Open table formats make data portable. The next challenge is making governance just as portable. Two additions to the Apache Iceberg REST Catalog help address that challenge: read restrictions for delegated enforcement and catalog labels for portable governance context.
Key highlights
- Read restrictions delegate a policy decision: A catalog evaluates policies for a requesting principal and returns row filters and column-projection or masking instructions. A trusted engine then enforces the result as it reads the table. The contract standardizes the decision format, while trust between the catalog and engine remains an operational and security concern outside the protocol.
- Catalog labels make metadata portable: A producing catalog can return table- and column-level key-value labels, such as a classification for sensitive data or a business domain. A consuming catalog can map those labels into its own tags, classifications, or policies and enforce them using its native governance system.
- Labels carry context, not shared policy meaning: Labels are intentionally lightweight and extensible. They make metadata exchange possible, but organizations still need conventions or mappings to agree on what a label means and how it should be used.
- Centralized enforcement remains important: For an untrusted or user-controlled engine, the source catalog should enforce policy before unauthorized data reaches the engine. Cross-engine ABAC uses server-side filtered scan plans so external engines can query governed data without implementing policy logic themselves.
- Choose the model for the access pattern: Use centralized enforcement when the engine cannot be trusted, read restrictions when a trusted engine can apply the catalogโs decision, and catalog labels when another catalog needs portable governance or business context while keeping enforcement local.
๐ Read the full post here
