI |
system.lakeflow | 21 | Jobs & Pipelines |
system.information_schema | 13 | Storage & Optimization, Governance, Access & Security |
system.access | 12 | Cost & Billing, Model Serving & AI, Governance, Access & Security |
system.query | 12 | Query Performance |
system.compute | 11 | Compute, Jobs & Pipelines |
system.storage | 5 | Storage & Optimization |
system.serving | 3 | Model Serving & AI |
system.data_classification | 2 | Governance, Access & Security |
system.ai_gateway | 1 | Model Serving & AI |
none - DESCRIBE EXTENDED output; not a system table | 1 | Storage & Optimization |
none - ANALYZE TABLE COMPUTE STORAGE METRICS output; not a system table | 1 | Storage & Optimization |
none - DESCRIBE EXTENDED / SHOW TBLPROPERTIES output; not a system table | 1 | Storage & Optimization |
Sums exceed 100 because many queries read more than one system.* schema, so they are counted under each schema they touch. And a schema grant unlocks its queries but not always a whole domain: Cost, for example, includes one query (the workspace-name lookup, cost_workspace_names) that reads system.access, so a system.billing grant alone unlocks 22 of the 23 Cost queries — not the whole domain.
Every query is tagged with the empty_if reasons it could legitimately return zero rows — a controlled vocabulary drawn from the library’s COVERAGE.md ↗. Read them fixable-first: the top rows are enablement and privilege gaps you can act on; the lower rows mean the feature simply hasn’t run yet. Each query’s own reasons appear in the Empty if column of the matrix below (and on the query itself). 18 always-on billing / reference queries carry no gap reason — they are effectively never empty.
| Gap reason | Why the query would be empty | Queries |
|---|---|---|
Schema not enabledschema_not_enabled | The system schema is opt-in and hasn't been enabled for the metastore — an admin turns it on via the system-schemas API. | 54 |
No SELECT privilegeprivilege_scoped | You lack SELECT (or USE CATALOG / USE SCHEMA) on the object — a non-admin sees zero rows, not an error. | 22 |
Preview not rolled outpreview_unavailable | The table is still Public Preview / Beta and hasn't reached your account or region yet. | 33 |
Account-admin read onlyaccount_admin_only | Only an account admin can read the table — a workspace admin sees nothing. | 1 |
Verbose audit offverbose_audit_required | The event needs verbose audit logging turned on in the workspace before it is captured. | 2 |
Usage tracking offusage_tracking_off | AI Gateway usage tracking is off on the endpoint, so its requests are invisible even though it bills. | 4 |
Predictive Optimization offpo_not_enabled | Predictive Optimization isn't enabled (or hasn't run) for the account, so there are no operations to report. | 5 |
Serverless / warehouse onlycompute_scope_gap | Only serverless or SQL-warehouse compute ran — classic clusters, which these compute tables track, are excluded. | 17 |
No serverless computeno_serverless | The scan or feature needs serverless compute, which isn't available in the workspace. | 2 |
ABAC policies onlyabac_only | Only ABAC tag-based policies are in use — they don't appear in information_schema, so the manual masks/filters this reads are empty. | 3 |
Submit-run onlysubmit_run_skipped | Jobs ran only as one-time submit / workflow runs, which skip the jobs and tasks dimension tables. | 6 |
Lineage not inferablelineage_inference_only | Lineage is inferred — work via unsupported paths (submit-runs, JDBC, path-only refs) leaves no lineage rows. | 4 |
Outside retention windowretention_window | The activity is older than the table's retention window (e.g. lineage ~1 year, job runs ~365 days). | 3 |
Ingestion lagingestion_lag | Billing / usage data lags by hours — recent activity may not have landed yet. | 9 |
Feature not used yetno_activity | The underlying feature simply hasn't run in your window — no share created, no endpoint traffic, no job executed. | 11 |
Per query: its tier (how heavy), the exact grant it requires, the system.* tables it reads, and the empty-if reasons it could return nothing (hover a chip for the full reason). Tier is a labelled field heuristic for run order, not a Databricks classification: lite = GA schemas plus a single grant; standard = a commonly-enabled schema, usually a join or window; deep = a heavier scan or a preview / feature-gated table.
