ABAC DENY policies

Unity Catalog ABAC policies that explicitly deny a privilege to chosen principals on objects whose governed tags match a condition, and take precedence over any grant, including privileges that come from object ownership. Only MANAGE ACCESS CONTROL can be denied so far, which stops those principals from granting or revoking privileges, changing ownership or managing ABAC policies on the matched objects.

Status and dates are extracted from public sources only. We don't see the private AE-shared roadmap. If something looks wrong, tell us.