RBAC is not enough: attribute-based access in practice

RBAC is great when your access rules map cleanly to org structure. Real data governance rules rarely do. "Analysts can see PII for customers in their assigned region, masked otherwise, unless the query is part of an audit" is not an RBAC rule.

ABAC policies, versioned alongside the catalog

allow {
  input.user.attributes.region == input.row.region
  input.user.clearance >= input.column.sensitivity
}

Policies live in the catalog. They version with the table. A policy change opens a branch just like a schema change does.