Harmonizing Informatica Governance Policies Across Databricks and Power BI Import Mode

[fjrodriguez]

What are the recommended architectures or best practices for harmonizing and enforcing governance policies (such as data masking and access controls) defined in Informatica across both Databricks and Power BI datasets running in Import mode?

What I can't find a clean answer for is how to keep those rules consistent across the stack:

• The rule is decided and approved in the governance catalog Informatica, by the business.
• It has to be enforced in Unity Catalog, so it applies to SQL, notebooks, dashboards and Genie.
• And it has to apply in Power BI, where our semantic models are Import mode — thousands of users, so DirectQuery isn't viable for us on cost and latency. Which means row filters and column masks defined in Unity Catalog don't reach the report consumer.

So today the same business rule risks being expressed more than once, by different teams, with no way to prove they say the same thing on a given date

My questions to anyone who has been through this:

1. How do you get a policy that is authored in an external governance tool to land in Unity Catalog without that tool taking over permissions in your metastore?
2. With Power BI in Import mode, how do you avoid re-implementing the same restriction in DAX? Is there a pattern better than maintaining a user-level entitlement table?
3. How do you demonstrate to audit that both platforms are applying the same rule, rather than asserting it?
4. And more generally: where do you draw the line between the governance catalog and Unity Catalog — who defines, who enforces?

[ivanvyd]

@fjrodriguez the key is to keep one policy source while accepting two enforcement points. Informatica should own the business intent and approval; Unity Catalog and Power BI should enforce platform-specific artifacts generated from the same versioned policy contract.

For Unity Catalog, use a platform-owned pipeline to translate that contract into governed tags and ABAC policies. Grant the service principal narrowly scoped privileges—for example, ASSIGN and APPLY TAG, plus scope-level MANAGE and EXECUTE on any policy UDF—rather than metastore ownership.

“Databricks recommends ABAC policies when you need consistent row filtering and column masking across many tables.” Databricks documentation

For AI/BI dashboards, use Individual data permissions when policies must be evaluated for each viewer; shared permissions execute as the publisher. Genie applies Unity Catalog row filters and column masks per user.

Power BI Import mode cannot pass the report consumer’s identity back to Unity Catalog. You therefore cannot remove Power BI-side enforcement, but you can remove manual policy re-authoring: generate a dynamic RLS entitlement table keyed by USERPRINCIPALNAME() from the same policy contract. For column restrictions, use OLS, exclude sensitive columns, or import a pre-masked projection. Keep consumers in Viewer or app roles because RLS does not restrict workspace Admin, Member, or Contributor roles.

For audit evidence, retain the policy version, effective date, deployment manifest, and test results. Compare SHOW EFFECTIVE POLICIES, system.information_schema.abac_policy_definitions, and system.access.audit with the deployed Power BI model roles. Run identical positive and negative test identities against both platforms. Deployment records show what was configured; identity-based tests demonstrate equivalent enforcement.