Unifying governance across engines and catalogs in the Open Lakehouse

The Apache Iceberg community has adopted two new REST Catalog specs, read restrictions and catalog labels, that extend the Open Lakehouse governance vision. Read restrictions let a catalog delegate policy enforcement to a trusted external engine (like a securely configured Trino) by returning column-projection actions and row-filter expressions rather than raw policy definitions, though the spec deliberately leaves trust establishment outside its scope. Catalog labels let federated catalogs (Unity Catalog, Snowflake, AWS Lake Formation, Google Cloud Knowledge Catalog) exchange lightweight key-value metadata such as PII classifications, which the consuming catalog maps into its own native policy model and enforces locally. Neither mechanism replaces centralized enforcement approaches like Databricks' Cross-Engine ABAC for untrusted engines such as user-controlled Spark or DuckDB; instead the three approaches are complementary depending on whether the destination is an untrusted engine, a trusted engine, or another catalog.

Source: https://www.databricks.com/blog/unifying-governance-across-engines-and-catalogs-open-lakehouse. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.