Preview· Databricks release notes (AWS)
ABAC DENY policies in Unity Catalog are in Beta
ABAC DENY policies are in Beta in Unity Catalog. They can explicitly deny the MANAGE ACCESS CONTROL privilege for specified principals, including object owners, and the denial takes precedence over grants.
Learners studying Unity Catalog access control need to know that an ABAC DENY can override granted access-management permissions.