You have an Azure Databricks workspace that is enabled for Unity Catalog and contains a...

Attribute-based access control (ABAC) in Unity Catalog is implemented through row filters. A row filter is a SQL function registered on a table that evaluates the identity or group membership of the querying user and returns only the rows they're entitled to see.

The key functions are CURRENT_USER() (returns the logged-in user's email) and IS_ACCOUNT_GROUP_MEMBER() (returns true if the user belongs to a specified group). By building filter logic around these, you create access rules that are data-driven — a user in the 'EMEA' group sees EMEA rows, a user in 'APAC' sees APAC rows — without maintaining separate table-level grants per data segment.

This is what distinguishes ABAC from role-based access control: decisions are based on the user's attributes evaluated at query time, not on static grant lists. The filter is transparent to end users — they query the table normally and only receive rows the policy allows.