@excavator-matt 

“Can we tag streaming tables with ABAC and expect it to be safe across versions?”

• Yes, streaming tables are fully subject to UC ABAC, but if the table is physically recreated, table‑level tags can be lost

“Is there first‑class support in Lakeflow for this?”

• Right now, the docs do not show any integration layer that manages governed tags https://docs.databricks.com/aws/en/ldp/developer/ldp-sql-ref-create-streaming-table

“What is a sane pattern?”

• Use Unity Catalog everywhere for Lakeflow
• Put GDPR‑relevant tags and ABAC policies at catalog leve
• , manage table/column tags via IaC or deployment jobs that re‑apply tags after pipeline changes,

ABAC policies work on Unity Catalog tables
But Lakeflow Declarative Pipelines do not version governed tags for you, so you must manage tags and policies at the UC layer

Solution thinking:

1. For GDPR‑style constraints  attach governed tags at catalog level 
2. ABAC policies can key off both governed tags and other attributes like table name
3. For streaming models that are versioned (for example, customer_latest_v1, customer_latest_v2), you can keep them in a “sensitive” schema (tagged as PII) and have policies that apply uniformly,
4. Automate tags as part of CI/CD for Lakeflow

If you share a bit about how you currently version streaming tables (e.g., drop/recreate vs ALTER vs new names), a more pipeline‑specific tagging workflow can be solutioned