A Unity Catalog row filter fails when its lookup table is filtered too

A protected fact table uses a lookup table to decide which rows a user may see. The lookup table also has a row policy, and a query fails when the two policies interact. A Databricks community discussion surfaced this design problem; the discussion itself was only accessible as a search lead in this research session.

Identify the policy graph

Capture the full error class, the protected table, policy function and every table read by that function. Databricks documents an unsupported nested row or column access policy error. The important question is whether a policy evaluation itself reads another protected relation. Do not infer that a failed query means the user should receive broader table privileges.

Redesign the entitlement lookup

Review the Unity Catalog row-filter and column-mask limits. A security-owned entitlement table or a carefully designed dynamic view may remove the nested evaluation, but each option has a different ownership and audit model. Keep the entitlement source narrow: user or group, allowed business key, effective period and change owner. Test both positive and negative access cases using non-admin identities.

Make the failure safe

Queries that hit a policy error should stop. Avoid a fallback that returns an unrestricted table, and avoid removing the lookup policy merely to make the dashboard green. Include policy dependency checks in deployment review, because a later policy on the lookup table can break a formerly valid fact-table filter.

Adovo’s view

An access rule is a small program with dependencies. If the dependencies change, the rule must be retested like any other production code. A secure failure is inconvenient; an invisible permission expansion is worse.