An entity-relationship diagram of the 50 system.* tables the audit library reads, across 10 schemas. Where the query lineage shows how the queries connect, this shows how the tables connect — the data model underneath. Start with the schema overview, then drop into a subject area for its tables and join keys.
This is grounded, not hand-drawn: the tables are exactly what the queries read, and every line is a join the SQL actually makes — the usage_metadata foreign keys and the JOIN … ON clauses mined from the query bodies. Read each line as child → parent: ∞ is the many end, 1 the one end, and the label is the join key. PK / FK / K badges mark the primary key, foreign keys and business keys on each table.
Six subject areas. system.billing.usage is the hub: its usage_metadata struct is the foreign key that attributes every DBU out to compute, jobs and serving, and workspace_id ties it to the access schema. Governance hangs off the securables that lineage points at. The label on each link is the joining column.
One ER diagram per subject area: its tables, their primary and foreign keys, and the join that links them. Foreign keys that reach into another subject area leave as a “joins out” caption. Wide diagrams scroll sideways.
system.billing.usage is the account's spine: one row per SKU per hour. It prices against list_prices / account_prices on a time-windowed join, and its usage_metadata struct is the foreign key that attributes every DBU to a cluster, job, warehouse, pipeline or endpoint.
Clusters, SQL warehouses and instance pools — plus the per-minute node timeline and the node-type catalogue that size them. query.history bridges here: every statement records the warehouse or cluster it ran on.
The lakeflow schema is a clean parent→child hierarchy: a job has tasks and runs; a run has task-runs; a DLT pipeline has updates. Job / pipeline ids are how billing.usage attributes spend to a workflow.
A served entity (model / external endpoint) is the parent; per-request usage and AI-gateway logs hang off its endpoint id. billing.usage attributes serving DBUs by the same endpoint id.
workspaces_latest is the workspace dimension nearly every system table joins to by workspace_id. The audit log is the raw event stream; table / column lineage records what read or wrote what, keyed to the job run or statement that did it.
The information_schema securables — tables, views, volumes — are the hub. Tags, grants, masking / row-filter policies, Delta-Sharing usage, PII classification and storage optimisation all attach to a securable by its catalog · schema · table name. Related tables are grouped into families to keep the map readable; each row is a real system table.
Now that you know how the tables connect, see how the queries connect, walk the investigation trails, or check which queries can come back empty on the coverage page.