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Discount Realization by SKU (actual vs list)cost_actual_vs_list_by_sku | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.list_prices | always-on |
| Per-Job DBU Cost Rankingcost_by_job | Standard | SELECT on system.billing; GA | system.billing.usage | Ingestion lag |
| Chargeback Coverage by Tagcost_chargeback_by_tag | Standard | SELECT on system.billing; GA | system.billing.usage | always-on |
| Dollarizing DBUs at List Pricecost_dollarized_by_sku_day | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.list_prices | Ingestion lag |
| Serverless, Photon & Tier Premiumscost_premium_serverless_photon | Standard | SELECT on system.billing; GA | system.billing.usage | always-on |
| Your List-Price Basis by SKUcost_account_prices_raw | Lite | SELECT on system.billing; GA | system.billing.list_prices | always-on |
| Where the Money Goes by Productcost_by_billing_origin_product | Lite | SELECT on system.billing; GA | system.billing.usage | always-on |
| Cost Per Cluster and Warehousecost_by_compute_resource | Standard | SELECT on system.billing; GA | system.billing.usage | always-on |
| Ad-hoc notebook DBU costcost_by_notebook | Standard | SELECT on system.billing; GA | system.billing.usage | Feature not used yet |
| Serving & Vector Spend by Endpointcost_by_serving_endpoint | Standard | SELECT on system.billing; GA | system.billing.usage | Feature not used yet |
| Chargeback DBUs by Identitycost_chargeback_by_identity | Standard | SELECT on system.billing; GA | system.billing.usage | always-on |
| Estimated Cloud Spend, DBU-Derivedcost_cloud_infra | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.list_prices | always-on |
| DBSQL Allocation Gap Checkcost_dbsql_allocation_gap | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.attributed_usage | always-on |
| Default-Storage DSU by API Tiercost_default_storage_dsu | Standard | SELECT on system.billing; GA | system.billing.usage | Ingestion lag |
| GenAI Token & GPU Spendcost_genai_token_gpu | Standard | SELECT on system.billing; GA | system.billing.usage | Feature not used yet |
| Billed Data Egress Signalcost_networking_egress | Standard | SELECT on system.billing; GA | system.billing.usage | Ingestion lag |
| Can You Trust the Bill?cost_restatement_trust_metric | Lite | SELECT on system.billing; GA | system.billing.usage | Ingestion lag |
| Model-Serving Cost Mode Per Endpointcost_serving_mode_by_endpoint | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.list_prices | Feature not used yet |
| The Base Billing Rollupcost_totals_by_sku_day | Standard | SELECT on system.billing; GA | system.billing.usage | Ingestion lag |
| Serverless Policy Coverage Gapscost_usage_policy_coverage | Standard | SELECT on system.billing; GA | system.billing.usage | always-on |
| Vector Search Spend by Endpointcost_vector_search_spend | Deep | SELECT on system.billing; GA | system.billing.usagesystem.billing.list_prices | Ingestion lagFeature not used yet |
| Workspace ID to Name Lookupcost_workspace_names | Lite | SELECT on system.access; GA | system.access.workspaces_latest | Schema not enabledPreview not rolled out |
| The List-Price Rate Bookpricing_list_prices_raw | Lite | SELECT on system.billing; GA | system.billing.list_prices | always-on |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Your Heaviest Statements, Rankedquery_costly_statements | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| What This Audit Costs Youaudit_self_cost | Lite | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| Cache Hits vs. Cold-Start Latencyquery_cache_coldstart | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| Daily Failed & Canceled Queriesquery_failed_queries_daily | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| Disk Spill Memory-Pressure Hotspotsquery_local_spillage | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| Per-Query Cost Allocation Inputsquery_per_query_estimate_lane | Deep | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| Where Query Spend Comes Fromquery_provenance_by_source | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledNo SELECT privilegePreview not rolled outServerless / warehouse only |
| Are Your Scans Skipping Files?query_pruning_effectiveness | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledNo SELECT privilegePreview not rolled outServerless / warehouse only |
| Capacity Queuing vs Cold-Start Waitsquery_queuing_waits | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledServerless / warehouse only |
| Shuffle And Small-Files Hotspotsquery_shuffle_write_amplification | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledPreview not rolled outServerless / warehouse only |
