What is Fine-Grained Access Control?

Definition
Fine-Grained Access Control (FGAC) means controlling data access at the row, column, or even cell level, rather than just at the table or database level. It lets you share a single physical dataset across many users while enforcing who can see which specific rows and columns.
The Core Problem:

Traditional access control treats entire tables as the smallest unit: either you can query the whole table or you cannot. But when you centralize petabytes of data from multiple business units into one warehouse, this breaks down. You might have customer support tickets where US support agents should only see US customers, EU agents only EU customers, and legal sees everything.

Copying data into separate restricted tables creates a maintenance nightmare. With thousands of users and hundreds of tables, you would end up with tens of thousands of filtered copies that diverge as schemas evolve.

The Three Control Dimensions:

FGAC operates across three dimensions. First, row level security filters which rows you see based on predicates. For example, adding WHERE customer_region IN user_permitted_regions to every query.

Second, column level security controls which columns appear in results. Analysts might see aggregate revenue but not individual customer names.

Third, dynamic data masking transforms values based on who is querying. A manager sees full credit card numbers, while customer service sees only the last four digits. The same physical column returns different values depending on caller identity.

✓ In Practice: Systems like Databricks Unity Catalog, Snowflake, BigQuery, and AWS Lake Formation all implement variations of FGAC. The patterns are general: evaluate policies close to the data engine, push filters down to storage, and centralize policy definitions so you do not duplicate business logic.

The fundamental shift is from "can you access this table" to "can you access this specific row and column given your attributes and the data's sensitivity classification."

💡 Key Takeaways

✓FGAC controls access at row, column, or cell level rather than entire tables

✓Row level security adds filter predicates, column security hides columns, masking transforms visible values

✓Centralizing data without FGAC would require maintaining thousands of filtered copies

✓Modern data platforms evaluate policies in the query engine and push filters to storage

✓Decision is enforced based on caller identity attributes like role, region, or clearance level

📌 Examples

1Support agent queries customer table but only sees customers from their assigned region due to row filter

2Analyst runs revenue query and sees totals but customer names are masked to NULL due to column restrictions

3Same credit card column returns full number to fraud team but only last 4 digits to customer service based on role

← Back to Fine-grained Access Control & Policies Overview