Time travel with ABAC policies
Time travel on tables with ABAC policies is in Beta. To use this feature, enable the Time Travel on UC Managed Tables with Attribute-Based Access Controls preview. Queries on standard compute require Databricks Runtime 19 or above; serverless compute is also supported.
Time travel lets you query historical table data using a specific timestamp or a version number from the Delta Lake transaction log.
Starting in Databricks Runtime 19, time travel queries on qualifying tables enforce ABAC row filter and column mask policies. SQL queries can use TIMESTAMP AS OF, VERSION AS OF, or the @ syntax in a table identifier, such as table_name@v1 or table_name@20240101000000000. DataFrame queries can use the timestampAsOf or versionAsOf option.
Requirements
The table and compute must meet all of the following requirements:
- The query runs on standard compute using Databricks Runtime 19 or above, or serverless compute. Queries on dedicated compute aren't supported.
- The table is a Unity Catalog managed Delta table with catalog commits enabled, or a managed Iceberg table.
- For managed Delta tables, column mapping is enabled in both the current table version and the historical version being queried, using the same column mapping mode.
How time travel works with ABAC policies
For time travel queries that enforce ABAC policies, Databricks reads the requested historical table version and compares its schema with the current table schema. Databricks returns only columns that exist in both schemas, so columns that exist in only the historical or current schema aren't exposed. It then applies the ABAC policies currently defined on the table to the historical data for the querying user.
If a current policy depends on a column that is missing or incompatible in the historical version, the query fails closed rather than returning unprotected data.
Best practices
- Keep column mapping enabled and use the same column mapping mode for every table version that users might query.
- Before you apply or change a policy, verify that each column referenced by the policy exists with a compatible definition in every historical version that users must query.
- Test representative time travel queries after changing the table schema or its policies to confirm the expected columns, row filtering, and masking.
Limitations
Time travel on tables with table-level row filters or column masks isn't supported.