Attribute-based access control (ABAC)
Attribute-based access control (ABAC) is a Databricks data governance capability, introduced June 2025.
Unity Catalog access-control model that grants or restricts access by evaluating governed tags (attributes) on securables, so one policy on a catalog or schema applies to everything beneath it.
- Tag a column 'pii' once and a single catalog-level policy masks it everywhere beneath - no more re-granting access table by table.
- The same tag-driven policies do both row filtering and column masking, on tables, materialized views, and streaming tables alike.
- Its GRANT policies hand out privileges to whatever matches a tag condition instead of object by object, and in August 2026 that grew from models alone to model services, MCP services, and agent services.
Limitations: Needs serverless compute or Databricks Runtime 16.4 and above, and only governed tags count; policies can't be applied directly to views, though they are still enforced when a view reads a protected table; quotas apply (10,000 policies per metastore, 100 per catalog or schema, 50 per table, 20 principals per policy); time travel queries and deep or shallow clones fail on policy-protected tables unless the principal is exempted; and AI Search indexes don't enforce row filters or column masks.
Open in REbricked →- Category
- Data governance
- Also known as
- ABAC, attribute-based access control
- Verified
- 2026-08-20