Attribute-based access control (ABAC) in Unity Catalog is implemented through row filters. A row filter is a SQL function registered on a table that evaluates the identity or group membership of the querying user and returns only the rows they ' re entitled to see.

The key functions are CURRENT_USER() (returns the logged-in user ' s email) and IS_ACCOUNT_GROUP_MEMBER() (returns true if the user belongs to a specified group). By building filter logic around these, you create access rules that are data-driven — a user in the ' EMEA ' group sees EMEA rows, a user in ' APAC ' sees APAC rows — without maintaining separate table-level grants per data segment.

This is what distinguishes ABAC from role-based access control: decisions are based on the user ' s attributes evaluated at query time, not on static grant lists. The filter is transparent to end users — they query the table normally and only receive rows the policy allows.