Setting up tag-and-policy attribute-based access control

Attribute-based access control (ABAC) in Unity Catalog lets administrators grant access using tags applied to catalogs, schemas, tables, and columns instead of managing privileges on every individual object. Policies reference tag key-value pairs to automatically apply masking, row filtering, or access grants at scale, and they work alongside traditional Unity Catalog privilege-based (RBAC) grants. This reduces the operational overhead of applying repetitive fine-grained security controls object by object.

1 · Learn the must-know

• 1ABAC policies use governed tags (key-value pairs) assigned to securable objects such as catalogs, schemas, tables, and columns to drive access decisions.
• 2Policies can be defined at a catalog level and inherit down through schemas and tables, so tagging new objects automatically brings them under existing governance rules.
• 3ABAC can automatically apply row filters and column masks based on tag values, removing the need to hand-write and attach a masking function to every individual table or column.
• 4ABAC complements rather than replaces Unity Catalog's existing privilege-based (GRANT) access control model; both mechanisms can apply simultaneously.
• 5Creating and managing tags and ABAC policies requires sufficient Unity Catalog privileges (such as catalog ownership or metastore admin rights), consistent with other governance operations.
• 6Because policies evaluate tag values dynamically, changing or removing a tag on an object immediately changes the effective access without needing to update individual grants.

2 · Check your understanding