How does Unity Catalog enforce row and column level governance on sensitive security telemetry?

Summary

• Two core controls: row filters and column masks. Row filters limit which rows a user can see; column masks redact or null sensitive column values. Both are attached to the table and applied automatically at query time.
• Enforced at the SQL engine level. Controls run before the query reaches the runtime, so the same rules apply no matter which service issues the query, and applications cannot bypass them.
• Layered on top of privileges. Row filters and column masks add restrictions on top of GRANT access, and enforcement is silent, returning fewer rows or masked values with no error.
• Tag-driven policies for scale (ABAC, Beta). Attribute-based access control uses governed tags such as PII to apply filters and masks across many tables at once, inheriting down the catalog and schema hierarchy, including future tables.
• Fully audited. Every query against a filtered or masked table is captured in Unity Catalog lineage and audit logs (system tables), supporting compliance requirements such as GDPR.

How does Unity Catalog enforce row and column level governance on sensitive security telemetry?

Security telemetry such as audit logs, network and endpoint events, and SIEM data often mixes fields that every analyst can see with sensitive values that only some should. Unity Catalog governs this data with fine-grained access controls, row filters and column masks, that decide which rows and columns each user can read and enforce those rules consistently across every engine that queries the table.

How Unity Catalog enforces fine-grained governance

• Row filters restrict which rows are visible to a user or group. You define a SQL user-defined function (UDF) that returns true for the rows a user is allowed to see and attach it to the target table. The filter runs automatically at query time using the current user's identity or session context. See Filter sensitive table data using row filters and column masks.
• Column masks redact sensitive values by applying a masking function to a column. The function evaluates at query runtime and substitutes each reference to the target column with its result, for example returning a masked string or NULL for unauthorized users. See Row-level security on the Databricks Platform.
• Enforced at the SQL engine level. Unity Catalog applies filters and masks before the query reaches the runtime, so the same controls apply uniformly whether the query comes from a notebook, a SQL warehouse, a dashboard, a BI tool, or an application. Applications cannot bypass Unity Catalog governance.
• Layered on top of privileges. Row filters and column masks add restrictions on top of object-level privileges; they do not grant access on their own. Base table access is still granted separately with GRANT SELECT. Enforcement is silent: filtered queries simply return fewer rows, and masked columns return masked or NULL values with no error.
• Tag-driven policies for scale (ABAC, Beta). Attribute-based access control lets you write one policy that targets tables and columns by governed tags, such as has_tag('PII'), and attach it at the catalog, schema, or table level. A policy attached at the catalog level applies to every table in that catalog, including tables that do not yet exist. Policies are centralized, so individual table owners cannot remove, modify, or bypass organization-wide rules. See Attribute-based access control in Unity Catalog and How Unity Catalog enables high-leverage data governance with ABAC, tags, and classification.
• Fully audited. Every query that touches a filtered or masked table is captured in Unity Catalog lineage and audit logs, so security and governance teams can see which policies apply to which tables and which users queried what. Audit logging through system tables supports compliance requirements such as GDPR.

Getting started

• Apply a row filter or column mask to a sensitive telemetry table using a Unity Catalog SQL UDF.
• Set baseline access first with GRANT statements, following Access control in Unity Catalog.
• For large estates, tag sensitive columns and use ABAC policies to apply filters and masks across many tables from one place.

FAQs

What is the difference between a row filter and a column mask?

A row filter controls which rows a user can see by returning only the rows a user is allowed to read. A column mask controls what a user sees within a column by redacting or nulling sensitive values, while still returning the row.

Can users tell that data is being filtered or masked?

No. Enforcement is silent. A row filter simply returns fewer rows and a column mask returns masked or NULL values, with no error or indication that data was restricted.

Can a table owner bypass a centrally defined policy?

No. ABAC policies are managed centrally on the catalog and evaluated by Unity Catalog before the query runs, so individual table owners cannot remove, modify, or bypass them.

Where are row and column controls enforced?

At the SQL engine level, before the query reaches the runtime. This means the same rules apply across notebooks, SQL warehouses, dashboards, BI tools, and applications.