How do I implement attribute-based access control (ABAC) for data and AI?

Summary

• ABAC uses governed tags on data assets to enforce fine-grained access controls automatically across catalogs, schemas, and tables without per-object configuration.
• Unity Catalog supports four policy types: row filters, column masks, GRANT policies, and DENY policies, all evaluated using tags and user-defined functions.
• Session identity evaluation ensures users see exactly what their own permissions allow, even when querying through views or functions.
• ABAC scales to 10,000+ policies per metastore and complements role-based access control for both identity and fine-grained data protection.
• Data Classification automatically identifies sensitive columns (PII, SSNs, phone numbers) and tags them to trigger masking policies.

How do I implement attribute-based access control (ABAC) for data and AI?

ABAC delegates access decisions to policies evaluated against attributes on data assets, typically tags, rather than managing permissions per object. Define governed tags, tag your data, create user-defined functions for filtering or masking logic, and attach policies to catalogs or schemas. Once active, policies apply automatically to all current and future matching assets.

What is ABAC?

Attribute-based access control evaluates policies against attributes associated with securable objects to make dynamic access decisions. Rather than configuring permissions object-by-object, you apply a tag (e.g., "HR", "PII", "region=EU") to data assets and write a policy that says "if table has tag X, mask column Y for users not in group Z." The policy then enforces that rule across all matching tables, current and future.

Key capabilities to evaluate

Capability	Why it matters
Governed tags (standardized, account-level)	Ensures consistent classification across all teams and workspaces
Row filter policies	Restrict rows users can see based on tag conditions
Column mask policies	Control how column values appear (e.g., masking PII)
GRANT and DENY policies	Dynamically grant or deny privileges based on tag attributes
Session identity evaluation	Users see what their permissions allow, not the object owner's permissions
Automatic Data Classification	AI identifies sensitive columns (email, SSN, phone) and auto-tags them
Enterprise scalability	Supports 10,000+ policies per metastore with policy inheritance

How Databricks approaches ABAC

Unity Catalog ABAC has four components:
Governed Tags: Account-level tags classify data assets (by sensitivity, region, business domain, or regulatory status). Assign tags manually or use automatic Data Classification, which uses AI to identify sensitive columns like email addresses or social security numbers.
Policies: Rules that specify who can access what data under what conditions. A single policy at the catalog or schema level applies automatically to all matching objects without per-table configuration. ABAC offers four policy types:

• Row Filter Policies: Restrict which rows a user can see based on tag conditions and custom logic.
• Column Mask Policies: Control how column values are presented (e.g., masking all PII columns as "***").
• GRANT Policies: Dynamically grant privileges when conditions match.
• DENY Policies (Beta): Explicitly deny privileges when conditions match.

User-Defined Functions (UDFs): Logic that implements filtering or masking behavior, referenced by policies.
Here is a practical example:

CREATE FUNCTION mask_pii(val STRING) RETURNS STRING
  RETURN '***';

CREATE POLICY mask_pii_for_hr
ON CATALOG catalog_a
COLUMN MASK mask_pii
TO `account users` EXCEPT `HR admins`
FOR TABLES
WHEN has_tag('HR')
MATCH COLUMNS has_tag('PII') AS pii_col
ON COLUMN pii_col;

This policy automatically masks all columns tagged with 'PII' in tables tagged with 'HR', except for HR administrators. See the ABAC documentation for detailed setup.

Implementation steps

1. Define governed tags at the account level to standardize classification.
2. Tag data assets manually or use automatic Data Classification.
3. Create UDFs that implement filtering or masking logic.
4. Create policies at the appropriate scope (catalog, schema, or table).
5. Access governed objects. Policies evaluate automatically when users query data.

ABAC vs. role-based access control

ABAC and role-based access control (RBAC) serve different purposes. RBAC controls which identity a user acts as; ABAC controls what data that identity can see. Together, they enable both identity management and fine-grained data protection at scale. A sales analyst has an RBAC role ("Sales Analyst") and ABAC policies restrict their view to "region=US" rows.

Use cases

PII masking: Mask email and phone numbers for non-governance users; unmask for authorized personnel.
Multi-region compliance: Tag by region and enforce GDPR by restricting non-EU users from EU data.
Slowly changing dimensions: Show current versions to all users; grant historical access only to analysts.

FAQs

Does ABAC replace role-based access control?

No. RBAC controls identity; ABAC controls data visibility. Use both together.

Can ABAC policies apply across multiple catalogs?

Yes. You can define policies at the account level that apply across catalogs, or scope policies to individual catalogs or schemas.

Does Data Classification require machine learning?

Yes. Databricks' Data Classification uses AI to scan columns and identify sensitive data like emails and social security numbers.

Can I use ABAC with Delta Sharing?

Yes. Data providers can share ABAC-governed tables directly with recipients.