---
title: "What is Row-Level Security?"
description: "Row-level security (RLS) is a database access control that filters which table rows a user may read or change according to identity, role, or session context. It supports multi-tenant SaaS, regional segregation, departmental access, compliance, healthcare, and partner use cases, while typically layering table-level grants with column-level security or data masking. The database applies a policy or predicate automatically at query time across BI dashboards, notebooks, ad-hoc SQL, APIs, and third-party tools, with separate USING and WITH CHECK rules for reads and writes. On Databricks, Unity Catalog row filters use SQL user-defined functions and apply across Databricks SQL, notebooks, jobs, and connected BI tools. The source recommends simple predicates, indexed keying columns, identity-based testing, and explicit enforcement for both reads and writes."
---

# What is Row-Level Security?

[Databricks](https://yomu.fyi/company/databricks) · Databricks Staff · Jun 18, 2026

**Type:** Explainer

## Summary

Row-level security (RLS) is a database access control that filters which table rows a user may read or change according to identity, role, or session context. It supports multi-tenant SaaS, regional segregation, departmental access, compliance, healthcare, and partner use cases, while typically layering table-level grants with column-level security or data masking. The database applies a policy or predicate automatically at query time across BI dashboards, notebooks, ad-hoc SQL, APIs, and third-party tools, with separate USING and WITH CHECK rules for reads and writes. On Databricks, Unity Catalog row filters use SQL user-defined functions and apply across Databricks SQL, notebooks, jobs, and connected BI tools. The source recommends simple predicates, indexed keying columns, identity-based testing, and explicit enforcement for both reads and writes.

## Context

Shared tables often serve multiple audiences with different visibility rules, such as tenants, regions, departments, clinicians, or external partners. The access boundary must remain consistent across different tools and access paths, while sensitive columns and whole-table permissions may require additional controls.

## Approach / What changed

Define a policy or predicate based on identity, role, session context, or a mapping table; attach it to the target table; and separately define read-side and write-side enforcement when the table accepts changes. On Databricks, use Unity Catalog row filters backed by SQL user-defined functions, alongside column masks and table-level grants where needed.

## Takeaways

- RLS filters rows automatically at the database layer, so the same rule applies across dashboards, notebooks, ad-hoc SQL, APIs, and third-party tools.
- Read predicates and write checks serve different purposes: USING controls visible rows, while WITH CHECK controls rows a user may insert or update.
- Databricks implements RLS through Unity Catalog row filters, which can use SQL user-defined functions and integrate with lineage and audit information.

**Tags:** [Databricks](https://yomu.fyi/topic/databricks), [Unity Catalog](https://yomu.fyi/topic/unity-catalog)

- Source: [Databricks](https://www.databricks.com/blog/row-level-security)
- Source URL: https://www.databricks.com/blog/row-level-security
- Ingested by Yomu: 2026-08-30T17:01:03.916Z

[Read original post](https://www.databricks.com/blog/row-level-security)