Authenticate and obtain a token scoped to the target catalog
Create a namespace by sending POST /api/catalog/v1/{prefix}/namespaces with a body containing the namespace array and optional properties
Create a catalog role if one does not already exist via the management API
Grant a namespace-scoped privilege (such as TABLE_READ_DATA or NAMESPACE_FULL_METADATA) to the catalog role via POST /api/management/v1/catalogs/{catalogName}/catalog-roles/{roleName}/grants, specifying the namespace in the grant body
Grant the catalog role to a principal role so that principals in that role inherit the privilege
Known gotchas
Namespaces in Polaris follow the Iceberg REST Catalog namespace spec; nested namespaces are represented as arrays (e.g., ["db", "schema"])
The {prefix} path segment in the catalog API URL is typically the catalog name as registered; it is not the same as the management API's catalogName path
Privileges granted at the namespace level propagate to tables within that namespace only when the privilege type supports inheritance; always verify with the privilege matrix in the Polaris docs
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp