E4 — Governance and Security

Why this module matters

15% of the Associate exam, and the section with the shortest half-life. Ingestion syntax from 2024 still mostly works. Governance syntax from 2024 will get you a question wrong: CREATE POLICY didn't exist, MANAGE behaved differently, Delta Sharing hadn't been renamed, and half the system tables weren't there.

It's also the section where being wrong in production is worst. A misconfigured Auto Loader loses data you can re-ingest. A misconfigured grant hands your salary table to the contractors group, and you find out from your CISO.

What the exam actually asks

The May 2026 exam guide (exam version as of May 4, 2026) lists exactly four objectives for Section 7, quoted verbatim:

Differentiate between managed and external tables in Unity Catalog and perform basic operations (create, modify, delete, and convert between managed and external tables) on them.

Configure access controls using the UI and SQL by applying GRANT, REVOKE, and DENY privileges to principals (users, groups, and service principals) at appropriate levels of the security hierarchy.

Understand column-level masking and row-level security to restrict data visibility based on user groups.

Understand Unity Catalog ABAC policies to centrally control row-level filtering and column masking for sensitive data.

Source: Databricks Certified Data Engineer Associate exam guide, May 2026

Two things to notice.

ABAC is on the exam by name. It's the newest governance feature in the whole platform, and the guide names it explicitly. Lesson 2 is therefore the highest-value-per-minute lesson in this module.

The guide says DENY. The SQL reference says DENY doesn't work in Unity Catalog. That's a real, current contradiction between two live Databricks documents, and lesson 1 deals with it head on rather than pretending it isn't there.

The one idea to hold onto

Unity Catalog governance has moved through three generations, and all three are still live:

  GEN 1                    GEN 2                        GEN 3
  ┌──────────────────┐     ┌─────────────────────┐      ┌────────────────────────┐
  │ GRANT / REVOKE   │  →  │ Row filters,        │  →   │ ABAC policies          │
  │ on securables    │     │ column masks,       │      │ (governed tags +       │
  │                  │     │ dynamic views       │      │  CREATE POLICY)        │
  └──────────────────┘     └─────────────────────┘      └────────────────────────┘
   per-object grants        per-table SQL UDFs           per-tag, catalog-wide,
                                                         automatic on new tables

"Databricks recommends ABAC policies when you need consistent row filtering and column masking across many tables. ABAC policies attach at the catalog or schema level and apply automatically based on governed tags, rather than requiring per-table configuration." — Row filters and column masks (updated 2026-07-30)

Same shape as E1's ingestion story: start at the most managed layer. Reach for a table-level ALTER TABLE ... SET ROW FILTER only when a tag-driven policy genuinely can't express the rule.

What you'll be able to do

Name the privileges that matter, explain inheritance, and debug the "but I granted them access!" ticket in under a minute.
Explain what MANAGE does — including the behavior change landing August 3, 2026.
Create a governed tag, tag a column, and write a CREATE POLICY row filter and column mask.
Write table-level row filters and column masks from memory, and say when you'd use a dynamic view instead.
Query system.access.audit to answer "who granted this, and when?"
Explain lineage coverage and its limits, including external lineage.
Share a table with another org through OpenSharing, and isolate a catalog to specific workspaces.

Lessons

#	Lesson	Read	Listen
1	The privilege model in depth	30 min	11 min
2	ABAC and governed tags	32 min	14 min
3	Fine-grained access: filters, masks, dynamic views	30 min	13 min
4	Lineage, auditing, and system tables	28 min	12 min
5	Sharing and isolation	25 min	11 min

Then: Cheat sheet · Lab · Quiz

This module assumes E0.3 — Unity Catalog's object model. E0.3 gives you the hierarchy, the three-level namespace, and the one-metastore-per-region rule. E4 does not repeat them.

A note on the docs

Researching this module surfaced four live inconsistencies in Databricks' own material. All four are flagged where they arise, because each one will cost you an afternoon if you meet it cold:

The exam guide says DENY; the DENY SQL reference says Unity Catalog doesn't support it. (L1)
The permissions-concepts page describes MANAGE behavior that stops being true on 2026-08-03, per the What's coming page. (L1)
"Delta Sharing" and "OpenSharing" both appear in current docs, sometimes in the same page, more than a month after the rename. (L5)
Governed tags carry no published GA/Preview label on the pages that would carry it, while the system.tags.governed_tags system table is explicitly labelled Beta. (L2)

Facts verified 2026-07-31 against the pages cited in each lesson.

Keeps playing into the following modules — 374 min from here to the end of the course.