A public-health department must stop epidemiologists outside a region from querying other regions’ case rows in the same Unity Catalog table. What should they apply?

Configuring a Unity Catalog row filter that limits visible rows to the principal’s allowed region is the correct control when a public-health department must keep epidemiologists from querying other regions’ case rows in the same table. Row filters enforce row-level security in the catalog so a single governed case table can serve multiple regional principals while each session only returns authorized civic case rows. Applying a Unity Catalog column mask that masks case details based on the user’s assigned region fails by concept because it only hides column values rather than restricting row visibility, so out-of-region epidemiologists can still query and retrieve the case rows they should not see. Assigning Unity Catalog SELECT privilege on the table to the regional epidemiologist group fails by concept because it grants table-wide read access rather than restricting row-level access, so epidemiologists can still query other regions’ case rows they should not see. Publishing a Unity Catalog clone of the table per region with region-specific rows pre-filtered fails by concept because it duplicates data into separate copies rather than enforcing row-level security on the single governed table, so epidemiologists with access to the base table can still query other regions’ rows and the clones create staleness and governance overhead. Exam caveat: Row filters are not column masks, table-level SELECT grants, or per-region clones. Filters constrain which rows appear for a principal; column masks hide column values but leave rows visible; SELECT grants allow all rows; clones copy filtered rows but leave the base table unprotected. Misapplying a column mask, broad SELECT grant, or clone as a security boundary is a common exam distractor that fails confidentiality for multi-region municipal health data. Operational check: Attach the row filter to the case table, map principals to allowed regions, query as an in-region epidemiologist and confirm only that region’s rows return, query as an out-of-region principal and confirm empty or denied results for foreign regions, and review audit or explain plans to show the filter is applied server-side rather than by client habit.