Comment by efromvt

I think you can model this as locked down buckets, wider engine access (spark/presto/etc), and apply the controls at the engine level. (it's not inherently different from making sure your DB files are locked down, if you squint at it). This does obviously block any non-engine access which has downsides. I agree that it is generally much less mature with lakehouses than eneterprise DBs.