An access-control approach in Unity Catalog where governed tags determine what a policy covers. A single policy set on a metastore, catalog, schema or table can therefore filter rows, mask columns, or grant or deny access across many objects at once.
Also called attribute-based access control.
Read more: Databricks docs
In the Ultra Transcenders books
Each book explains ABAC in context, with comparison tables and the common traps.
Terms in this definition
- Unity Catalog
Azure Databricks' governance solution covering both data and AI in one place, with centralised permissions, auditing, data discovery and lineage.
- WHERE
Limits a SELECT, UPDATE or DELETE to just the rows meeting a condition. Omit it, and the statement hits every row.
- Governed tags
Tags defined at account level and controlled by a tag policy that sets permitted values and who can apply them. Catalogs and schemas pass them down to child objects (columns do not inherit them), and ABAC policies use them as the attributes to match.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- Set
Secret permission in Key Vault for writing secrets; some older material refers to it as Create.
- Metastore
The highest-level Unity Catalog container, holding metadata and permissions for a single cloud region. Each region has only one, which every workspace in that region shares, and it is not meant to be the usual boundary for isolating data.
- Catalog
The first level of Unity Catalog's
catalog.schema.tablenaming and the primary boundary for isolating data. Privileges granted on a catalog flow down to every schema and object it contains. - Schema
The middle part of a Unity Catalog name (
catalog.schema.table), grouping tables, views, volumes, functions and models inside a catalog. A grant on it covers everything in it now and later, and nothing inside can be reached withoutUSE SCHEMA.
Related terms
- ABAC separation of duties
A way of dividing ABAC work between groups: one group owns the governed tag taxonomy, stewards tag the data, and governance admins author the policies. People creating data then have no access-control configuration to do themselves.
- AKS-ACR integration
Running az aks create or az aks update with --attach-acr grants AcrPull to a cluster's kubelet managed identity, letting nodes fetch images with no pull secrets. Registries using ABAC can't use this; grant Container Registry Repository Reader manually there.
- Blob index tags
Indexed, searchable key-value attributes set on blobs, which lifecycle rules can filter on via
blobIndexMatchand ABAC conditions can use; filtering by them isn't possible with a SAS. - Container Registry Repository Reader
A role for ACR registries with ABAC enabled that allows pulling and reading images, tags and metadata across the registry or only for repositories picked by ABAC conditions. It plays the part of AcrPull in ABAC mode but can't list the catalogue.
- Control tag pattern
An ABAC approach that hides all columns in new tables until someone has reviewed them. A governed tag called
review_statuson the schema begins aspending, and a policy applies masking while that value remains. - CREATE POLICY
Attaches a named policy to a securable, stating who it affects and which tag conditions trigger it. The policy can be a column mask, a row filter, or an ABAC
DENYorGRANT. - Delegated role assignment management with conditions
Sometimes called constrained delegation: someone gets a role that can write role assignments, such as Role Based Access Control Administrator, but an ABAC condition limits what they may hand out or take away, by role, by type of principal or by specific principal.
- Fail-closed
An approach that blocks access whenever enforcement can't be assured. For instance, unless a principal is exempt, compute below Databricks Runtime 16.4 can't read tables secured by ABAC.