Thanks @emanueol!

Short answer: mostly yes — when you access data as a Unity Catalog (UC) object on Databricks compute, UC governance applies. There are important nuances by source:

• Managed tables (Delta, Iceberg): Full UC governance. Row filters/column masks are supported on managed Delta; managed Iceberg doesn’t support row filters/masks yet. See managed tables overview and benefits and Iceberg limitation:

  • https://docs.databricks.com/aws/en/tables/managed#unity-catalog-managed-tables-in-databricks-for-del... 

  • https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#limitations

• External tables (registered in UC): Policies are enforced at query time; avoid path/URI reads that bypass UC; FGAC has runtime requirements (e.g., DBR 15.4+ reads; 16.3+ writes on dedicated with serverless filtering). Details:

  • Row/column policies at query time: https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#what-are-row-filt... and https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#what-are-column-m... 

  • Path-bypass + dedicated compute requirements: https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#limitations and https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#dedicated-access-... 

  • External access patterns (governance boundary for cloud URIs): https://docs.databricks.com/aws/en/external-access#access-non-delta-lake-tabular-data-with-external-...

• Foreign catalogs (HMS/Glue federation): UC provides permissions, lineage, auditing when you query via the UC foreign catalog, but feature coverage is narrower; external HMS/Glue are read‑only for writes; see:

  • Governance layer overview: https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#overview-of-hive-metasto...

  • Feature matrix + differences: https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#how-does-hive-metastore-... and https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#requirements-and-feature... 

  • Write support constraints: https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#what-does-it-mean-to-wri... 

  • ABAC runtime requirement (if using tag-driven policies): https://docs.databricks.com/aws/en/data-governance/unity-catalog/abac#limitations

• Delta Sharing: Providers cannot share tables that already have row filters or column masks; recipients can apply their own policies on their side:

  • Provider limitation + recipient capability: https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks#limitations 

  • Related sharing updates: https://docs.databricks.com/aws/en/release-notes/product/2025/june#cross-platform-view-sharing-is-no... and https://docs.databricks.com/aws/en/release-notes/product/2025/june#sharing-managed-iceberg-tables-in...

• Legacy hive_metastore accessed directly (not via UC): UC policies don’t apply unless the data is exposed through a UC foreign catalog or migrated:

  • Federation overview + feature support: https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#overview-of-hive-metasto... and https://docs.databricks.com/aws/en/query-federation/hms-federation-concepts#requirements-and-feature...

Bottom line: Access data as UC objects to get UC governance. Coverage is strongest on managed/external UC tables, more limited on foreign catalogs, and behaves differently for Delta Sharing. Mind runtime/compute requirements for fine‑grained controls and avoid path-based reads that bypass UC.