| When And What Runsquery_workload_mix_hours | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledNo SELECT privilegeServerless / warehouse only |
| Heaviest Query Shapes, Grouped by Fingerprintquery_costly_statements_grouped | Standard | SELECT on system.query; GA | system.query.history | Schema not enabledNo SELECT privilegeServerless / warehouse only |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Warehouse Idle-Tail Secondscompute_warehouse_idle_gaps | Standard | SELECT on system.compute, system.billing; GA | system.compute.warehouse_eventssystem.billing.usagesystem.billing.list_prices | always-on |
| Live Classic Cluster Config Baselineclassic_clusters_config_current | Lite | SELECT on system.compute; GA | system.compute.clusters | Serverless / warehouse only |
| Idle Classic Clusters, Rankedcompute_idle_node_ratio | Standard | SELECT on system.compute, system.billing; GA | system.compute.node_timelinesystem.billing.usagesystem.billing.list_prices | Serverless / warehouse only |
| SQL Warehouses Thrashing Clusterscompute_warehouse_autoscale_churn | Standard | SELECT on system.compute, system.billing; GA | system.compute.warehouse_eventssystem.billing.usagesystem.billing.list_prices | always-on |
| Spot Mix and Instance Idle Signalinstance_events_idle_active | Lite | SELECT on system.compute; Public Preview (system.compute.instance_events may be empty or disabled per workspace) | system.compute.instance_events | Preview not rolled outServerless / warehouse only |
| Idle Instance-Pool Waste Snapshotinstance_pools_idle_capacity | Standard | SELECT on system.compute, system.billing; Public Preview (system.compute.instance_pools may be empty or disabled per workspace) | system.compute.instance_poolssystem.billing.usagesystem.billing.list_prices | Preview not rolled out |
| Right-Sizing Evidence From Node Telemetrynode_timeline_utilization | Lite | SELECT on system.compute; GA | system.compute.node_timeline | Serverless / warehouse only |
| Node Type Hardware Spec Catalognode_types_reference | Lite | SELECT on system.compute; GA | system.compute.node_types | always-on |
| Live SQL Warehouse Config Baselinesql_warehouse_config_current | Lite | SELECT on system.compute; GA | system.compute.warehouses | always-on |
| SQL Warehouse Event Activitysql_warehouse_events_activity | Lite | SELECT on system.compute; GA | system.compute.warehouse_events | Feature not used yet |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Failing Jobs Ranked by Wasted DBUslakeflow_failed_jobs_wasted_dbus | Deep | SELECT on system.lakeflow, system.billing; GA | system.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices | Schema not enabled |
| Job Tasks On All-Purpose Computelakeflow_jobs_on_all_purpose | Standard | SELECT on system.lakeflow, system.compute, system.billing; GA | system.lakeflow.job_task_run_timelinesystem.compute.clusterssystem.billing.usagesystem.billing.list_prices | Schema not enabled |
| Job Failure Breakdown by Root Causelakeflow_failed_runs | Lite | SELECT on system.lakeflow; GA | system.lakeflow.job_run_timeline | Schema not enabled |
| Job Health-Rule Coveragelakeflow_health_rule_coverage | Standard | SELECT on system.lakeflow; GA (health_rules was added late Nov 2025) | system.lakeflow.jobs | Schema not enabledSubmit-run only |
| Orphaned And Handed-Off Jobslakeflow_job_ownership_orphans | Standard | SELECT on system.lakeflow; GA (creator_user_name/run_as_user_name were added late Nov 2025) | system.lakeflow.jobs | Schema not enabledSubmit-run only |
| Jobs Stuck Waiting On Capacitylakeflow_job_queue_time | Standard | SELECT on system.lakeflow; GA (queue_duration_seconds was added late Nov 2025) | system.lakeflow.job_run_timeline | Schema not enabled |
| Task-Level Timeout Coverage Gapslakeflow_job_tasks_no_timeout | Standard | SELECT on system.lakeflow, system.billing; GA (job_tasks.timeout_seconds was added late Nov 2025) | system.lakeflow.job_taskssystem.billing.usagesystem.billing.list_prices | Schema not enabledSubmit-run only |
| Jobs Missing a Timeoutlakeflow_jobs_no_timeout | Standard | SELECT on system.lakeflow, system.billing; GA (timeout_seconds was added early Dec 2025) | system.lakeflow.jobssystem.billing.usagesystem.billing.list_prices | Schema not enabledSubmit-run only |
| Runs Killed Before They Launchedlakeflow_never_started_runs | Lite | SELECT on system.lakeflow; GA | system.lakeflow.job_run_timeline | Schema not enabled |
| Where Job Time Actually Goeslakeflow_phase_cold_start | Lite | SELECT on system.lakeflow; GA (the five *_duration_seconds columns were added early Dec 2025) | system.lakeflow.job_run_timeline | Schema not enabled |
