Applying row filters and column masks

Row filters and column masks let you enforce fine-grained, table-level security in Unity Catalog by attaching SQL user-defined functions (UDFs) to tables that dynamically filter rows or redact column values based on the querying user's identity or group membership. They are defined once at the table level and are automatically enforced across all compute (SQL warehouses, notebooks, jobs) without needing per-query logic.

1 · Learn the must-know

• 1Row filters and column masks are implemented as SQL functions (UDFs) registered in Unity Catalog before being attached to a table with ALTER TABLE ... SET ROW FILTER or ALTER COLUMN ... SET MASK.
• 2A row filter function must accept the relevant table columns as parameters and return a BOOLEAN indicating whether the row is visible to the current user.
• 3A column mask function must accept the column (and optionally other columns for conditional logic) and return a value of the same data type, typically using functions like is_account_group_member() or current_user() to decide whether to redact or transform the value.
• 4A single table can have one row filter and multiple column masks (one per column) applied simultaneously, and both are enforced consistently regardless of the compute engine or client used to query the table.
• 5The user applying or altering a row filter/column mask needs sufficient privileges (typically table ownership or ALTER privilege) plus EXECUTE privilege on the underlying function, and the function must reside in a catalog/schema accessible to all who query the table.
• 6Row filters and column masks can be removed with ALTER TABLE ... DROP ROW FILTER or ALTER COLUMN ... DROP MASK, and changes take effect immediately for subsequent queries without needing to rewrite the underlying data.

2 · Check your understanding