Catalog
PreviewWorth evaluating
ABAC DENY policies in Unity Catalog are in Beta
From Databricks release notes (AWS)
ABAC DENY policies are in Beta in Unity Catalog. They can explicitly deny the MANAGE ACCESS CONTROL privilege for specified principals, including object owners, and the denial takes precedence over grants.
Learners studying Unity Catalog access control need to know that an ABAC DENY can override granted access-management permissions.
What to re-read
More from Catalog
- ReleaseUnity Catalog permissions on system.ai now control which AI Functions users can run (GA)
- PreviewFiles API 3.0 for Unity Catalog volumes enters Beta with multipart uploads
- ReleaseService principal OAuth tokens can carry a custom identity claim for per-user row filtering
- ReleaseREAD METADATA privilege now works with every compliance security profile standard