| Per-Pipeline Cost and Over-Refreshlakeflow_pipeline_cost | Deep | SELECT on system.billing, system.lakeflow; GA (system.billing.usage/list_prices); Public Preview (system.lakeflow.pipelines and pipeline_update_timeline - a missing/disabled table degrades names/updates to NULL, never the DBU attribution) | system.billing.usagesystem.billing.list_pricessystem.lakeflow.pipelinessystem.lakeflow.pipeline_update_timeline | Schema not enabledPreview not rolled outFeature not used yet |
| Pipeline Active-Time and Idle-Tail Signallakeflow_pipeline_idle_tail_duration | Standard | SELECT on system.lakeflow, system.billing; Public Preview (system.lakeflow.pipelines and pipeline_update_timeline); GA (system.billing.usage/list_prices) | system.lakeflow.pipeline_update_timelinesystem.lakeflow.pipelinessystem.billing.usagesystem.billing.list_prices | Schema not enabledPreview not rolled out |
| Pipeline Refresh Failures And Retrieslakeflow_pipeline_update_failures_retries | Lite | SELECT on system.lakeflow; Public Preview (system.lakeflow.pipeline_update_timeline) | system.lakeflow.pipeline_update_timeline | Schema not enabledPreview not rolled out |
| DLT Pipeline Fleet Inventorylakeflow_pipelines_inventory_tier | Lite | SELECT on system.lakeflow; Public Preview (system.lakeflow.pipelines) | system.lakeflow.pipelines | Schema not enabledPreview not rolled out |
| Flapping Jobs That Retrylakeflow_retries_repairs | Standard | SELECT on system.lakeflow, system.billing; GA | system.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices | Schema not enabled |
| Hunting Stale Zombie Jobslakeflow_stale_zombie_jobs | Standard | SELECT on system.lakeflow, system.billing; GA | system.lakeflow.jobssystem.lakeflow.job_run_timelinesystem.billing.usagesystem.billing.list_prices | Schema not enabledSubmit-run onlyOutside retention window |
| Green Runs Hiding Failed Taskslakeflow_succeeded_with_failed_tasks | Lite | SELECT on system.lakeflow; GA | system.lakeflow.job_run_timelinesystem.lakeflow.job_task_run_timeline | Schema not enabled |
| Tasks Running Near Timeoutlakeflow_tasks_near_timeout | Standard | SELECT on system.lakeflow; GA (execution_duration_seconds and timeout_seconds were both added late Nov 2025) | system.lakeflow.job_task_run_timelinesystem.lakeflow.job_tasks | Schema not enabledSubmit-run only |
| Job Failure Root-Cause Breakdownlakeflow_termination_taxonomy | Lite | SELECT on system.lakeflow; GA | system.lakeflow.job_run_timeline | Schema not enabled |
| Discover Job Termination-Type Valueslakeflow_termination_type_probe | Lite | SELECT on system.lakeflow; GA (the column exists; its value enum is unverified - see caveats) | system.lakeflow.job_run_timeline | Schema not enabled |
| Daily Job Run Mix And Hourslakeflow_workload_mix_hours | Lite | SELECT on system.lakeflow; GA (execution_duration_seconds was added early Dec 2025) | system.lakeflow.job_run_timeline | Schema not enabled |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| AI Gateway Abuse Signalscompute_ai_gateway_usage | Standard | SELECT on system.ai_gateway; must be enabled per-metastore (empty until AI Gateway is enabled on an endpoint) | system.ai_gateway.usage | Schema not enabledPreview not rolled outAccount-admin read onlyUsage tracking off |
| What Your Serving Endpoints Cost — and Which Are Idlecompute_serving_endpoint_cost_status | Standard | SELECT on system.billing, system.serving, system.access; the serving and access system schemas enabled; billing is GA, serving + workspaces_latest are Public Preview | system.billing.usagesystem.billing.list_pricessystem.serving.served_entitiessystem.serving.endpoint_usagesystem.access.workspaces_latest | Schema not enabledPreview not rolled outUsage tracking off |
| Daily Serving Endpoint Trafficcompute_serving_endpoint_usage | Deep | SELECT on system.serving, system.billing; system.serving must be enabled per-metastore (empty until Model Serving is in use); system.billing is GA. | system.serving.served_entitiessystem.serving.endpoint_usagesystem.billing.usagesystem.billing.list_prices | Schema not enabledPreview not rolled outUsage tracking off |
| Serving Endpoint Traffic Rollupserving_endpoint_traffic_by_endpoint | Deep | SELECT on system.serving, system.billing; system.serving must be enabled per-metastore (empty until Model Serving is in use); system.billing is GA. | system.serving.endpoint_usagesystem.serving.served_entitiessystem.billing.usagesystem.billing.list_prices | Schema not enabledPreview not rolled outUsage tracking off |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Detecting UniForm & Managed-Iceberg Tablesiceberg_uniform_metadata | Deep | DESCRIBE / SELECT privilege on the target table; Unity Catalog required (UniForm / managed-Iceberg detection is a UC feature) | none - DESCRIBE EXTENDED output; not a system table | always-on |
