Databricks DE · Topic 8.4

Attribute-Based Access Control (ABAC)

Govern by attribute, not by table: tag data with governed tags, write one CREATE POLICY targeting the tag, and it applies automatically — cascading through the catalog hierarchy. This deep dive walks the verified policy DDL.

governed tagsCREATE POLICYhas_tag_valuecascades

The one-liner

ABAC = governed tags on data + policies (CREATE POLICY … ROW FILTER / COLUMN MASK) that target a tag via has_tag_value() and attach at catalog/schema/table level, applying automatically to any matching object. Define once, enforce everywhere.

🏷️ Analogy: instead of locking each cabinet (per-table masks from 8.3), you put a "CONFIDENTIAL" sticker on documents and write one rule: "mask anything tagged CONFIDENTIAL." Tag a new doc → the rule covers it instantly.

⚠️ ABAC DDL is evolving — row-filter/column-mask policies are the core offering; GRANT policies are Beta. Verify current status in the docs.

Tag a column → the policy fires automatically

▸ click "tag pii" on a column; the catalog policy masks it

ABAC policy on CATALOG prod: mask columns tagged pii unless user ∈ pii_readers

📁 catalog prod (policy attached)

📂 schema sales

📄 customers.name visibletag pii

📄 customers.ssn visibletag pii

📄 customers.email visibletag pii

Nothing tagged yet → nothing masked.

1 · Governed tags (the attributes)

Governed tags are defined at the account level with access controls (unlike ad-hoc ungoverned tags). ABAC matches on governed tags; apply them to schemas/tables/columns:

ALTER TABLE prod.sales.customers ALTER COLUMN ssn     SET TAGS ('pii' = 'ssn');
ALTER TABLE prod.sales.customers ALTER COLUMN address SET TAGS ('pii' = 'address');

2 · Column-mask policy (mask any tagged column)

CREATE FUNCTION prod.sales.redact_ssn(s STRING) RETURNS STRING
  RETURN CASE WHEN is_account_group_member('pii_readers') THEN s ELSE '***-**-****' END;

CREATE POLICY redact_ssn_policy
  ON SCHEMA prod.sales
  COLUMN MASK prod.sales.redact_ssn
  TO `account users`
  FOR TABLES
  MATCH COLUMNS has_tag_value('pii', 'ssn') AS ssn_col
  ON COLUMN ssn_col;          -- every pii=ssn column in the schema is masked

3 · Row-filter policy (hide rows by tag)

CREATE POLICY hide_eu_customers
  ON SCHEMA prod.sales
  ROW FILTER prod.sales.is_not_eu_address
  TO `account users`
  FOR TABLES
  MATCH COLUMNS has_tag_value('pii', 'address') AS addr_col
  USING COLUMNS (addr_col);   -- the filter receives the tagged column

Match with has_tag('key') / has_tag_value('key','value'), combinable with AND/OR/NOT. Scope ON CATALOG, ON SCHEMA, or ON TABLE; a higher-level policy cascades to current & future matching objects.

4 · ABAC vs per-table (8.3) — click each

Per-table (8.3)

ABAC (8.4)

Per-table row filters / column masks.

Configure each table with ALTER TABLE
New table → configure again
Fine for a few tables; doesn't scale

ABAC — by tag, hierarchical.

Define a policy once, targeting a tag
Attach at catalog/schema → cascades to matching objects
Tag a new column → auto-covered

	Per-table	ABAC
Defined	on each table	once, by tag
New table/column	configure again	auto-covered if tagged
Best for	a few tables	enterprise-wide

Why it matters

Per-table masks/filters don't scale to thousands of tables — ABAC governs by tag, hierarchically; tag a new column pii and the mask is already enforced.
"Enforce PII masking across a whole catalog?" → ABAC governed tags + policy.

🏢 Real-world use case: tag every PII column pii and set one column-mask policy on the prod catalog — every current and future pii-tagged column is masked automatically, no per-table work.

Uses, edge cases & limitations

Uses: org-wide PII masking, region/tenant row isolation by tag, consistent governance across large catalogs with minimal admin.
Edge cases: governance is only as good as your tagging — an untagged PII column won't be masked; mind policy precedence when multiple policies match.
Limitation: built on row-filter/column-mask machinery (8.3), so those perf & time-travel/CLONE constraints apply; verify feature availability (e.g. GRANT policies are Beta); ABAC DDL is still evolving.

Common gotchas

❌ Relying on ABAC while data is untagged — no tag, no protection.
❌ Re-doing per-table masks when a tag + policy covers all of them.
❌ Using ungoverned tags for policies — ABAC matches governed tags.
❌ Assuming every ABAC feature is GA — GRANT policies are Beta; confirm in docs.
❌ Ignoring policy overlap/precedence when multiple policies target an object.