Hi @Dolly0503 ,

Yes, you can do row-level security across one table or many in Unity Catalog without copying data per role. @balajij8  pointed you in the right architectural direction (ABAC with governed tags, a reusable row-filter function, and centrally managed policies). Let me add the official requirements, a couple of corrections, and a simpler option if you only have a few tables.

The first thing to decide is your path, and it comes down to scale.

Path A is the classic row filter. It's the simplest approach and it's the best fit when you only have a few tables. No tags or policies needed. You attach a UDF directly to each table.

-- Function returns TRUE for rows the caller may see
CREATE OR REPLACE FUNCTION main.default.dept_filter(dept STRING)
RETURN is_account_group_member('data_admins')   -- admins see all
  OR is_account_group_member(dept);              -- else only your dept's rows

-- Attach to each table
ALTER TABLE main.default.employee_data
  SET ROW FILTER main.default.dept_filter ON (department);

is_account_group_member() is the role hook. It evaluates the querying user's group membership at runtime. You repeat the ALTER TABLE for each table you want filtered.

Path B is ABAC policies. This is the better fit when you want one definition to govern many tables, including ones that don't exist yet. There are four steps.

1. Define governed tags at the account level (Catalog Explorer under tag policies, or the REST API/Terraform) for the attributes that drive access, things like department, region, and sensitivity. One correction here: governed tags are not created with an inline CREATE TAG ... VALUES(...) statement. They're managed at the account level, then assigned to objects.
2. Assign tags to the relevant tables and columns.

ALTER TABLE main.default.employee_data SET TAGS ('department' = 'hr');

3. Create the row-filter UDF. It returns a BOOLEAN, same as Path A.
4. Create a policy on the catalog, schema, or table, bound to the tagged objects.

CREATE POLICY dept_rls
ON SCHEMA main.default
COMMENT 'Users see only their department''s rows'
ROW FILTER main.default.dept_filter
TO `account users` EXCEPT `data_admins`
FOR TABLES
MATCH COLUMNS has_tag('department') AS dept
USING COLUMNS (dept);

The payoff with Path B is that you define it once on the schema or catalog, and any current or future table carrying the department tag gets filtered automatically. No per-table wiring.

A few guardrails to get right before you go to production:

1. ABAC adds restrictions on top of access, it doesn't grant it. You still need the normal object-level GRANT on the table. ABAC only filters what's visible after access is granted.
2. Requirements and privileges: supported compute (serverless or DBR 16.4+), MANAGE on the securable, and EXECUTE on the UDF. ABAC policies are GA as of mid-2026.
3. Only one distinct row filter can resolve per user and table at runtime. If multiple different filters apply to the same user and table, Databricks errors out. So consolidate your role logic into one reusable function, or make sure your policies are mutually exclusive.
4. Add an admin or service-account escape hatch in the UDF (the data_admins check above), otherwise pipelines and owners can lock themselves out.
5. For complex role to data mappings, have the UDF run an EXISTS query against a lookup table (e.g. role_access_map) instead of chaining is_account_group_member() CASE branches. It's much easier to maintain as your roles grow.
6. If you also need to hide columns or values (masking an SSN, for example), use the sibling column mask feature. Same ABAC machinery, just COLUMN MASK instead of ROW FILTER.

The short version: for RLS across many tables without duplicating data, use Unity Catalog ABAC with governed tags and a single reusable row-filter UDF. If you only have a few tables, a direct SET ROW FILTER gets you there in two statements.

Docs:

1. ABAC in Unity Catalog: https://docs.databricks.com/aws/en/data-governance/unity-catalog/abac/
2. Create and manage row filter and column mask policies: https://docs.databricks.com/aws/en/data-governance/unity-catalog/abac/policies
3. Row filters and column masks: https://docs.databricks.com/aws/en/data-governance/unity-catalog/filters-and-masks
4. Requirements, quotas, and limitations: https://docs.databricks.com/aws/en/data-governance/unity-catalog/abac/requirements

Cheers, Louis.