Unifying governance across engines and catalogs in the Open Lakehouse

Summary

Apache Iceberg’s REST Catalog additions—read restrictions and catalog labels—address different cross-platform governance problems: delegating enforcement to trusted engines and carrying governance context across federated catalogs. Read restrictions let a catalog evaluate policy for a principal and return bounded column-projection actions and row-filter expressions that a trusted engine must enforce, while leaving trust establishment outside the protocol. Catalog labels exchange opaque key-value metadata at table and column level, allowing a consuming catalog to map classifications locally, preserve native policy expressiveness, and maintain its own audit trail. Together with centralized enforcement through Cross-Engine ABAC, they provide distinct options for direct access and catalog federation, although read restrictions cannot express policies outside their standardized vocabulary.

Takeaways

1. 1

   Read restrictions return principal-specific column-projection actions and standardized row-filter expressions; they do not transmit administrator-defined policies directly.

2. 2

   Catalog labels are opaque key-value pairs exchanged at table and column level, then mapped into the consuming catalog’s native classifications, attributes, or tags.

3. 3

   Read restrictions suit trusted engines with expressible policies, while catalog labels suit federation where each catalog performs local policy evaluation and enforcement.