Metastore-level ABAC policies in Unity Catalog

Attribute-based access control (ABAC) policies in Unity Catalog can now be attached directly at the metastore level. This allows governance teams to define organization-wide data protection rules that automatically apply across every catalog and future catalogs.

Use cases

Imagine you need to mask social security numbers in any table across the organization with a specific tag, without manually configuring the rule in each catalog.

• Apply row filters or column masks globally.
• Define organization-wide GRANT and DENY policies.
• Ensure new catalogs automatically inherit data protection rules.

How to use

You can create a metastore-level policy using Catalog Explorer, the REST API, or SQL statements run on compute running Databricks Runtime 19 or above.

CREATE POLICY ssn_mask
ON METASTORE
COLUMN MASK ssn_to_last_nr
TO `account users` EXCEPT `HR admins`
FOR TABLES
MATCH COLUMNS has_tag('ssn') AS ssn
ON COLUMN ssn
USING COLUMNS (4);

What happens in this code:

1. The CREATE POLICY statement defines a new security rule.
2. The ON METASTORE modifier scopes the rule to the highest level of the hierarchy.
3. The MATCH COLUMNS clause uses a tag function to identify sensitive columns.
4. The mask hides data for all users except the HR admins group.

Limitations and requirements

• This feature is in Beta.
• Requires compute running Databricks Runtime 19 or above for SQL operations.
• Only metastore admins can create, update, or delete these policies.
• GRANT and DENY policies cannot target non-catalog objects such as external locations, storage credentials, or shares.
• Unity Catalog-managed disaster recovery does not automatically replicate metastore-level policies to secondary regions.

Using it in a pipeline

This fits into the governance and security layer, ensuring that Bronze, Silver, and Gold tables receive automatic protection rules upon creation without extra engineering effort.