Fine-grained access control in Unity Catalog: restrict which rows users can see and mask sensitive columns, all without storing multiple copies of data. Unity Catalog row filters and column-level masks enforce access policies at query time using SQL functions.
Source: official Databricks documentation · Databricks announcement
Key takeaways
- Row filters restrict which rows users can access based on SQL filter functions evaluated at query runtime.
- Column-level masks protect sensitive data by transforming values conditionally based on user roles.
- Maximum one row filter and one mask per column apply across all queries without data duplication.
- Permissions check happens at query time, not data load time.
- Functions define filter logic using standard SQL predicates and masking functions like md5.
Chapters
- 0:00 — Introduction: Row filters and column-level masks
- 1:00 — Creating and applying row filters
- 2:00 — Creating and applying column-level masks
- 3:00 — Enforcing and removing security policies
Frequently asked questions
How are row filters different from column masks?
Row filters control which rows a user sees (e.g., developers see only their rows). Column masks transform column values (e.g., salary shows as hash for non-HR users).
Can I define both row filters and column masks on the same table?
Yes, each table can have one row filter and each column can have one mask. The transcript demonstrates both applied together on the same table.
When is the filter or mask evaluated?
Both are evaluated at query runtime, so permissions are always current and no additional copies of data are stored.
How do I define a row filter?
Create a function with a SQL predicate (e.g., checking if current user is in a group) and apply it using ALTER TABLE SET ROW FILTER command.
Full transcript
Auto-generated from the video and lightly edited for readability. Timestamps link to the moment in the video.
Show full transcript (11 segments)
0:01hello my name is Yousef Marin I have the pleasure to introduce two new features to enhance data security effectively at the granular level those features are row filters and column level masks users can leverage standard SQL functions to Define row filters and colum masks enabling fine Rin access
0:23controls at the level of individual rows and columns row filters are allow you to apply a filter to a table that get evaluated at run time and all return rows that satisfy specific criteria within the filter and column masking allow you to apply a masks to a column in a table
0:46that's get evaluated at front time columns can be returned unmasked or masked depending on the filter definition criteria column level masks and row filters can be applied by creating a function and applying it to a table with a larer table statement or the function can be defined and apply to a table in
1:09one step in the create table statement each column in a table can have a maximum of one column level mask defined and each table can have a maximum of one row filter defined in this example I created a table I filled with with some data let
1:31me show you the table so we have two roles developer and a manager the first thing I will do is to Define my row filter so I will create a function called permissions and I will specify if the user who run the query is part of the group manager then this user will be
1:55able to view all the table else this user can only View to rows with the value developer once the function is created you need to apply to a table using the alter table command set row filter and of course the name of the function and now if I run this query
2:19again because I'm not part of the group manager I will only view the r developer and for the mass it's the same thing you need to create a function that I did call salary md5 I'm saying again if I'm part of the group HR then I will be able to view
2:42salary else I will view the hash column and in this example I am applying the function at the creation of the table some I'm specifying that salary is going to be masked using the function salary
3:04md5 I'm doing some data insertion and then I will query the table to show you the result and since I'm not part of the group HR I'm unable to see the salary and of
3:29course you can still drop the mask if you want and now I can run the query and I am able to view the salary and you can also drop the row filter and I'll be able to view
3:51everything of course this this o this Fe those two features give you the opportunity to Grant the permission over some tables without displaying all the data that you have inside tables thank you
Official Databricks resources
- Attribute-based access control (ABAC) documentation — docs
- Databricks Free Edition — product
- Open sourcing Unity Catalog (Databricks blog) — blog
Related
- Lakehouse RT, AI Gateway, Omnigent: Databricks Announcements
- Unity Catalog Managed Tables 2026: PM Insights at DAIS
- Catalog Commits with Unity Catalog: Multi-Table ACID Transactions
- Data governance with Unity Catalog on Databricks
- All Databricks video guides
- All tutorials & videos
Databricks Answers
Looking for a quick, source-backed answer? Browse Databricks Answers on Unity Catalog, governance & security — direct, documentation-validated answers to common Databricks questions, curated by Youssef Mrini, Senior Developer Advocate at Databricks.