Time Travel queries now enforce ABAC policies in Unity Catalog

Use cases

Imagine you need to audit historical data from a table protected by attribute-based access control (ABAC) policies, ensuring security rules still apply to past versions. With this feature, you can:

• Query historical table data using a specific timestamp or version number.
• Ensure row filters and column masks are enforced during Time Travel queries.
• Maintain data security when using Databricks Runtime 19 or serverless compute.

How to use

You can use standard Time Travel syntax in SQL queries or Spark DataFrames.

SELECT * FROM meu_catalogo.meu_schema.minha_tabela VERSION AS OF 5;

What happens in this code:

1. Databricks locates version number 5 of the table in the transaction log.
2. The system compares the historical schema with the current schema.
3. The current ABAC policies are applied to the returned historical data.

SELECT * FROM meu_catalogo.meu_schema.minha_tabela TIMESTAMP AS OF '2026-01-01 00:00:00';

What happens in this code:

1. Databricks identifies the valid data for the specified timestamp.
2. The active row filtering and column masking rules are enforced for the querying user.

Limitations and requirements

• This feature is in Beta.
• Requires enabling the Time Travel on UC Managed Tables with Attribute-Based Access Controls preview.
• Requires standard compute running Databricks Runtime 19 or above, or serverless compute.
• The table must be a Unity Catalog managed Delta table with catalog commits enabled, or a managed Iceberg table.
• For managed Delta tables, column mapping must be enabled in both the current and historical versions using the same mode.
• Time travel on tables with table-level row filters or column masks is not supported.