Future grants: DATA METRIC FUNCTION and FUNCTION objects are now evaluated independently (Pending)¶

Future grants on DATA METRIC FUNCTION objects and on FUNCTION (UDF) objects are now evaluated independently.

Before the change:

DATA METRIC FUNCTION and FUNCTION objects shared the same internal type code (FN) for future grants. As a result, a future grant on one type inadvertently applied to the other:

• GRANT <privilege> ON FUTURE DATA METRIC FUNCTION IN SCHEMA <schema> also granted <privilege> on all future FUNCTION objects in that schema.
• GRANT <privilege> ON FUTURE FUNCTION IN SCHEMA <schema> also granted <privilege> on all future DATA METRIC FUNCTION objects in that schema.

This caused unintended privilege expansion in both directions.

After the change:

Future grants on DATA METRIC FUNCTION objects apply only to DATA METRIC FUNCTION objects, and future grants on FUNCTION objects apply only to FUNCTION objects. The two object types are treated as distinct securables in future grant evaluation.

This change is being made to prevent over-authorization that results from the shared internal type code and to align future grant behavior with the intended object-type boundaries.

How to update your access control configuration¶

Before this bundle is enabled, review any existing future grants that target FUNCTION or DATA METRIC FUNCTION objects:

SHOW FUTURE GRANTS IN SCHEMA <schema_name>;
SHOW FUTURE GRANTS IN DATABASE <database_name>;

If you relied on a FUNCTION future grant to also cover DATA METRIC FUNCTIONs (or vice versa), add an explicit future grant for the intended object type before enabling the bundle.

Ref: 2422