ABAC DENY policies are in Beta

BetaSep 8, 2026VerifiedAdded Sep 22, 2026

ABAC DENY policies are in Beta in Unity Catalog. DENY policies can be used to explicitly deny the MANAGE ACCESS CONTROL privilege to prevent specified principals, including object owners, from performing access-management operations. They always take precedence over any grant. For details, see ABAC DENY policies (Beta) .

Governance Observability

Read Databricks's release notes

https://docs.databricks.com/aws/en/release-notes/product/2026/september#abac-deny-policies-are-in-beta

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More Unity Catalog releases

Unity CatalogSep 9, 2026

External secrets in Unity Catalog (Beta)

External secrets connect a Unity Catalog schema to AWS Secrets Manager. The secrets appear in Unity Catalog as read-only securable objects that you govern with Unity Catalog privileges. Databricks reads their values from AWS Secrets Manager on demand. See External secrets in Unity Catalog .

BetaGovernanceSecurityObservabilitySource

Unity CatalogSep 11, 2026

Sharing foreign Iceberg tables with OpenSharing is now generally available

Sharing and reading foreign Iceberg tables with OpenSharing is now generally available. Providers can share Iceberg tables federated from foreign Iceberg catalogs using Lakehouse Federation, including to recipients using external Iceberg clients.

GAGovernanceApache IcebergObservabilitySource

Unity CatalogSep 11, 2026

Sharing foreign schemas and tables with OpenSharing is now generally available

Sharing and reading foreign schemas and foreign tables with OpenSharing is now generally available. Providers can share foreign schemas and tables federated from external data sources using Lakehouse Federation, without copying data into Databricks.

GAPricingDeveloper toolsSource

Unity CatalogSep 15, 2026

The READ METADATA privilege will soon be available by default for workspaces with the compliance security profile enabled

The READ METADATA privilege will be available by default for workspaces with the compliance security profile enabled in mid-October 2026. READ METADATA grants read-only visibility into an object's metadata, including security-sensitive information that BROWSE doesn't expose, such as privilege grants, row filters and column masks, and ABAC policies.

UpdateGovernanceSecuritySource

Unity CatalogSep 15, 2026

Sharing foreign Delta tables with OpenSharing is now generally available

Sharing and reading foreign Delta tables with OpenSharing is now generally available. Providers can share Delta-format tables federated from OneLake, a Hive metastore, or AWS Glue, without copying data into Databricks. See Add foreign Delta tables to a share .

GASource

Unity CatalogSep 15, 2026

Data Classification now scans Unity Catalog views (Beta)

Data Classification can now scan Unity Catalog views in addition to tables, classifying columns for sensitive data using the same detection engine. This is a Beta feature. See Classify views .

BetaGovernanceObservabilitySource

Unity CatalogSep 16, 2026

VARIANT cast extends to ARRAY and MAP columns in ABAC column masks

You can now use a single VARIANT function to mask columns of type ARRAY and MAP , in addition to STRUCT and other types. This requires Databricks Runtime 19 or above. See Masking multiple column types with a single function .

UpdateGovernanceSource

Unity CatalogAug 31, 2026

ABAC GRANT policies are generally available for models and services

ABAC GRANT policies for models, model services, model provider services, Model Context Protocol (MCP) services, and agent services are now generally available. These policies dynamically grant Unity Catalog privileges to securable objects whose governed tags match a condition, instead of granting privileges on each object individually.

GAAI agentsMCPGovernanceSource

Also shipped on Sep 8, 2026

Google Cloud BigQuerySep 8, 2026

Conversational analytics now supports predictive modeling questions using the AI.PREDICT function

Conversational analytics now supports predictive modeling questions using the AI.PREDICT function . This feature is in Preview .

PreviewSource

Snowflake SnowflakeSep 8, 2026

Add and drop hybrid table constraints online (General availability)

With this release, you can add and drop UNIQUE and FOREIGN KEY constraints on an existing hybrid table by using alter table . Previously, you had to define these constraints when you created the table, so adding a foreign key to a table that was already serving a workload meant recreating and reloading the table.

GASource

Snowflake SnowflakeSep 8, 2026

Shadow traffic for gateways (Preview)

With this preview release, you can use a shadow traffic gateway to send all production requests to a primary service endpoint while mirroring a percentage of those requests to one or more shadow endpoints. Responses from shadow endpoints aren't returned to clients.

PreviewData integrationSource

Snowflake Snowflake OpenflowSep 8, 2026

Second generation Openflow deployments and runtimes (General availability)

Second generation (gen 2) Openflow deployment and runtime SQL objects are now generally available on AWS and Azure. Create, modify, and remove gen 2 deployments and runtimes with CREATE , ALTER , DROP , SHOW , and DESCRIBE commands, or through the Openflow UI, with standard Snowflake RBAC on schema-scoped objects.

GASQLStreamingData integrationSource

Google Cloud Gemini EnterpriseSep 8, 2026

Gemini Enterprise: Semantic search support in Google Cloud Marketplace (Preview)

The agent search in Google Cloud Marketplace now supports semantic search, allowing you to find agents by describing their functionality (for example, "generate reports" or "translate text") without needing exact keyword matches. For more information, see Add and manage A2A agents from Google Cloud Marketplace .

PreviewAI agentsLLMsVector searchSource

OpenAI OpenAI APISep 8, 2026

OpenAI Prompt Cache Diagnostics is generally available in the Responses API

For GPT-5.6 and later, developers can compare cache reuse against a previous response, see reasons for cache misses and follow guidance to improve cache hit rates.

GALLMsDeveloper toolsSource