Unity Catalog Adds Governed Tag Propagation to Derived Tables and Views

A column containing a customer's Social Security number can remain sensitive even after it moves into another table. The problem is that data transformations often create new tables and views without carrying over the original security tags. Someone then has to apply those tags again. If the team misses a table, an existing access policy might not protect the derived data as expected.

Databricks is addressing this problem with governed tag propagation in Unity Catalog, which entered Beta on October 12, 2026. When you enable propagation for a governed tag, Unity Catalog uses data lineage to apply that tag automatically to eligible tables and views created from tagged sources.

This is useful for teams that use governed tags with attribute-based access control (ABAC). A tag such as pii can identify sensitive data, while an ABAC policy can use that tag to decide whether a column should be masked or access should be restricted.

The feature reduces manual tagging, but there is one detail developers must understand: propagation happens asynchronously. A newly created table or view might not receive its tags immediately, and ABAC policies that depend on those tags do not apply to the derived object until the tags arrive.

What Are Governed Tags in Unity Catalog?

Governed tags are centrally managed labels that help organizations classify data and apply consistent rules to it. Unlike ordinary custom tags, governed tags have controlled values and permissions for assigning them.

For example, a company might define these tags:

Tag	Example value	Purpose
`data_classification`	`confidential`	Identify data that requires extra protection
`pii`	`ssn`	Identify a column containing Social Security numbers
`data_region`	`eu`	Classify data according to a region
`retention_class`	`restricted`	Identify data that follows a specific handling policy

These are illustrative tag names and values. Your organization can define governed tags according to its own classification rules.

A governed tag does not, by itself, mask a column or block a query. It supplies metadata that other governance features can use. With ABAC, administrators can create policies that match governed tags and apply row filters, column masks, or other supported access rules.

The challenge is keeping those tags attached to the right data when developers create new tables and views.

Why Tag Propagation Matters

Suppose a customer table contains a column named ssn. An administrator assigns the governed tag pii = ssn to that column and configures an ABAC policy to mask it for users who should not see the original value.

The source table is protected. But a data engineer might create another table for reporting:

CREATE TABLE analytics.customer_report AS
SELECT
    customer_id,
    customer_name,
    ssn
FROM production.customers;

The new table contains the same sensitive information. Without tag propagation, the governed tag does not automatically carry over just because the data came from a tagged source.

Someone would have to identify the new column and tag it manually. The more tables a data pipeline creates, the easier it becomes to miss one.

With governed tag propagation enabled for the relevant tag, Unity Catalog uses lineage from supported operations to identify the source and apply the tag to the corresponding column in the derived table.

This helps keep data classification consistent as information moves through the platform.

How Governed Tag Propagation Works

The process has three main parts.

1. An administrator enables propagation for a governed tag

Tag propagation is disabled by default for each governed tag. A user with MANAGE permission on the tag must enable it individually.

For tags that have allowed values, the administrator also selects a default propagation value to use when a conflict occurs.

2. A developer creates or updates a derived object

The developer runs a supported operation, such as CREATE TABLE AS SELECT or CREATE VIEW, using serverless compute.

Unity Catalog uses the recorded data lineage to identify which source tables and columns contributed to the result.

3. Unity Catalog applies the tags in the background

The propagation process runs asynchronously. It does not block the SQL operation, and tags usually appear on the derived object within minutes.

Once a governed tag reaches a derived column, an ABAC policy that matches that tag can apply to the derived data.

The important limitation is the delay between creating the object and receiving its tags. During that interval, policies that depend on the propagated tag are not enforced on the derived object until the tag appears.

Which SQL Operations Support Tag Propagation?

The Beta feature supports several common operations when they run on serverless compute.

Operation	What propagation does
`CREATE TABLE AS SELECT`	Applies eligible tags to the new table and corresponding columns
`CREATE VIEW`	Applies tags to the new view
`ALTER VIEW`	Propagates eligible tags when the view is updated
`CREATE OR REPLACE VIEW`	Applies tags based on the supported operation and source lineage
`INSERT INTO ... SELECT`	Propagates eligible tags to the target table
`MERGE`	Propagates eligible tags when the target is updated from source data
`CLONE`	Propagates table-level tags only

Column-level propagation matters because a table can contain a mix of public and sensitive data. If only the ssn column carries a sensitive tag, the goal is to keep that classification attached to the corresponding column in downstream objects instead of marking every column as sensitive.

The feature does not support every object or operation. In particular, propagation is not supported for streaming tables or materialized views created by Lakeflow Declarative Pipelines. Classic compute is also unsupported.

How to Enable Governed Tag Propagation

Before enabling the feature, check that governed tags are enabled for your account and that your workspace is attached to a Unity Catalog metastore. A workspace administrator must also enable the Tag propagation preview.

To configure propagation for a governed tag:

Open your Databricks workspace and select Catalog.
Click Govern and choose Governed Tags.
Select the tag you want to propagate.
Click Configure to open the tag propagation settings.
Turn on the Tag propagation option.
If the tag has allowed values, select the default value to use when propagation encounters a conflict.
Save the configuration.

You need MANAGE permission on the governed tag to enable or disable propagation and choose its default propagation value.

Repeat these steps for every governed tag that should propagate. Enabling propagation for one tag does not enable it for all tags in the account.

