AnalyticsCatalogReaderRole

Keeps the catalog to the catalog's roles: a read of the catalog's own aggregates (its sources and datasets, their columns, sensitivity and lineage, the control plane), a query of any of their models, a state read or a trace, by a caller with none of AnalyticsCatalogRoles.READERS is refused as wow.auth.forbidden before anything is read: the read is right, the caller may not make it. Trusted in-process code, which reads with no caller, is not asked.

The published datasets themselves (the DATASET model, the data plane) are not the catalog's to guard: their queries go through the node's other rules as any dataset's do, each caller reading the rows of its own scope (tenant, owner, space) with each value masked as its lineage says.