The Lakehouse runtime catalog enforces storage location, permission,
and security hardening rules when you create and manage tables using the Apache
Iceberg REST catalog endpoint. These rules help you isolate underlying storage
paths, prevent naming conflicts, and restrict table registration to authorized
administrators.

## Table location

Table paths must be nested within the parent namespace path (for example,
`gs://{namespace_path}/.../{table_name}`). This constraint is enforced to help
with security and catalog hardening.

**Behavior change for table paths:** Note that the resulting table location
(under which the `metadata/` folder is created) automatically has a random
string attached as a suffix to prevent conflicts and improve security:

- If no specific location is provided, the resulting location is `gs://{namespace_path}/{table_name}/{random_suffix}`.
- If a specific location is provided (for example, `gs://{namespace_path}/.../{table_name}`), the resulting location is `gs://{namespace_path}/.../{table_name}/{random_suffix}`.

## Table registration permissions

Both multiple-bucket and single-bucket catalogs require the
`biglake.tables.register` permission to register a table. This permission is
restricted to the BigLake Admin (`roles/biglake.admin`) role to ensure only
administrators can perform table registration.