Best practice to enforcing row-level security across multiple catalogs sharing same schema structure

[Khasim_1]

Hi Everyone,

We have identical schema structures replicated across three catalogs (dev, qa, prod) to support environment isolation. We now need to apply row-level security (e.g., restricting sales reps to only see their own region's data) consistently across all three catalogs without duplicating the row-filter function/logic three times.

What we've tried: > - Created a single row-filter function in a shared "utility" catalog and attempted to reference it from the other catalogs — this failed due to cross-catalog function reference limitations. > - Considered duplicating the filter function per catalog, but this creates a maintenance burden (any logic change requires updating 3 places).

 Questions:

1. Is there a supported pattern for sharing row-filter/column-mask functions across catalogs in Unity Catalog, or must each catalog maintain its own copy?
2. Does Unity Catalog support catalog-level inheritance of security policies, or is row/column security always scoped strictly to the catalog where the function is defined?
3. Has anyone solved this using Databricks Asset Bundles (DABs) to templatize and redeploy the same filter logic across catalogs, rather than trying to share a single function reference?

Any real-world patterns for maintaining DRY (Don't Repeat Yourself) security policies across multiple catalogs would be appreciated.