This behavior is by design.
load and lookup [ load … ] work in Notebooks, but they are not supported in the SLOs app or Davis Anomaly Detector. Even with the correct permissions, you will still see an error when trying to access /lookups/... in those apps.
What you can do instead:
Pre-enrich at ingest: Enrich logs, Business Events, or metrics with lookup (mapping) data before they are stored in Grail. This way, the SLO or anomaly detection can use regular fields/dimensions without relying on load.
Tags / MZ / source attributes: If your lookup is used for classification, replicate it using auto-tags, Management Zones, or additional metric dimensions.
Use Notebook/Dashboard for analysis: Keep any analysis that requires lookup [ load … ] in Notebooks or Dashboards, and base the SLO on metrics/events that are already enriched.
Permissions (for Notebook / Resource Store access):
ALLOW storage:files:read - globally
OR
ALLOW storage:files:read WHERE storage:file-path startsWith "/lookups/";
ALLOW storage:files:write // if you upload
OR
ALLOW storage:files:write WHERE storage:file-path startsWith "/lookups/"; // if you upload
ALLOW storage:files:delete // if you delete
ALLOW storage:files:delete WHERE storage:file-path startsWith "/lookups/"; // if you delete
After that quick DQL test in notebook:
fetch dt.system.files
| limit 1
load "/lookups/..."
| limit 5
MaciejNeumann
