ABAC: When Data Context Becomes the Access Rule
Attribute-Based Access Control uses identity and data attributes to decide access. This explainer shows how governed tags become row filters or column masks across data engines.
Loading…
Topic
Data Classification
2 posts about Data Classification. Every summary links to the original.
- 2 posts
- 2 companies
- 1 explainer
See the idea
Data Classification explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Building a File Semantic Analyzer: Guarding Outbound Data at Scale with AI
Organizations struggled to determine whether files leaving their environment contained business-critical information, personal data, or non-essential content. Uber’s File Semantic Analyzer (FSA) addresses the limits of keyword- and pattern-based DLP by extracting text from documents, using OCR for image-based files, chunking large inputs, and sending context-rich text to a fine-tuned large language model. The model produces summaries, named entities, key phrases, inferred intent, classifications, and explanations, which a rule-based engine uses for policy enforcement while analysts validate high-fidelity findings and provide feedback. The system reduced incident-response time from multiple hours to a few minutes per case, saves an average of five minutes per file, and is expected to analyze 150,000 files annually; the post reports a 97% reduction in false positives.
ABAC row filtering and column masking policies, governed tags, and data classification are now generally available in Unity Catalog
Unity Catalog now generally offers three complementary data-governance capabilities: Attribute-Based Access Control (ABAC) policies for row filtering and column masking, Governed Tags, and agentic Data Classification. They address per-object access rules, coordination gaps, and manual detection by letting governance teams define tag-based policies once, automatically classify sensitive data, and protect matching objects across catalogs and schemas. Governed tags provide an account-level vocabulary inherited across catalogs, schemas, tables, and columns, while ABAC applies row filters and column masks using tag-based conditions. Classification uses built-in compliance classifiers, custom classifiers, metadata, pattern recognition, and large language models, with human-in-the-loop validation and false-positive exclusions. General availability adds 10x larger policy limits, support for 10,000+ policies per metastore, lifecycle management through SQL, APIs, UI, and Terraform, expanded compliance coverage, and custom classifiers in beta.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.