ABAC, Masking, and Cross-Engine Governance

The privilege migration matrix and tag compression from the last section get you group-based grants at the catalog and schema level; this section adds the finer-grained layer those grants alone can’t express – who sees which rows, which columns are masked, and what happens the instant a query comes from an engine that isn’t Databricks at all. ABAC turns row filters and column masks from a per-table chore into a tag-driven policy that follows every current and future object automatically, which is the difference between governance that survives six months of schema drift and governance that quietly rots. The section closes on the piece most migrations underestimate: proving that masking and filtering still hold when a partner’s Snowflake account or a Trino cluster reads the same Unity Catalog data through Delta Sharing or the Iceberg REST catalog.

flowchart LR
    subgraph Tags["Governed Tags (account-level)"]
        T1["domain=finance"]
        T2["pii=true"]
        T3["tier=restricted"]
    end

    subgraph Policy["ABAC Policies"]
        RF["Row filter policy"]
        CM["Column mask policy"]
    end

    subgraph Objects["Unity Catalog Objects"]
        SCH[Schema] --> TBL1[Table]
        SCH --> TBL2[Table added later]
    end

    T1 & T3 -->|has_tag_value| RF
    T2 -->|has_tag_value| CM
    RF -.enforced on.-> TBL1
    RF -.enforced on.-> TBL2
    CM -.enforced on.-> TBL1
    CM -.enforced on.-> TBL2

    TBL1 & TBL2 --> CV[Credential Vending]
    CV --> DS["Delta Sharing<br/>(external orgs, any platform)"]
    CV --> IC["Iceberg REST Catalog<br/>(Trino, Snowflake, PyIceberg)"]

Lectures

#	Lecture	Est. Read
1	ABAC With Governed Tags: Tag at Schema, Not Table	3 min read
2	Dynamic Views and Row-Level Security	2 min read
3	Tag-Based PII Masking	2 min read
4	Cross-Engine Access: Delta Sharing, Iceberg, Credential Vending	3 min read
5	The ABAC Tag Taxonomy and Masking Policy Pack	3 min read
6	Check Your Knowledge	Quiz

---

| ← Previous: Check Your Knowledge | Next: ABAC With Governed Tags: Tag at Schema, Not Table → | |:—|—:|

---

Table of contents

• ABAC With Governed Tags: Tag at Schema, Not Table
• Dynamic Views and Row-Level Security
• Tag-Based PII Masking
• Cross-Engine Access: Delta Sharing, Iceberg, Credential Vending
• The ABAC Tag Taxonomy and Masking Policy Pack
• Check Your Knowledge