---
title: "ABAC: When Data Context Becomes the Access Rule"
description: "Attribute-Based Access Control uses identity and data attributes to decide access. This explainer shows how governed tags become row filters or column masks across data engines."
---

# ABAC: When Data Context Becomes the Access Rule

**Type:** [What is it?](https://yomu.fyi/visual-explainers/category/what-is-it.md)

![A central ABAC concept connects a data request, governed tags, policy evaluation, and enforcement that returns row filters or column masks across data engines.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/93e52118-cffd-47c2-8d18-e81611aa6393/image-ac529158-ea7a-409e-b753-518effde20b1.webp)

> Attribute-Based Access Control uses identity and data attributes to decide access. This explainer shows how governed tags become row filters or column masks across data engines.

## Explanation

Attribute-Based Access Control evaluates a request against policy using attributes such as the principal’s entitlements and governed metadata on data. In the diagram, governed tags feed a policy decision that produces row filters or column masks, while the catalog or trusted engine enforces the result. The model explains why tagging, classification, policy lifecycle, and audit trails matter when one rule must protect data across catalogs and engines.

## FAQ

### How does ABAC protect data for an external query engine?

The external engine sends a scan request, and the catalog evaluates entitlements and applicable policies. It returns a filtered scan plan with authorized rows or columns before the engine processes the data.

### Why use governed tags with ABAC policies?

Governed tags provide a shared vocabulary that can be inherited across catalogs, schemas, tables, and columns. ABAC policies can then apply row filters or column masks to matching data without defining each object rule separately.

### What operational risk should engineers watch for?

Policy effectiveness depends on accurate metadata and a maintained policy lifecycle. Automated classification can require human validation and false-positive exclusions, while policy and lineage records support review and auditability.

**Tags:** [Attribute-Based Access Control](https://yomu.fyi/topic/attribute-based-access-control.md), [Auditability](https://yomu.fyi/topic/auditability.md), [Data Classification](https://yomu.fyi/topic/data-classification.md), [Data Governance](https://yomu.fyi/topic/data-governance.md)

## Related reading

### [Unifying governance across engines and catalogs in the Open Lakehouse](https://yomu.fyi/post/unifying-governance-across-engines-and-catalogs-in-the-open-lakehouse.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Daniel Weeks, Ryan Blue, Andrei Tserakhau
- Published: Sep 10, 2026
- Type: Explainer

Apache Iceberg’s REST Catalog additions—read restrictions and catalog labels—address different cross-platform governance problems: delegating enforcement to trusted engines and carrying governance context across federated catalogs. Read restrictions let a catalog evaluate policy for a principal and return bounded column-projection actions and row-filter expressions that a trusted engine must enforce, while leaving trust establishment outside the protocol. Catalog labels exchange opaque key-value metadata at table and column level, allowing a consuming catalog to map classifications locally, preserve native policy expressiveness, and maintain its own audit trail. Together with centralized enforcement through Cross-Engine ABAC, they provide distinct options for direct access and catalog federation, although read restrictions cannot express policies outside their standardized vocabulary.


### [Governance beyond security: knowledge, context & ontology on the lakehouse](https://yomu.fyi/post/governance-beyond-security-knowledge-context-ontology-on-the-lakehouse.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Srikanth Mandalapu, Travis Paulson, Bernie Kuan
- Published: Sep 3, 2026
- Type: Explainer

The post argues that healthcare AI governance must extend beyond security controls to include knowledge, context, and ontology: security governs access, while semantics determine what data means and whether models can trust it. DEP frames classification tags, model cards, data contracts, and lineage as machine-readable governance artifacts, with Unity Catalog serving as the metadata runtime for agents. Build agents can generate ETL, testing, de-identification, and deployment, while analytic agents answer questions over individual data products; human stewards approve proposals and own accountability. A shared lifecycle certifies the data product and AI track through gates using scores for governance, quality, semantics, and ownership, with certification expiring after relevant changes or failures. The approach applies data-layer ABAC to SQL and vector retrieval, logs agent prompts with lineage, and connects readiness metrics to model economics by enabling smaller models when cataloged data supplies sufficient context.


### [Introducing Cross-Engine ABAC](https://yomu.fyi/post/introducing-cross-engine-abac.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Alex Jiang, Alex Reid, Michelle Leon
- Published: Jun 2, 2026
- Type: Announcement

Cross-engine ABAC is announced in Beta, extending Unity Catalog's fine-grained governance to external engines through Iceberg REST Catalog APIs. It supports tag-based row filters and column masks, including conditional logic and SQL UDFs, while allowing policies to be defined once and enforced across engines. For an external query, the engine sends a scan request, Unity Catalog evaluates entitlements and applicable policies, and returns a filtered scan plan before the engine processes authorized files. Enforcement remains at the catalog layer, so engines need not implement governance logic and can use the open scan APIs. Apache Spark is supported today through Iceberg-Spark and Delta-Spark connectors, with Starburst and DuckDB integrations coming soon; the Beta also points toward Apache Iceberg label exchange for future governance metadata sharing.


### [ABAC row filtering and column masking policies, governed tags, and data classification are now generally available in Unity Catalog](https://yomu.fyi/post/abac-row-filtering-and-column-masking-policies-governed-tags-and-data.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Adriana Ispas, Kristen Wilder, Jacqueline Li, Corey Sunwold, Menglei Sun, Viswesh Periyasamy
- Published: May 13, 2026
- Type: Announcement

Unity Catalog now generally offers three complementary data-governance capabilities: Attribute-Based Access Control (ABAC) policies for row filtering and column masking, Governed Tags, and agentic Data Classification. They address per-object access rules, coordination gaps, and manual detection by letting governance teams define tag-based policies once, automatically classify sensitive data, and protect matching objects across catalogs and schemas. Governed tags provide an account-level vocabulary inherited across catalogs, schemas, tables, and columns, while ABAC applies row filters and column masks using tag-based conditions. Classification uses built-in compliance classifiers, custom classifiers, metadata, pattern recognition, and large language models, with human-in-the-loop validation and false-positive exclusions. General availability adds 10x larger policy limits, support for 10,000+ policies per metastore, lifecycle management through SQL, APIs, UI, and Terraform, expanded compliance coverage, and custom classifiers in beta.