Attribute-based access control for data lakes

Summary

• ABAC governs a data lake by attaching access policies to governed tags instead of to individual tables, so one rule (for example, mask every column tagged PII) applies automatically to all matching tables, including ones created later.
• The four policy types are row filters, column masks, GRANT policies, and DENY policies (Beta); together they decide which rows and columns a user sees and which privileges they hold, all keyed off tags.
• Policies are evaluated at query time against the identity of the person running the query, inside the SQL engine, so no application or API path can route around them.
• On Databricks, ABAC is part of Unity Catalog and reached general availability in April 2026; automatic data classification can tag sensitive data so policies protect it without manual tagging.
• Because enforcement is at the catalog layer, the same tag-based policies can extend to outside engines that read open lakehouse tables through the Iceberg REST Catalog (Beta).

Attribute-based access control for data lakes

A data lake stores huge volumes of data in open formats on cheap cloud storage, but most lakes were built for scale first and fine-grained access control second. Attribute-based access control (ABAC) closes that gap. Instead of granting or filtering access on each table one at a time, you attach policies to attributes, expressed as governed tags, and every policy applies automatically wherever its tag appears. Tag a column pii once and a masking rule covers it across thousands of tables, including ones created tomorrow. Access rules then scale with the lake, and because they run at the query engine, nothing routes around them.

What is attribute-based access control?

ABAC computes access decisions from attributes rather than from static, per-object grants. In a lakehouse those attributes are governed tags applied to catalogs, schemas, tables, columns, materialized views, and streaming tables to capture sensitivity, region, or business domain. A single rule, say "mask any column tagged pii for anyone outside the compliance group," then governs every matching object at once. Role-based access control (RBAC) answers "who may open this table"; ABAC answers "what data inside it can this person see, given how it is classified." Most teams use both.

Key capabilities to evaluate

Capability	Why it matters
Tag-driven policies	One policy bound to a tag applies to every object carrying that tag, so you stop editing permissions table by table.
Row filtering	Returns only the rows a user's attributes permit, such as their own region or business unit, from a shared table.
Column masking	Redacts, hashes, or nulls sensitive fields at read time unless the user meets the policy's condition.
Dynamic GRANT and DENY	Grants or denies privileges based on tags such as classification or approval state; an explicit deny always wins.
Query-time enforcement	Policies evaluate inside the SQL engine using the caller's identity, so views, notebooks, and BI tools get the same governed answer.
Cross-engine reach	Policies enforced at the catalog layer can extend to outside engines reading the same open tables.

How Databricks approaches ABAC for data lakes

On Databricks, ABAC is built into Unity Catalog, the governance layer for the lakehouse. You define governed tags, attach row-filter, column-mask, GRANT, or DENY policies to them at the catalog, schema, or table level, and Unity Catalog evaluates those policies at query time. Because policies key off tags rather than object names, a new table inherits the right controls the moment it is tagged, with no per-table setup. Data classification can tag sensitive columns automatically, so protection does not wait on manual curation.
Enforcement uses the caller's identity and runs at the SQL engine on Standard or Dedicated access mode compute, so views, functions, notebooks, and BI clients all resolve to the same result. ABAC reached general availability in April 2026, a release that moved row-filter and column-mask evaluation to the querying user's identity. DENY policies are in Beta. Because Unity Catalog governs open Delta and Iceberg tables, the same policies can extend to external engines that read those tables through the Iceberg REST Catalog (in Beta), so governance follows the data rather than the tool.
See attribute-based access control in Unity Catalog, the core concepts, and when to use each access control mechanism. The blog on scaling data governance with ABAC covers tag design.

Use cases

Regulated data in financial services and healthcare. Tag account numbers, medical record identifiers, and similar fields once; column masks then hide them from every analyst and agent that is not explicitly cleared, across all tables that hold them.
Data residency. Tag tables by region and attach row filters so users in one country see only the records permitted there, without splitting the lake into separate copies.
Multi-tenant platforms. A provider serving many customers tags rows by tenant and lets row filters isolate each tenant's data automatically, enforced at query time rather than in application code.

FAQs

How is ABAC different from row filters and column masks set per table?

Per-table filters and masks still exist and suit one-off logic. ABAC lets you write the rule once against a tag so it covers every current and future object carrying that tag. Databricks recommends ABAC to centralize and scale controls, and reserves per-table policies for narrow cases.

Does ABAC work for data read by engines outside Databricks?

Unity Catalog enforces policies at the catalog layer, and support for external engines reading open tables through the Iceberg REST Catalog is in Beta. Enforcement happens before data reaches the engine, so outside readers receive only authorized rows and columns.

Does ABAC slow down queries?

Policies are evaluated as part of normal query authorization inside the engine, so the overhead is in line with standard access control. No separate service sits in the request path.

Is ABAC generally available on Databricks?

Yes. ABAC in Unity Catalog became generally available in April 2026, including row filters, column masks, and GRANT policies. DENY policies and cross-engine enforcement are in Beta.