Implementing Row-Level Security using ABAC in SAP Databricks

[Yogananda]

In modern enterprise landscapes, especially in SAP-driven ecosystems, data security is not just about who can access a table—it’s about which rows a user is allowed to see.

Traditional Role-Based Access Control (RBAC) often falls short when:

• Data spans multiple domains (Finance, HR, Sales)
• Access depends on business attributes (department, region, sensitivity)
• Governance must scale across hundreds of tables

Image generated using AI Core - Gemini Flash Lite Model

This is where Attribute-Based Access Control (ABAC) in SAP Databricks Unity Catalog becomes powerful.

In this blog, we will:

• Understand ABAC-based Row-Level Security (RLS)
• Compare it with classic approaches
• Implement it step-by-step
• Apply it to an SAP dictionary dataset (like MARA, KNA1, etc.)

What is ABAC in SAP Databricks?

ABAC allows access decisions based on:

• Attributes of data (tags like department, sensitivity)
• Attributes of users (group membership)
• Policies that connect them
  

Instead of hardcoding rules per table, you define:

Tags + UDF + Policy = Dynamic Row-Level Security

---

Architecture Overview

ABAC has three main components:

Component	Purpose
Governed Tags	Classify data
Row Filter UDFs	Define access logic
Policies	Bind logic to data

Sample Scenario: Business Requirement

Let’s take an example.

Tables (SAP Dictionary-like)

• ZSALES_ORDER (similar to VBAK)
• ZCUSTOMER (similar to KNA1)
• ZEMPLOYEE (HR data)

Requirement

Role	Access
Sales Team	Only sales data for their region
Finance Team	Only finance-related records
HR Admins	Full access
Executives	All data

Step 1: Create Governed Tags

Tags represent metadata similar to SAP data classification fields.

CREATE TAG sensitivity VALUES ('high', 'medium', 'low');
CREATE TAG department VALUES ('sales', 'finance', 'hr');
CREATE TAG region VALUES ('EMEA', 'APAC', 'NA');

Step 2: Tag SAP Tables

Apply tags to simulate SAP dictionary semantics.

ALTER TABLE main.sap.zsales_order
SET TAGS ('department'='sales', 'region'='EMEA');

ALTER TABLE main.sap.zcustomer 
SET TAGS ('sensitivity'='high', 'department'='finance');

ALTER TABLE main.sap.zemployee 
SET TAGS ('sensitivity'='high', 'department'='hr');

Step 3: Create Row Filter UDF

This is where business logic resides.

CREATE OR REPLACE FUNCTION main.sap.filter_by_department(dept STRING, region STRING)
RETURNS BOOLEAN
RETURN
  CASE
    WHEN is_account_group_member('Executives') THEN TRUE
    WHEN is_account_group_member('HR_Admins') THEN TRUE
    WHEN is_account_group_member('Finance_Team') AND dept = 'finance' THEN TRUE
    WHEN is_account_group_member('Sales_Team') AND dept = 'sales' 
         AND region = current_user_region() THEN TRUE
    ELSE FALSE
  END;

Step 4: Create ABAC Policy

Now bind everything together.

CREATE POLICY sap_data_access_policy
ON CATALOG main
COMMENT 'Enterprise-wide SAP data access control'
ROW FILTER main.sap.filter_by_department
TO `All Users` EXCEPT `Data_Admins`, `Executives`

FOR TABLES
WHEN has_tag_value('sensitivity', 'high')

MATCH COLUMNS has_tag('department') AS dept,
              has_tag('region') AS region

USING COLUMNS (dept, region);

What Happens at Runtime?

When someone queries:

SELECT * FROM main.sap.zsales_order;

Unity Catalog executes:

1. Checks applicable policies
2. Validates tags (department, region)
3. Extracts tagged columns
4. Passes values into UDF
5. Evaluates user group via is_account_group_member()
6. Filters rows dynamically

When to Use ABAC

Use ABAC if:

• You have multiple SAP datasets
• Data is shared across domains
• Governance needs to scale
• You integrate SAP + SAP Datasphere / Databricks

[PaulK]

Thank you for this very interesting blog; currently we are struggling to apply complex BW-Analysis-Authorization to DBX.

Example:
Salestable like VBAK with row level security on the following three columns:
KEYACCOUNT
MARKETSEGMENT
SALESOFFICE

Userauthorization table with:
Userid
AND/OR join
Filter on
KEYACCOUNT
MARKETSEGMENT
SALESOFFICE

Some user in our companys have various functions; e.g. the person is keyaccountmanager for a specific customer; that means he has access worldwide to all records that are assigned to this customer/keyaccountmanager
AND
in addition is working in a specific salesoffice and has access to all records that are assigned to this salesoffice.

This is running well in SAP BW/HANA/Datasphere, where we translate this into the WHERE condition in SQL
e.g.
WHERE ( KEYACCOUNT=100 AND MARKETSEGMENT=* AND SALESOFFICE=* ) OR (KEYACCOUNT=* AND MARKETSEGMENT=* AND SALESOFFICE=SO123 )

Would this be possible in your concept ?

Regards
Paul

[Yogananda]

Its possible.

Example authorizations:

USERID KEYACCOUNT MARKETSEGMENT SALESOFFICE

PAUL	100	*	*
PAUL	*	*	SO123

WHERE
(
  KEYACCOUNT = '100'
)
OR
(
  SALESOFFICE = 'SO123'
)

In Databricks ABAC, the row filter UDF can look up the authorization table and check whether at least one rule exists that matches the current row:

EXISTS (
  SELECT 1
  FROM USER_AUTH A
  WHERE A.USERID = CURRENT_USER()

  AND (
       (A.KEYACCOUNT IS NULL OR A.KEYACCOUNT = SALES.KEYACCOUNT)
   AND (A.MARKETSEGMENT IS NULL OR A.MARKETSEGMENT = SALES.MARKETSEGMENT)
   AND (A.SALESOFFICE IS NULL OR A.SALESOFFICE = SALES.SALESOFFICE)
  )
)

 You need to consider this below 

1. Store authorizations in a dedicated table.
2. Pass the current user into a row-filter function.
3. Evaluate the authorization table dynamically.
4. Return TRUE if any authorization rule matches (OR logic).