BigQuery docs do not describe explicitly what permissions are required for a wildcard query.

I assume:

• bigquery.tables.list at the dataset-level
• bigquery.tables.getData at the table-level for
• roles/bigquery.jobUser at the project level to be able to issue queries – but I include this for completeness; it’s not relevant here as the permission error relates to data access, not compute

However, I’ve tried this via:

• Assigning bigquery.tables.list at the dataset-level (along with bigquery.datasets.get for completeness) via a custom role
• Assigning roles/bigquery.dataViewer at the table-level for every table that is caught by the wildcard query

But I get a non-descript error:

If I write a query that manually unions all tables that ARE caught by wildcard, it works fine – so there is clearly some additional super non-obvious permission required by wildcard operation – and I can’t even guess what it is based on the permissions that are contained within roles/bigquery.dataViewer.

I do not want to grant roles/bigquery.dataViewer at the dataset level as my users should only be able to query the tables caught by particular wildcard queries and not all other tables in the dataset.

Help appreciated, thanks.