Attribute-Based Access Control uses identity and data attributes to decide access. This explainer shows how governed tags become row filters or column masks across data engines.
Attribute-Based Access Control evaluates a request against policy using attributes such as the principal’s entitlements and governed metadata on data. In the diagram, governed tags feed a policy decision that produces row filters or column masks, while the catalog or trusted engine enforces the result. The model explains why tagging, classification, policy lifecycle, and audit trails matter when one rule must protect data across catalogs and engines.
The external engine sends a scan request, and the catalog evaluates entitlements and applicable policies. It returns a filtered scan plan with authorized rows or columns before the engine processes the data.
Governed tags provide a shared vocabulary that can be inherited across catalogs, schemas, tables, and columns. ABAC policies can then apply row filters or column masks to matching data without defining each object rule separately.
Policy effectiveness depends on accurate metadata and a maintained policy lifecycle. Automated classification can require human validation and false-positive exclusions, while policy and lineage records support review and auditability.
The posts behind it
Databricks · · ExplainerApache Iceberg’s REST Catalog additions—read restrictions and catalog labels—address different cross-platform governance problems: delegating enforcement to trusted engines and carrying governance context across federated catalogs. Read restrictions let a catalog evaluate policy for a principal and return bounded column-projection actions and row-filter expressions that a trusted engine must enforce, while leaving trust establishment outside the protocol. Catalog labels exchange opaque key-value metadata at table and column level, allowing a consuming catalog to map classifications locally, preserve native policy expressiveness, and maintain its own audit trail. Together with centralized enforcement through Cross-Engine ABAC, they provide distinct options for direct access and catalog federation, although read restrictions cannot express policies outside their standardized vocabulary.
Databricks · · ExplainerThe post argues that healthcare AI governance must extend beyond security controls to include knowledge, context, and ontology: security governs access, while semantics determine what data means and whether models can trust it. DEP frames classification tags, model cards, data contracts, and lineage as machine-readable governance artifacts, with Unity Catalog serving as the metadata runtime for agents. Build agents can generate ETL, testing, de-identification, and deployment, while analytic agents answer questions over individual data products; human stewards approve proposals and own accountability. A shared lifecycle certifies the data product and AI track through gates using scores for governance, quality, semantics, and ownership, with certification expiring after relevant changes or failures. The approach applies data-layer ABAC to SQL and vector retrieval, logs agent prompts with lineage, and connects readiness metrics to model economics by enabling smaller models when cataloged data supplies sufficient context.
Databricks · · AnnouncementCross-engine ABAC is announced in Beta, extending Unity Catalog's fine-grained governance to external engines through Iceberg REST Catalog APIs. It supports tag-based row filters and column masks, including conditional logic and SQL UDFs, while allowing policies to be defined once and enforced across engines. For an external query, the engine sends a scan request, Unity Catalog evaluates entitlements and applicable policies, and returns a filtered scan plan before the engine processes authorized files. Enforcement remains at the catalog layer, so engines need not implement governance logic and can use the open scan APIs. Apache Spark is supported today through Iceberg-Spark and Delta-Spark connectors, with Starburst and DuckDB integrations coming soon; the Beta also points toward Apache Iceberg label exchange for future governance metadata sharing.
Databricks · · AnnouncementUnity Catalog now generally offers three complementary data-governance capabilities: Attribute-Based Access Control (ABAC) policies for row filtering and column masking, Governed Tags, and agentic Data Classification. They address per-object access rules, coordination gaps, and manual detection by letting governance teams define tag-based policies once, automatically classify sensitive data, and protect matching objects across catalogs and schemas. Governed tags provide an account-level vocabulary inherited across catalogs, schemas, tables, and columns, while ABAC applies row filters and column masks using tag-based conditions. Classification uses built-in compliance classifiers, custom classifiers, metadata, pattern recognition, and large language models, with human-in-the-loop validation and false-positive exclusions. General availability adds 10x larger policy limits, support for 10,000+ policies per metastore, lifecycle management through SQL, APIs, UI, and Terraform, expanded compliance coverage, and custom classifiers in beta.
More like this
A car rental is a search layer over many fleets plus a contract enforced at the counter. This explainer maps its four parts and why the advertised daily rate never equals the total cost.
An app store is a distribution surface, a versioned contract, and a health loop between a platform and its developers. Here is how those parts fit together and why each one fails loudly if ignored.
A GPU-resident astronomy pipeline keeps every stage of image analysis — load, align, subtract, detect, review — inside GPU memory instead of round-tripping through the CPU.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
