← All updates Databricks Update One-Pager Light version
databricks Platform · Updated Aug 21, 2026

Context attributes in ABAC column mask and row filter policies (Beta)

Context attributes for attribute based access control (ABAC) policies are in Beta.

What it does

Context attributes for attribute based access control (ABAC) policies are in Beta. You can now write Unity Catalog ABAC policy conditions that target the context of a request, such as which OAuth application is calling (request.client id) and whether the request runs on behalf of a user (request.is on behalf of). The has context attribute and has context attribute value functions are supported in the WHEN clause of row filter and column mask policies.

Why it matters

Attribute based access control (ABAC) is an access control model that uses governed tags and policies to grant permissions based on object attributes rather than per object grants.

Key capabilities
For row filter and column
For row filter and column mask policies, supported policy scopes are CATALOG, SCHEMA, or TABLE. For GRANT policies (Beta)…
Tables, including streaming tables and
Tables, including streaming tables and materialized views, are the only supported securable type for row filter and column mask…
A policy attached at a
A policy attached at a catalog evaluates against all tables in that catalog. A policy attached at a schema evaluates against all…
Recommended use cases
For a sales catalog
Architecture
Databricks Platform → Platform
In short

Context attributes for attribute based access control (ABAC) policies are in Beta. You can now write Unity Catalog ABAC policy conditions that target the context of a request, such as which OAuth application is calling (request.client id) and whether the…

Read the full documentation ↗
Key takeaway
Context attributes for attribute based access control (ABAC) policies are in Beta.
2026-08-21-context-attributes-in-abac-column-mask-and-row-filter-policies-beta Generated by the Databricks Updates Agent · browse all updates