How does one gain access to the tables in dbt_test__audit when store_failures is turned on?

[fathom-parth]

For our other models, we have a grant section in their model config to give the right people roles/bigquery.dataViewer.
However, if store_failures is turned on, I don't see a way to give the relevant people dataViewer on the created tables/schemas.

Am I missing some documentation? I don't see anything in:

1. https://docs.getdbt.com/reference/test-configs
2. https://docs.getdbt.com/reference/resource-configs/schema#tests
3. https://docs.getdbt.com/reference/resource-configs/grants
4. https://docs.getdbt.com/reference/resource-configs/store_failures

Apologies if I didn't read closely enough!

[adamcunnington-mlg]

@fathom-parth I'm not following what granting permissions has to do with store failures (which is about persisting test failure outputs).

If you want to give someone access to a table, the grant section, as you indicated, is sufficient.
If you want to give someone to something beyond the scope of the model, then you can iterate through the results object during on-run-end (a key in dbt_project.yml).

[alison985]

@adamcunnington-mlg's this question from @fathom-parth makes complete sense to me and is something I have faced. Especially when runs are done on a service user account. It creates a schema and content that needs granting but is in the configuration in such a way that how to do grants is not straight-forward. I had a hard time even figuring out where this schema came from and how to turn it on/off. There's an extra wrinkle with the schema name re: target and custom schema name appends.

How can you know what objects to grant? Especially ahead of their first creation.

Your option to use on-run-end would add to run times in a way that's not needed. The select grant only needs to be run one time.

While I think this question can be answered by putting an example in the docs ( @mirnawong1 ) it's an example of a great question a lot of folks have and will have.

[adamcunnington-mlg]

Ah, I hadn't combined the title of the issue with the description so hadn't fully grasped what was being asked. Yes, I see now - and on-run-end is the only option to do this correctly in all cases and it feels clunky given it's only needed to be done once

[jtcohen6]

This feels like a legitimate feature request:

• Tests should be configurable with grants, like other resource types.
• When --store-failures is enabled, the test "materialization" (which materializes a table of failures in the DWH) should also apply_grants, which it doesn't currently

That would apply grants once per test / table, but it enables more granular configuration, and feels more straightforward than trying to configure grants on the dbt_test__audit schema (the default namespace if another is not specified).

Separately, there is a discussion from last year around, should it be possible (and how) to apply configurations (such as grants) to schema objects?

• Configuring + managing `schemas` #5781