how data platform teams reduce time spent on access requests

Summary

• The fastest way to cut access-request toil is to stop granting access table by table. Govern with attributes and groups so a rule written once applies to many datasets, including ones created later.
• In Unity Catalog, attribute-based access control (ABAC) uses governed tags and policies to grant, filter, or mask data by attribute, so a new table that carries a tag is covered the moment it exists, with no new request.
• Account-level groups tie access to roles and teams, so onboarding a person is a single group change rather than a stack of individual grants.
• Automatic data classification tags sensitive data such as PII so masking and filtering policies protect it without someone tagging each column by hand.
• Self-service access requests handle the exceptions: users find data and request access in-product, routed to the owner for approval, so the exchange stays fast and on the record.

how data platform teams reduce time spent on access requests

The fastest way to cut access-request toil is to stop granting access one table at a time. Data platform teams reduce the hours they spend on access requests by governing with attributes and groups instead of one-off grants: they tag data once, write a policy that applies to everything carrying that tag, and let group membership decide who sees what. A new table that matches a policy is covered the moment it is created, so the ticket backlog shrinks on its own. In Unity Catalog, attribute-based access control (ABAC), governed tags, and account-level groups turn most access management into policy that maintains itself, and a self-service request flow handles the exceptions.

Why access requests pile up

Manual access control scales badly. When every table needs its own grant and every new hire needs many of them, the platform team becomes a ticket queue, requests wait on a person, and permissions drift out of step with reality. The fix is to remove most of the tickets: express access as rules tied to data attributes and user groups, so a grant is written once and applies broadly, and new data inherits the right protection automatically.

What to look for

Capability	Why it matters
Attribute-based policies	Grant, filter, or mask by a data attribute so one rule covers many tables, including ones created later.
Group-based access	Tie permissions to roles and teams, so onboarding is one group change, not many grants.
Inherited, hierarchical rules	Policies set at the catalog or schema level flow down, so you configure once, not per table.
Automatic sensitive-data tagging	Classify PII and other sensitive data so protection applies without manual tagging.
Self-service requests with routing	Let users find data and request access in-product, routed to the right owner for approval.
Central, override-proof policy	Platform admins set rules that lower-level admins cannot quietly loosen.
Audit and lineage	Show who can access what, and why, without assembling it by hand.

How Databricks approaches this with Unity Catalog

• Attribute-based access control. ABAC uses governed tags and policies to grant, filter, or mask by attribute rather than per object. One policy can mask every column tagged as PII across a schema or catalog, or filter rows by a user attribute such as region. Because policies match tags, a new table that carries the tag is covered automatically, with no new request. ABAC is generally available on AWS and GCP. See Attribute-based access control in Unity Catalog.
• Governed tags and inheritance. Tags are the attributes policies match on, and a policy set at the catalog or schema level inherits down the hierarchy, so you write a rule once instead of table by table.
• Account-level groups. Grant to a role or team once, then adding or removing a person is a single group change that updates their access everywhere, which is what makes onboarding and role changes cheap.
• Automatic data classification. Data classification scans catalogs and tags sensitive data such as PII, so ABAC policies protect it without someone tagging each column by hand. This is a newer capability, so confirm its current availability for your cloud.
• Self-service access requests. When a grant is still needed, Unity Catalog lets users discover data and request access in-product, and routes the request to the data owner (by email, chat, or a webhook) for approval, so the exchange does not live in a separate ticket system. See Access requests in Unity Catalog.

Set policy centrally so it cannot be overridden by a lower-level admin, and access stays consistent as the platform grows.

Use cases

Onboarding and role changes. Map access to groups so a new analyst gets the right data by joining a group and loses it by leaving, with no stream of individual grants.
Protecting sensitive columns at scale. Tag PII once and let a single masking policy cover every current and future table that carries the tag, instead of editing tables individually.
Regulated self-service. Give analysts a governed way to find and request data, with owner approval and a full audit trail, so access speeds up without loosening control.

FAQs

What is attribute-based access control (ABAC)?

ABAC grants, filters, or masks data based on attributes, expressed as governed tags, rather than by writing a permission for each object. You define a policy once, and it applies to every object that carries the matching tag, including objects created later.

How is ABAC different from role-based grants?

Role-based grants assign privileges to principals object by object. ABAC attaches rules to data attributes, so one policy governs many objects at once and keeps covering new ones. The two work together: groups decide who a policy applies to, and tags decide which data it covers.

Do we still need an access-request process?

Yes, for the cases a policy does not cover. Unity Catalog's self-service access requests let users request access in-product and route it to the data owner for approval, which keeps those exceptions fast and auditable.

Is ABAC available on every cloud?

ABAC is generally available on AWS and GCP. Availability differs by cloud, so check the current status for your platform before you build policies on it.