Catalog
PreviewWorth evaluating
ABAC gains DENY policies, and they beat every grant
From Databricks release notes
A DENY policy blocks MANAGE ACCESS CONTROL for the principals it names, and it always wins over a grant that would allow it. Beta. It is the first ABAC construct that can take something away rather than hand it out.
What to re-read
More from Catalog
- ReleaseUnity Catalog permissions on system.ai now control which AI Functions users can run (GA)
- PreviewFiles API 3.0 for Unity Catalog volumes enters Beta with multipart uploads
- ReleaseService principal OAuth tokens can carry a custom identity claim for per-user row filtering
- ReleaseREAD METADATA privilege now works with every compliance security profile standard