How Attribute-Based Access Control uses governed tags to enforce dynamic, scalable data access policies without per-object permissions.
Governed Tags are account-level tags with enforced rules for consistency. They classify data assets with attributes like:
sensitivity=high, region=EMEA, domain=finance
Tags alone don't enforce access — they just classify data.
Admins apply governed tags to catalogs, schemas, or tables. Tags inherit downward.
Example: A customer_data table is tagged with sensitivity=high and region=EMEA.
ABAC Policies are the enforcement layer. They define rules like:
"If table has sensitivity=high, only compliance-team can SELECT"
Policies use UDFs for row filters and column masks.
When Alice queries the table, UC evaluates:
1. What tags does this table have?
2. What policies match those tags?
3. Is Alice allowed based on policy rules?
Change a tag → access changes instantly.
No need to update permissions on individual objects. Just:
• Reassign a tag, or
• Update the policy definition
This scales to thousands of tables with minimal admin effort.
Role: Classification & consistency
Role: Dynamic enforcement
Why ABAC + Tags?
How they work together: