Permission Settings

For each action (read, write, execute, delete) that each user or group can perform on an object in the data catalog, the object’s access control list assigns a permission value: Unset, Deny, or Allow.

Unset	This permission has not been set by an owner or administrator. When a permission value is Unset, the user’s or group’s permission for this action (read, write, execute, or delete) may depend on other permissions (group or individual) for this object. For example, if a user’s own account has a permission of Unset for reading a file but the user belongs to a group that is allowed to read the file, the user is allowed to read the file. If the user’s account has a permission of Unset for reading a file and no group permissions apply, the user is not allowed to read the file.
Deny	The user or group may not perform this action (read, write, execute, or delete) on the object. When user and group permissions on an object conflict, Deny generally wins. You cannot deny permission to a group, except for the “everyone” group.
Allow	The user or group may perform this action (read, write, execute, or delete) on the object unless permission is denied elsewhere. For example, if a user belongs to a group that is allowed to read a file, but the user himself is denied permission to read that file, the user is not able to read the file.