ABAC DENY Policies in Databricks Unity Catalog

ABAC DENY policies in Unity Catalog let you explicitly deny access management privileges to users, groups, or service principals based on tag conditions. They always take precedence over any granted permissions.

Use cases

Imagine you need to prevent regular users from altering permissions on tables tagged as sensitive, ensuring only the security team holds that power. With these policies, you can:

• Block granting and revoking privileges on tables, schemas, or catalogs.
• Prevent object ownership changes.
• Block the management of ABAC policies, row filters, and column masks.

How to use

You can create a DENY policy using SQL statements on a classic compute resource running Databricks Runtime 18 or above.

CREATE POLICY deny_manage_access_control_sensitive_tables
ON CATALOG catalog_a
COMMENT 'Prevent non-admins from managing permissions on sensitive tables'
TO `account users`
EXCEPT `data_admins`
DENY MANAGE ACCESS CONTROL
FOR TABLES
WHEN has_tag('sensitive');

What happens in this code:

1. The CREATE POLICY statement defines a new denial rule named deny_manage_access_control_sensitive_tables attached to catalog_a.
2. The TO clause applies the restriction to all account users, excluding the data_admins group.
3. The DENY MANAGE ACCESS CONTROL FOR TABLES command blocks permission management capabilities specifically on tables.
4. The WHEN has_tag('sensitive') condition restricts the scope only to objects carrying the sensitive tag.

Limitations and requirements

• This feature is in Beta.
• Requires a classic compute resource running Databricks Runtime 18 LTS or above for SQL execution.
• Only the MANAGE ACCESS CONTROL privilege is currently supported.
• Metastore admins are always implicitly exempt.