Handling Conflicts Between Source Tags

Conflicts can occur when a derived table uses data from multiple sources with different tag values.

Imagine that two source tables have a governed tag named sensitivity_level. One source has the value internal, while the other has the value confidential.

A query combines data from both tables:

CREATE TABLE analytics.combined_customers AS
SELECT customer_id, sensitivity_level
FROM production.customer_records

UNION ALL

SELECT customer_id, sensitivity_level
FROM production.partner_records;

This example assumes that both source tables contain compatible columns. It illustrates a situation where the sources carry different governed tag values for the same tag key.

Unity Catalog cannot simply copy both values onto the target as separate assignments for the same governed tag key. It uses the default propagation value configured by the tag administrator when a conflict occurs.

For a classification tag, the administrator might choose a default that represents the most restrictive applicable classification. The right choice depends on the organization's policy, so it should be decided before enabling propagation.

Without a sensible conflict rule, a derived table could receive a classification that does not match the organization's intended handling requirements.

How Propagation Works With ABAC

ABAC uses attributes associated with data objects to decide which access policies apply. Governed tags supply those attributes.

For example, an organization might define a column mask for a governed tag that identifies Social Security numbers. The policy can then apply to tables and derived columns that carry the matching tag.

A simplified masking function might look like this:

CREATE OR REPLACE FUNCTION governance.mask_ssn(value STRING)
RETURNS STRING
RETURN CASE
    WHEN is_account_group_member('ssn_readers') THEN value
    ELSE '***-**-****'
END;

This function is an illustrative example of a masking rule, not a complete ABAC policy configuration. Registering the function does not automatically apply it to every tagged column. An administrator must configure the appropriate ABAC column mask policy and associate it with the governed tag.

Once the tag propagates to a derived column, the matching policy can protect that column without requiring someone to assign the tag manually.

This is where the feature saves ongoing maintenance work. The classification follows the data through supported transformations, and the existing policy can continue to recognize it.

Do not ignore the propagation delay

There is a security consideration here. Tag propagation runs in the background, so a derived object may temporarily exist without the tag that will eventually be applied.

During this interval, ABAC policies that rely on the propagated tag are not enforced on that object until the tag appears.

For sensitive data, do not assume that creating a derived table immediately makes it subject to every policy attached to its source. Review the workflow and make sure your access controls account for this delay before exposing the derived object to users or applications.

Requirements and Limitations

Governed tag propagation has several restrictions developers and administrators should understand.

Beta availability: The feature is in Beta and may change.
Serverless compute: Supported operations must run on serverless compute. Classic compute is not supported.
Governed tags only: Custom, ungoverned tags do not propagate.
Table securables only: Propagation covers table-level and column-level tags. Volumes and other Unity Catalog securables are not supported.
Pipeline limitations: Streaming tables and materialized views created by Lakeflow Declarative Pipelines are not supported.
Tag limit: A single object can have at most 50 tags, including propagated tags.
Asynchronous behavior: Tags usually appear within minutes, but there is a delay before the related ABAC policies apply to the derived object.

These limitations mean you should test propagation with the actual SQL operations and compute type used by your pipelines rather than assuming it works for every table creation method.

Advantages and Disadvantages

Advantages

Less manual tagging: Developers do not have to reapply every governed tag to each supported derived object.
More consistent classification: Tags can follow data through supported table and view transformations.
Better ABAC coverage: Existing policies can apply to derived columns when their governed tags propagate.
Centralized conflict handling: Administrators define a default value for conflicts instead of leaving every pipeline to handle them differently.
Clearer governance metadata: Catalog Explorer distinguishes propagated tags from directly assigned, inherited, and automatically applied tags.

Disadvantages

Propagation is not immediate: The delay can matter for sensitive data.
Only selected operations are supported: Some pipeline objects and compute types are outside the feature's scope.
Conflicts need careful decisions: A default propagation value must reflect the organization's classification rules.
Governed tags require administration: The feature does not remove the need to define tags, control assignments, and manage ABAC policies.

Best Practices for Developers and Administrators

Start with the most important classification tags. Enable propagation for tags such as those identifying personal or confidential data, then test the results on representative derived tables and views.

Choose conflict defaults deliberately. If different source tables carry different values for the same tag, decide how the target should be classified before enabling propagation.

Check tags after creating derived objects. Use Catalog Explorer to confirm that the expected tags appeared and that the displayed propagation source is correct.

Account for asynchronous enforcement. Do not expose a newly created sensitive-data table on the assumption that propagated tags and ABAC policies are already active. Verify the tag and policy behavior first.

Keep lineage accurate. Propagation depends on lineage from supported operations. Use supported SQL operations on serverless compute and validate the lineage for the resulting objects.

Review the 50-tag limit. A derived object may receive tags from several sources. Plan your tag design so that propagation does not exceed the supported limit.

Conclusion

Governed tag propagation helps Unity Catalog keep data classification consistent as developers create tables and views from existing sources. Administrators enable propagation for individual governed tags, and Unity Catalog uses lineage from supported operations to apply those tags to derived objects.

For organizations using ABAC, the benefit is practical: a policy can continue to recognize sensitive columns after they move downstream, without requiring someone to tag every new table manually.

The feature is in Beta, and its asynchronous behavior matters. Test the supported operations, define clear conflict rules, and verify that propagated tags have arrived before relying on them to protect newly created sensitive data.