Databricks ABAC

This guide provides an overview of SaaS Authorization Management for Databricks ABAC using PlainID.

Databricks ABAC is the attribute-based access control model in Databricks Unity Catalog. ABAC Policies attach at the Catalog, Schema, or Table level and apply automatically to Tables and Columns based on Governed Tags. Each Policy uses a user-defined function (UDF) to filter rows or mask column values at query time.

PlainID connects to Databricks ABAC through a Policy Orchestration Point (POP) and discovers relevant Unity Catalog objects, their Governed Tags, and ABAC Policies with their associated functions, so you can view and audit them centrally in the Platform.

Databricks ABAC is a separate integration type from Databricks.

Supported Mode

The Databricks ABAC integration supports Learn Mode.

In Learn Mode, PlainID discovers your Databricks Unity Catalog objects and ABAC Policies and displays them in the Platform. In Learn Mode, PlainID does not create, update, or deploy Policies to Databricks.

To learn about POP modes, refer to our Orchestration Workspace documentation.

Key Concepts

The Databricks ABAC integration relies on the following Unity Catalog objects:

Object	Description
Catalog	The top-level container for data assets in Unity Catalog.
Schema	A data container for multiple Tables and other objects that helps manage the Catalog.
Table	The object that ABAC Policies protect, directly, based on their Governed Tags and/or by inheritance.
Column	A Column within a Table. Masking Policies protect Columns based on their Governed Tags.
Governed Tag	A tag that ABAC Policies use to decide which Tables and Columns they apply to.
ABAC Policy	A Unity Catalog object that applies a row filter or column mask function to Tables/Columns.

For details on Schemas, Functions, and the rest of the Unity Catalog object hierarchy, see the Unity Catalog securable objects reference. For more on ABAC, see Unity Catalog attribute-based access control (ABAC).

Supported Policy Types

PlainID discovers the following Databricks ABAC Policy types:

Row filter (Row Access Policy): Restricts which rows a principal can see in a Table, based on function logic that returns TRUE for rows the principal can access.
Column mask (Masking Policy): Controls what a principal sees in a Column, based on function logic that returns either the original value or a masked value.

Both Policy types apply to Tables. PlainID discovers Policies attached at the Catalog, Schema, and Table level, including Policies a Table inherits from its Schema or Catalog.

Discovered Objects

When you create a Databricks ABAC POP, PlainID discovers the following objects:

Databricks Object	In PlainID
Catalog	PlainID displays the Catalog as an ABAC Catalog. The Catalog is the discovery scope of the POP.
Schema	PlainID displays the Schema as an ABAC Schema within the Catalog.
Table	PlainID displays the Table as an ABAC Table and creates it as an Asset in the Tables Asset Type. Tables are the objects that ABAC Policies protect.
Column	PlainID represents Columns with the Databricks ABAC Column Asset Type, which defines the Columns a Masking Policy protects. PlainID does not create an Asset for each Column.
Function (UDF)	PlainID displays each function as part of the Policy that references and uses it. PlainID discovers only functions that a discovered Policy references.
Governed Tag	PlainID displays Governed Tags as an Asset Attribute on Tables and Columns. For Tables that PlainID creates as Assets, the GovernedTags Asset Attribute includes the actual tags PlainID discovers for each Table (see details below).

Governed Tags

PlainID represents each Governed Tag assigned to a Table or Column as a single value in the format <tagKey>:<tagValue>. A Table with several tags carries several values.

If a Table has a tag key without a value, PlainID represents it as <tagKey>:Key-Only.

Tag in Databricks	Value in PlainID
Key `pii`, value `email`	`pii:email`
Key `pii`, no value	`pii:Key-Only`

Policy Details

PlainID identifies each Policy with a Vendor Policy ID that follows the format Databricks uses:

<on_securable_type>.<on_securable_fullname>.<policy_name>

For example, a Policy named mask_ssn attached to the Schema sales.customers has the Vendor Policy ID SCHEMA.sales.customers.mask_ssn.

Protected Resource Filter

The Protected Resource Filter defines where a Policy applies:

Property	Description
`on_securable_type`	The level the Policy attaches to: `CATALOG`, `SCHEMA`, or `TABLE`.
`on_securable_fullname`	The full name of the Catalog, Schema, or Table (e.g., `sales.customers`).
`when_condition`	An optional Table tag expression, such as `has_tag_value('pii', 'email')`. The Policy applies only to Tables that match.
`on_column`	For Masking Policies, the Column tag expression that identifies the masked Column.

For example, the following Masking Policy applies to every Table in the Schema sales.customers that has the tag pii:email, and masks Columns tagged pii:ssn:

{
  "on_securable_type": "SCHEMA",
  "on_securable_fullname": "sales.customers",
  "when_condition": "has_tag_value('pii', 'email')",
  "on_column": "has_tag_value('pii', 'ssn')"
}

Viewing Discovered Data

After discovery, the Databricks ABAC POP includes the following tabs:

Tab	Description
Observability	The default landing page of the POP.
Vendor Objects	The discovered Catalog, Schemas, and Tables.
Vendor Policies	The discovered Row Access Policies and Masking Policies.

Getting Started

To connect Databricks ABAC to PlainID, refer to Databricks ABAC Setup.