| Liquid Clustering Work and Costpo_clustering_activity | Standard | SELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional | system.storage.predictive_optimization_operations_history | Schema not enabledPreview not rolled outPredictive Optimization offIngestion lag |
| Clustering Key Churn Detectorpo_clustering_column_churn | Deep | SELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional | system.storage.predictive_optimization_operations_history | Schema not enabledPreview not rolled outPredictive Optimization off |
| Data-Skipping Stats Backfill Trackerpo_data_skipping_backfill | Deep | SELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional | system.storage.predictive_optimization_operations_history | Schema not enabledPreview not rolled outPredictive Optimization off |
| Predictive Optimization Cost & Coveragepo_maintenance_cost_by_table | Standard | SELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional, 180-day retention | system.storage.predictive_optimization_operations_history | Schema not enabledPreview not rolled outPredictive Optimization offIngestion lag |
| VACUUM Storage Reclaimed Per Tablepo_vacuum_reclaimed_bytes | Standard | SELECT on system.storage; Public Preview (system.storage.predictive_optimization_operations_history), regional | system.storage.predictive_optimization_operations_history | Schema not enabledPreview not rolled outPredictive Optimization off |
| Real Table Size Breakdownstorage_breakdown_analyze | Deep | privilege sufficient to run ANALYZE TABLE on the target table; GA but requires DBR 18.0+ (COMPUTE STORAGE METRICS is not available on older runtimes) | none - ANALYZE TABLE COMPUTE STORAGE METRICS output; not a system table | always-on |
| Table Inventory by Type and Formattable_inventory_type | Deep | SELECT on system.information_schema; Unity Catalog required | system.information_schema.tables | No SELECT privilege |
| Delta Time-Travel & Optimize Settingstable_props_time_travel_config | Standard | DESCRIBE / SELECT privilege on the target table; GA (standard Delta Lake table properties) | none - DESCRIBE EXTENDED / SHOW TBLPROPERTIES output; not a system table | always-on |
| Query | Tier | Requires | Reads | Empty if |
|---|---|---|---|---|
| Run-As Privilege Escalation Watchaccess_runas_escalation | Deep | SELECT on system.access; Public Preview | system.access.audit | Schema not enabledNo SELECT privilegePreview not rolled outVerbose audit off |
| Who Changed Permissions, From Whereaccess_admin_role_change_events | Standard | SELECT on system.access; Public Preview | system.access.audit | Schema not enabledNo SELECT privilegePreview not rolled out |
| Sensitive Columns Missing Their Maskaccess_classified_unmasked | Standard | SELECT on system.data_classification and system.information_schema; system.data_classification is Public Preview and requires Unity Catalog; column_masks is Public Preview (DBR 12.2 LTS+) | system.data_classification.resultssystem.information_schema.column_masks | Schema not enabledNo SELECT privilegePreview not rolled outNo serverless computeABAC policies only |
| Column-Level Lineage Blast Radiusaccess_column_lineage_sensitive_reach | Deep | SELECT on system.access; GA | system.access.column_lineage | Schema not enabledLineage not inferable |
| Which Columns Are Actually Maskedaccess_column_masks_inventory | Standard | SELECT on system.information_schema; Public Preview, DBR 12.2 LTS+, Unity Catalog required | system.information_schema.column_masks | No SELECT privilegeABAC policies only |
| Where Sensitive Data Actually Livesaccess_data_classification_inventory | Standard | SELECT on system.data_classification; Public Preview, Unity Catalog required, needs the data-classification feature AND the system.data_classification schema both enabled | system.data_classification.results | Schema not enabledPreview not rolled outNo serverless compute |
| Dead-Table Cleanup Candidatesaccess_dead_table_candidates | Standard | SELECT on system.access and system.information_schema; system.access.table_lineage is GA; information_schema requires Unity Catalog | system.access.table_lineagesystem.information_schema.tables | No SELECT privilegeLineage not inferableOutside retention window |
| Who Holds Which Grantsaccess_grants_inventory | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.table_privilegessystem.information_schema.catalog_privileges | No SELECT privilege |
| Grants on Schemas and Integrationsaccess_grants_inventory_extended | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.schema_privilegessystem.information_schema.connection_privilegessystem.information_schema.credential_privilegessystem.information_schema.external_location_privileges | No SELECT privilege |
