Attribute-based access control (ABAC)

Attribute-based access control (ABAC) is a Databricks data governance capability, introduced May 2026.

Unity Catalog access-control model that grants or restricts access by evaluating governed tags (attributes) on securables, so one policy on a catalog or schema applies to everything beneath it.

• Tag a column 'pii' once and a single catalog-level policy masks it everywhere beneath - no more re-granting access table by table. 🔗
• The same tag-driven policies do both row filtering and column masking, and tag-based GRANT policies arrived in Beta in June 2026. 🔗

⚠ Limitations: Requires serverless compute or Databricks Runtime 16.4+ and uses governed tags; policies can't be applied directly to views; quotas apply (e.g. 10000 policies per metastore, 50 per table, 20 principals per policy); time travel and cloning fail on policy-protected tables unless the principal is exempted; and there's no ABAC information schema (use the REST API). 🔗

Category

Data governance

Introduced

May 2026🔗

Announced at

GA May 2026🔗

Also known as

ABAC, attribute-based access control

Verified

2026-07-18