Attribute-Based Access Control (ABAC) in Unity Catalog: Dynamic and Scalable Governance

Modern data governance demands flexible, scalable, and contextual access controls. In environments where the volume, variety, and complexity of data grow exponentially, traditional models like RBAC (Role-Based Access Control) and ACL (Access Control List) can fall short. These approaches, based on fixed permissions, do not always adapt to changing business needs or regulatory compliance requirements.

This is where ABAC (Attribute-Based Access Control) emerges as a natural evolution. This model enables dynamic policies based on attributes, providing more granular, automated control aligned with enterprise governance rules.

Why is access control important in modern data environments?

• The growth of data and users makes managing permissions one by one unfeasible.
• Role-based or static list models do not fit dynamic contexts.
• Centralized governance, auditability, and traceability are essential for regulatory compliance and protecting sensitive information.

What is ABAC and how does it work in Unity Catalog (Databricks)?

ABAC is an access control model that allows policies to be defined based on attributes (tags) applied to data resources. In Unity Catalog, ABAC does not replace RBAC, but complements it, combining role-based control with dynamic conditions defined by attributes.

This enables policies that automatically respond to business rules, sensitivity levels, or geographic locations, without having to manually redefine permissions.

Key Concepts

• Governed tags: Attributes defined at the account level, such as sensitivity, region, business domain, classification, etc. These tags are managed through governed tag policies to ensure global consistency.
• ABAC policies: Rules applied at different hierarchical levels (catalog, schema, table) that determine access behavior based on attributes.
• Policy inheritance: Policies defined at higher levels are automatically inherited by subordinate resources, facilitating centralized governance.

ABAC Components in Unity Catalog

Governed tags

Governed tags are defined at the account level and can be assigned to catalogs, schemas, or tables. Common attribute examples:

• sensitivity: high, medium, low
• region: LATAM, EMEA, ASIA
• domain: sales, finance, human_resources

-- Synthetic example of tag assignment
ALTER TABLE customers SET TAG region = 'LATAM';

These tags allow dynamic access rules to be built based on their value.

ABAC Policies and Hierarchical Levels

Policies can be applied at different hierarchical levels:

Supported Policy Types

• Row filter
• Column mask

Allows users to see only rows that meet certain attributes. For example, show only transactions belonging to the user’s region: sql CREATE ROW FILTER POLICY region_filter AS (region = CURRENT_USER_REGION());

Allows values in a column to be shown or masked based on attributes or context. For example, hide the phone number if sensitivity is high: sql CREATE COLUMN MASK POLICY mask_phone AS (CASE WHEN sensitivity = 'high' THEN NULL ELSE phone_number END);

Using UDFs in Policies

User-defined functions (UDFs) allow custom logic to be included within ABAC policies. This makes it easier to create complex conditions or adapt to business logic:

CREATE FUNCTION CURRENT_USER_REGION() RETURNS STRING;

Dynamic Evaluation and Policy Application

When a user runs a query, the system evaluates:

• The tags assigned to the resource (e.g., region = ‘LATAM’)
• Applicable ABAC policies
• User or context attributes

Based on this, Unity Catalog grants, denies, or filters the results.

Advantages and Typical Use Cases

🔗 Scalability

Allows access management for large volumes of data and users without defining permissions individually. Attribute-based policies are automatically applied according to business rules, facilitating administration in complex and growing environments.

🛠️ Flexibility

Tags and policies can be modified centrally, allowing access control to adapt to organizational changes, regulations, or business requirements without manually reconfiguring each resource.

🏛️ Centralized governance

Policies and tags are managed hierarchically and inherited, ensuring consistency and compliance throughout the data ecosystem, from the catalog to individual tables.

🛡️ Enhanced security

Access control becomes more granular and contextual, allowing sensitive data to be protected according to attributes such as region, sensitivity level, or user role, and responding dynamically to risk scenarios.

📋 Auditability

All accesses and actions are recorded in audit logs, facilitating traceability, regulatory compliance, and investigation of security incidents.

Practical Example

Imagine a company with customer data separated by region (Latin America, EMEA, Asia). You can define a region tag and a policy that only shows data according to the user’s region:

ALTER TABLE customers SET TAG region = 'LATAM';
CREATE ROW FILTER POLICY region_filter AS (region = CURRENT_USER_REGION());

Or, using sensitivity:

ALTER TABLE customers SET TAG sensitivity = 'high';
CREATE COLUMN MASK POLICY mask_phone
AS (CASE WHEN sensitivity = 'high' THEN NULL ELSE phone_number END);

Limitations and Considerations (beta version)

How to Configure ABAC

1. Create governed tags
2. Assign tags to resources (catalog, schema, table)
3. Define row filter / column mask policies
4. Include UDFs if custom logic is required
5. Perform testing and validation
6. Check audit logs
7. Manage inheritance and exceptions

-- Synthetic configuration example
CREATE TAG region;
ALTER TABLE customers SET TAG region = 'LATAM';
CREATE ROW FILTER POLICY region_filter AS (region = CURRENT_USER_REGION());

Best Practices and Recommendations

• Apply policies at higher levels (catalog or schema) to avoid redundancy.
• Design tags with consistent nomenclature and clear taxonomies.
• Test in controlled environments before production.
• Maintain active monitoring and auditing for traceability.
• Plan exception handling and periodically review policies and tags.

Conclusion

ABAC represents a qualitative leap in data governance: it brings flexibility, scalability, and context to access policies. By integrating with Unity Catalog, it allows organizations to define dynamic controls aligned with their business and compliance needs, without increasing administrative complexity.

Resources

• Official ABAC documentation in Unity Catalog (Databricks AWS)
• Microsoft Learn: ABAC in Databricks (Spanish)