| Login Concentration & Anomaly Rollupaccess_login_concentration | Standard | SELECT on system.access; Public Preview | system.access.audit | Schema not enabledNo SELECT privilegePreview not rolled out |
| Blocked Inbound Network Attemptsaccess_network_inbound_denials | Deep | SELECT on system.access; Public Preview | system.access.inbound_network | Schema not enabledPreview not rolled out |
| Blocked Egress Exfiltration Attemptsaccess_network_outbound_denials | Deep | SELECT on system.access; Public Preview | system.access.outbound_network | Schema not enabledPreview not rolled outServerless / warehouse only |
| PII Leaking Into Untagged Columnsaccess_pii_propagation_untagged | Standard | SELECT on system.access and system.information_schema; system.access.column_lineage is GA; information_schema requires Unity Catalog | system.access.column_lineagesystem.information_schema.column_tags | Schema not enabledNo SELECT privilegeLineage not inferableOutside retention window |
| Row Filter Coverage Inventoryaccess_row_filters_inventory | Standard | SELECT on system.information_schema; Public Preview, DBR 12.2 LTS+, Unity Catalog required | system.information_schema.row_filters | No SELECT privilegeABAC policies only |
| Table Lineage Blast Radiusaccess_table_lineage_blast_radius | Standard | SELECT on system.access; GA | system.access.table_lineage | Schema not enabledNo SELECT privilegeLineage not inferable |
| Manual Governance Tag Inventoryaccess_tags_inventory | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.column_tagssystem.information_schema.table_tags | No SELECT privilege |
| Vector Search Query Traffic by Endpointaccess_vector_search_traffic | Standard | SELECT on system.access; Public Preview | system.access.audit | Schema not enabledNo SELECT privilegePreview not rolled outVerbose audit off |
| What You're Sharing Outside — and With Whomaccess_delta_sharing_exposure | Standard | SELECT on system.information_schema; Unity Catalog required; Delta Sharing (provider side) in use | system.information_schema.sharessystem.information_schema.share_recipient_privilegessystem.information_schema.table_share_usagesystem.information_schema.schema_share_usage | No SELECT privilegeFeature not used yet |
| Every View, and Which Are Materializedaccess_views_inventory | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.tablessystem.information_schema.views | No SELECT privilegeFeature not used yet |
| Volumes — the Files Outside Your Tablesaccess_volumes_inventory | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.volumessystem.information_schema.volume_tags | No SELECT privilegeFeature not used yet |
| PII the Masks Can't Reachaccess_pii_outside_tables | Standard | SELECT on system.information_schema; Unity Catalog required | system.information_schema.volumessystem.information_schema.volume_tagssystem.information_schema.schema_tags | No SELECT privilegeFeature not used yet |
Almost always a schema-enablement gap, not an empty account. Several system.* schemas (e.g. system.query, system.lakeflow, system.serving) are still in preview or must be enabled per-metastore. Check the query’s Requires line and the reads column below: if it names a schema you haven’t enabled, that is the cause. A genuinely quiet account (no failures, no idle clusters) can also legitimately return nothing. See Prerequisites & enablement above for the reasons a table is empty and the step-by-step enable recipe.
By design. Inventory and reference queries return NOT ASSESSED at runtime because they carry no pass/fail band — they return state to read (a configuration, a price basis, a role list), so there is no OK/WARN/CRITICAL to compute. It is a runtime outcome, not a column in the matrix above. The money-trust queries also leave the dollar figure “not assessed” when Databricks exposes no per-row DBU column: that is an honest gap, not an omission — the magnitude (count, runtime, quantity) is still reported.
The schema isn’t enabled for your metastore, or your principal lacks SELECT on it. Every query’s Requires line states the grant it needs (e.g. SELECT on system.billing; GA). Grant SELECT on the parent system schema (or ask your account admin to enable it) — the coverage matrix below shows how many queries a single grant unlocks.
When system.billing.account_prices is absent (it is not present in every environment), the queries fall back to list price and label the figure est · at list — pre-discount, DBU-only, and directional, never your negotiated invoice. An untagged or unpriced slice means one GROUP BY group had no matching price row, not that the whole account is unpriced. See the reference glossary for the list-vs-account and est · at list definitions.
New here? Start with the first-audit runbook, follow an investigation trail, and keep the reference & glossary open.