databricks Platform · Updated Jun 11, 2026

ABAC GRANT Policies for Models

Dynamic access control for ML models in Unity Catalog.

What it does

ABAC GRANT policies enable dynamic granting of Unity Catalog privileges based on the governed tags of securable objects, specifically allowing the `EXECUTE` privilege on models at the catalog or schema level. This feature supports both customer-registered MLflow models and Databricks-hosted foundation models. The policies evaluate conditions against tags each time access is checked, streamlining access management for models.

Why it matters

This update enhances data governance by simplifying access control for machine learning models, reducing administrative overhead and potential errors associated with direct grants. Organizations can ensure that only authorized users can execute models based on dynamic conditions, improving security and compliance while fostering collaboration among data scientists and analysts.

Key capabilities

Dynamic Privilege Granting

GRANT policies dynamically assign privileges based on matching governed tags.

Support for Multiple Model Types

Policies apply to both customer-registered MLflow models and Databricks-hosted foundation models.

Catalog and Schema Level Attachment

GRANT policies can be attached at the catalog or schema level, simplifying management.

Inline Condition Expressions

Conditions for granting access can be expressed inline without the need for user-defined functions.

Prerequisites

Databricks Runtime 18.3 or above is required for creating GRANT policies with SQL.

Users must have MANAGE permissions on the catalog or schema where the policy is attached.

Recommended use cases

Granting access to ML models based on their lifecycle stage (e.g., production, development).Automatically managing access to new foundation models as they are added to the system.Simplifying access control for teams by reducing the need for multiple direct GRANT statements.

Limitations · remember

!Currently, only the EXECUTE privilege on models is supported in Beta.

!GRANT policies can only be attached at the catalog or schema level, not at the individual model level.

Architecture

Unity Catalog → ABAC Framework → GRANT Policies → Securable Objects

Get started

Access Catalog Explorer

Navigate to the Catalog section in your Databricks workspace.

Select Catalog or Schema

Choose the catalog or schema where you want to attach the GRANT policy.

Create New Policy

Click on the Policies tab and select New policy.

Define Policy Conditions

Specify the principals, scope, and conditions for the policy.

Review and Create

Review the SQL statement generated and click Create policy.

Key takeaway

ABAC GRANT policies streamline access control for machine learning models, enhancing security and governance in Databricks.

2026-06-11-abac-grant-policies-for-models-beta Generated by the Databricks Updates Agent · browse all updates