The audit log

SELECT action_name,
       array_sort(map_keys(request_params)) AS param_keys,
       count(*)                             AS events
FROM   system.access.audit
WHERE  service_name = 'unityCatalog'
  AND  action_name IN ('getTable', 'generateTemporaryTableCredential',
                       'updatePermissions',
                       'createEntityTagAssignment',
                       'deleteEntityTagAssignment')
  AND  event_date >= current_date() - INTERVAL 7 DAYS
GROUP  BY action_name, array_sort(map_keys(request_params))
ORDER  BY action_name, events DESC;

SELECT event_time,
       action_name,
       -- One key per action, and the names are not interchangeable:
       -- full_name_arg (getTable) / table_full_name / full_name.
       -- Verify against the probe query above before shipping.
       coalesce(request_params.full_name_arg,
                request_params.table_full_name,
                request_params.full_name)     AS securable,
       response.status_code                   AS status,
       source_ip_address
FROM   system.access.audit
WHERE  service_name        = 'unityCatalog'
  AND  user_identity.email = 'sp-dwh-prod-loader'
  AND  event_date >= current_date() - INTERVAL 7 DAYS
ORDER  BY event_time DESC
LIMIT  200;

-- information_schema is PER CATALOG: this must be dwh_prod's, not system's.
WITH pii_tables AS (
  SELECT DISTINCT
         catalog_name || '.' || schema_name || '.' || table_name AS full_name
  FROM   dwh_prod.information_schema.column_tags
  -- The governed tag is 'pii' with values email | phone | address (see the
  -- Access & ABAC route). Match on the KEY, not on a value -- a value filter
  -- silently drops any class you add later, and this query failing open looks
  -- exactly like a clean review.
  WHERE  tag_name = 'pii'
),
touches AS (
  SELECT user_identity.email  AS principal,
         -- getTable is documented with full_name_arg; the credential-vending
         -- event is NOT -- it is documented with full_name and reported as
         -- table_full_name. Pick one key and every data-access row joins to
         -- NULL and disappears. Confirm the keys with the map_keys probe in
         -- 'What system.access.audit records' before you trust this output.
         coalesce(request_params.full_name_arg,
                  request_params.table_full_name,
                  request_params.full_name) AS full_name,
         event_time,
         response.status_code  AS status
  FROM   system.access.audit
  WHERE  service_name = 'unityCatalog'
    AND  action_name IN ('getTable', 'generateTemporaryTableCredential')
    AND  event_date >= current_date() - INTERVAL 90 DAYS
)
SELECT t.principal,
       t.full_name,
       count_if(t.status =  200) AS allowed,
       count_if(t.status <> 200) AS refused,
       max(t.event_time)         AS last_touch
FROM   touches t
JOIN   pii_tables p ON p.full_name = t.full_name
GROUP  BY t.principal, t.full_name
ORDER  BY allowed DESC;

SELECT event_time,
       user_identity.email            AS changed_by,
       action_name,
       request_params.securable_type  AS securable_type,
       -- Name keys differ per action; verify with the map_keys probe from
       -- 'What system.access.audit records' before this alert goes live.
       coalesce(request_params.securable_full_name,
                request_params.full_name,
                request_params.entity_name)  AS securable,
       request_params.changes               AS changes,
       source_ip_address
FROM   system.access.audit
WHERE  service_name = 'unityCatalog'
  AND  action_name IN ('updatePermissions',
                       'createCatalog', 'deleteCatalog',
                       -- tagging IS a permission boundary under ABAC
                       'createEntityTagAssignment',
                       'deleteEntityTagAssignment')
  AND  event_date >= current_date() - INTERVAL 1 DAY
  AND  coalesce(request_params.securable_full_name,
                request_params.full_name,
                request_params.entity_name, '') LIKE 'dwh_prod%'
ORDER  BY event_time DESC;