UC Declarative ABAC

Declare governance in YAML. Version it. Deploy it.

UC Declarative ABAC lets you define your Databricks Unity Catalog Attribute-Based Access Control (ABAC) governance model in declarative YAML files. The engine reads your configs, queries Unity Catalog for the current state, computes the difference, and applies only the changes needed. Run it from the uc-abac CLI or as a GitHub Action from the repository that holds your YAML.

Documentation: uc-declarative-abac.readthedocs.io

What it manages

• Tag-based ABAC policies: column masks, row filters, and grants that match tagged objects.
• Unity Catalog objects: catalogs, schemas, tables, volumes, and functions, with owners, comments, tags, and request-for-access destinations.
• Governed tags with allowed values and assigners, and Discovery domains.
• Account groups, their members, and assumers.
• Reusable definitions with $ref overrides and template variables, so one definition can deploy to dev, test, and prod.

Every mutating feature is off until you give it a scope, so you choose exactly what the engine may change.

Quick start

uv venv && uv sync --extra dev

# Validate configs offline (no workspace or credentials needed)
uc-abac validate --config-dir examples/finance_demo/configs

# Preview the changes, then apply them
uc-abac deploy --config-dir examples/finance_demo/configs --warehouse-id <warehouse-id> \
  --tag-management-scopes '*' --privilege-management-scopes '*' --dry-run
uc-abac deploy --config-dir examples/finance_demo/configs --warehouse-id <warehouse-id> \
  --tag-management-scopes '*' --privilege-management-scopes '*'

See the quick start for authentication options, and GitHub Actions to deploy from CI.

Where did everything go?

This README used to hold the full reference. It now lives on the documentation site:

Topic	Page
Installation and quick start	Getting started
Definitions, resources, $ref overrides, template variables	Concepts
Catalogs, schemas, tables, volumes, functions, groups, governed tags, domains	Configuration reference
Mask, filter, and grant policies	Policies
Feature scopes	Feature scopes
Authentication and required permissions	Authentication
Settings file, environment variables, system catalog proxy	Settings
GitHub Actions (deploy, validate, dump)	GitHub Actions
Deployment semantics and drift	Deployment semantics
Dumping current state	Dumping current state
CLI flags and exit codes	CLI reference
Deprecated flags and inputs	Deprecations

Examples and contributing

• examples/finance_demo is a complete, deployable-from-scratch governance project to copy into your own repo.
• See CONTRIBUTING.md to report issues or contribute changes.

---

UC Declarative ABAC is not an official Databricks product. Databricks and Unity Catalog are trademarks of Databricks, Inc.