Access control in a modern data warehouse determines who can do what to which data. Role-Based Access Control (RBAC) assigns permissions to named roles and users inherit all permissions of their assigned roles. Attribute-Based Access Control (ABAC) extends RBAC by making access decisions based on user, resource, and environment attributes — 'allow access to deliveries where batting_team = user's team'. Most cloud data warehouses implement RBAC as the primary access control mechanism and support ABAC through row-level security features like Snowflake Row Access Policies.
The principle of least privilege, applied systematically to a data warehouse, produces a role hierarchy designed around actual job functions. A typical analytics platform role hierarchy has: SYSADMIN (infrastructure management only), SECURITYADMIN (role grants only, no data access), DATA_ENGINEER_ROLE (read/write staging, read-only analytics), ANALYST_ROLE (read-only analytics, no staging), BI_SERVICE_ROLE (read-only to specific mart tables only), and GOVERNANCE_ROLE (read access to audit logs only). Each role has exactly the permissions needed for its function and nothing more.
Analogy🏏Cricket
🏏 Think of it like cricket: OLTP is the IPL's live ticketing counter — it handles thousands of simultaneous seat reservations, each requiring a precise single-seat record update with immediate confirmation. Speed per transaction and data consistency under concurrent updates are everything. OLAP is the IPL's season statistics department — it runs complex analytical queries across every ball bowled in every match of every season to produce the published rankings, economy rates, and historical comparisons. No one books a seat through the statistics department, and no broadcaster calls the ticketing counter for Bumrah's career economy rate. The two workloads demand completely different systems. Just as the ticketing counter is built for speed and correctness on one seat at a time and would buckle if asked to tally a decade of attendance mid-sale, an OLTP row-store excels at single-record writes but chokes on full-table aggregation; and just as the statistics department pores over millions of past deliveries but would be hopeless at booking a live seat under contention, the OLAP columnar engine sweeps billions of rows yet is the wrong tool for a fast single-row update. The physical design of each — row-oriented for the counter, columnar for the stats desk — is what makes it superb at its own job and unfit for the other's.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.