---
title: "Unifying governance across engines and catalogs in the Open Lakehouse"
description: "Apache Iceberg’s REST Catalog additions—read restrictions and catalog labels—address different cross-platform governance problems: delegating enforcement to trusted engines and carrying governance context across federated catalogs. Read restrictions let a catalog evaluate policy for a principal and return bounded column-projection actions and row-filter expressions that a trusted engine must enforce, while leaving trust establishment outside the protocol. Catalog labels exchange opaque key-value metadata at table and column level, allowing a consuming catalog to map classifications locally, preserve native policy expressiveness, and maintain its own audit trail. Together with centralized enforcement through Cross-Engine ABAC, they provide distinct options for direct access and catalog federation, although read restrictions cannot express policies outside their standardized vocabulary."
---

# Unifying governance across engines and catalogs in the Open Lakehouse

[Databricks](https://yomu.fyi/company/databricks) · Daniel Weeks, Ryan Blue, Andrei Tserakhau · Sep 10, 2026

**Type:** Explainer

## Summary

Apache Iceberg’s REST Catalog additions—read restrictions and catalog labels—address different cross-platform governance problems: delegating enforcement to trusted engines and carrying governance context across federated catalogs. Read restrictions let a catalog evaluate policy for a principal and return bounded column-projection actions and row-filter expressions that a trusted engine must enforce, while leaving trust establishment outside the protocol. Catalog labels exchange opaque key-value metadata at table and column level, allowing a consuming catalog to map classifications locally, preserve native policy expressiveness, and maintain its own audit trail. Together with centralized enforcement through Cross-Engine ABAC, they provide distinct options for direct access and catalog federation, although read restrictions cannot express policies outside their standardized vocabulary.

## Context

Cross-platform governance must support data access from different engines and federation among heterogeneous catalogs, while addressing enforcement boundaries, policy expressiveness, auditability, performance, identity handling, and service dependencies.

## Approach / What changed

The post explains three governance patterns: centralized enforcement through scan planning, read restrictions for delegating policy outcomes to trusted engines, and catalog labels for exchanging table- and column-level governance context between catalogs. It compares their enforcement models, identity and security requirements, scalability, auditability, and suitable deployment scenarios.

## Takeaways

- Read restrictions return principal-specific column-projection actions and standardized row-filter expressions; they do not transmit administrator-defined policies directly.
- Catalog labels are opaque key-value pairs exchanged at table and column level, then mapped into the consuming catalog’s native classifications, attributes, or tags.
- Read restrictions suit trusted engines with expressible policies, while catalog labels suit federation where each catalog performs local policy evaluation and enforcement.

**Tags:** [Apache Iceberg](https://yomu.fyi/topic/apache-iceberg), [Attribute-Based Access Control](https://yomu.fyi/topic/attribute-based-access-control), [Data Governance](https://yomu.fyi/topic/data-governance)

- Source: [Databricks](https://www.databricks.com/blog/unifying-governance-across-engines-and-catalogs-open-lakehouse)
- Source URL: https://www.databricks.com/blog/unifying-governance-across-engines-and-catalogs-open-lakehouse
- Ingested by Yomu: 2026-09-11T00:02:55.172Z

[Read original post](https://www.databricks.com/blog/unifying-governance-across-engines-and-catalogs-open-lakehouse)