ABAC_POLICY_DEFINITIONS

Applies to: check marked yes Databricks SQL check marked yes Databricks Runtime check marked yes Unity Catalog only

Important

This feature is in Public Preview.

INFORMATION_SCHEMA.ABAC_POLICY_DEFINITIONS returns one row for each ABAC policy attached to a securable object. Each row describes the policy definition, including its attachment scope, policy type, included and exempt principals, and the condition used to enforce the policy.

To list metastore-level policies (Beta), along with every ABAC policy across the metastore, query SYSTEM.INFORMATION_SCHEMA.ABAC_POLICY_DEFINITIONS.

You will only see policies returned when you have READ METADATA or MANAGE on the securable where the policy is attached, or own it. This matches the access pattern of DESCRIBE POLICY.

This relation is an extension of the SQL Standard Information Schema.

Definition

The ABAC_POLICY_DEFINITIONS relation contains the following columns:

Name Data type Nullable Description
POLICY_ID STRING No Unique identifier of the policy.
POLICY_NAME STRING No Name of the policy.
POLICY_TYPE STRING No The policy type. For example, ROW_FILTER, COLUMN_MASK, GRANT, or DENY.
CATALOG_NAME STRING Yes Name of the catalog the policy is attached to, or that contains the schema or table the policy is attached to. NULL for metastore-attached policies (Beta).
SCHEMA_NAME STRING Yes Name of the schema the policy is attached to, or that contains the table the policy is attached to. NULL for metastore-attached and catalog-attached policies.
SECURABLE_NAME STRING Yes Name of the securable object the policy is attached to. NULL for metastore-attached, catalog-attached and schema-attached policies.
ON_SECURABLE_TYPE STRING No Type of the securable object the policy is attached to: METASTORE (Beta), CATALOG, SCHEMA, or TABLE.
TO_PRINCIPALS ARRAY<STRING> No Principals (users, groups, or service principals) the policy applies to. Empty array [] when none are set.
EXCEPT_PRINCIPALS ARRAY<STRING> No Principals excluded from policy application. Empty array [] when none are excluded.
FOR_SECURABLE_TYPE STRING No Type of the securable object the policy targets when evaluated. For example, TABLE for row filters and column masks, or MODEL, MODEL_SERVICE, MODEL_PROVIDER_SERVICE, MCP_SERVICE, or AGENT_SERVICE for GRANT policies. For DENY policies, the securable type the privilege is denied on, such as CATALOG, SCHEMA, or TABLE.
PRIVILEGES ARRAY<STRING> Yes Privileges granted or denied by the policy. NULL for ROW_FILTER and COLUMN_MASK policies.
WHEN_CONDITION STRING Yes Conditional expression under which the policy applies. For example, a boolean expression that matches tables based on their governed tags.
MATCH_COLUMNS ARRAY<STRING> Yes Columns referenced by the policy. NULL for GRANT and DENY policies.
CREATED_BY STRING No Principal who created the policy.

Examples

-- List every GRANT policy in the current catalog.
> SELECT *
    FROM information_schema.abac_policy_definitions
    WHERE policy_type = 'GRANT';

-- List every DENY policy in the current catalog.
> SELECT *
    FROM information_schema.abac_policy_definitions
    WHERE policy_type = 'DENY';

-- Find all row filters and column masks attached to securable objects in a schema.
> SELECT policy_name, policy_type, on_securable_type, securable_name, when_condition, match_columns
    FROM information_schema.abac_policy_definitions
    WHERE policy_type IN ('ROW_FILTER', 'COLUMN_MASK')
      AND catalog_name = 'my_catalog'
      AND schema_name = 'my_schema';
  • Last updated on