Hello Patrick,
Before Ranger was integrated with Sandbox, dfs.permissions in Sandbox was set to false. The reason was to allow Hue and some other use cases to create databases and tables.
After Ranger was integrated, we emulated the same behavior by creating a global policy to allow access for everyone. This likely explains the behavior that you’re seeing in the Sandbox now.
If you go through the Sandbox Security tutorials, the first step is to disable the global policy (for each component). If you disable the global HDFS policy in Ranger which allows everyone, then I think you’ll start to see the behavior you expect from HDFS.
I hope this helps.
–Chris