Certify and Deprecate Data with Unity Catalog Tags

1.What a certified badge tells a data consumer

A large catalog usually holds several tables that look like they answer the same question: a carefully maintained sales table, an analyst's scratch copy, and a summary nobody has refreshed in a year. Unity Catalog lets the organization say which one to trust. Certifying an asset signals that it meets your organization's standards. Deprecating an asset warns people that it is outdated. Databricks describes this as a layer that sits on top of your metric views, domains and Pages: certification adds a layer of trust and authority on top of those definitions. Genie One also uses the signal and prioritizes the assets your organization vouches for.

Under the hood, certification is just a tag. The key is system.certification_status, and the workspace turns its value into a visual badge. The badge appears next to object names in the workspace and also changes how the data appears in notebooks and the SQL editor. Analysts therefore see the warning where they write queries, not only when they browse the catalog.

The tag isn't limited to tables. You can apply it to catalogs, schemas, tables, views, volumes, functions, registered models, dashboards, Genie Agents, Databricks Apps and notebooks. A team can therefore certify both a gold table and the dashboard built on top of it.

Sources1

2.Applying the certification status tag

Two separate permission checks apply. The first is on the tag itself. Because system.certification_status is a governed tag, you need the ASSIGN permission on that governed tag. The second is on the object you are tagging: you must own it, or hold APPLY TAG on it plus USE SCHEMA on its parent schema and USE CATALOG on its parent catalog. In the steward's case, APPLY TAG and the USE privileges cover only the object. Without ASSIGN on the tag, they cannot certify it.

Once the permissions are in place, you can set the status in the workspace UI or in SQL. In the UI, you work from the object's kebab menu, and the dialog offers a third choice, None, which clears the status. You can change or remove the status at any time, so deprecating a table is not a one-way decision.

In SQL, certification is an ordinary SET TAG statement. The tag key and its value are both wrapped in backticks, and the table is named with its full three-level name.

-- Apply certified tag key
SET TAG ON TABLE main.sales.transactions `system.certification_status` = `certified`;

SET TAG ON TABLE main.sales.old_summary `system.certification_status` = ` ? `;

Sources1

3.Governed tags, and certifying at scale

Certification is one case of a more general feature. Tags are keys with optional values that you attach to securable objects to organize them, and they make tables and views easier to find through workspace search. Ordinary tags are free-form, so one team might write PII while another writes pii. Governed tags fix this. An admin marks a tag key as governed and defines its allowed values. For example, a governed sensitivity tag might accept only public, internal or restricted. After that, only users with ASSIGN on the governed tag can set its values, and changing the tag's definition requires MANAGE on it. Because tag data is stored as plain text and may be replicated globally, tag names and values should never contain personal or sensitive information.

-- Update the description.
ALTER GOVERNED TAG pii SET DESCRIPTION 'Indicates what kind of personal identifiable information the asset contains';

-- Replace the allowed values list.
ALTER GOVERNED TAG sensitivity_level SET VALUES ('low', 'medium', 'high');

Two details matter here. First, SET VALUES replaces the whole list of allowed values; it does not add to it. Second, if an admin deletes a governed tag, its assignments become ungoverned, and anyone with APPLY TAG can then change them without ASSIGN.

Setting the tag by hand works for a few tables, but not for hundreds. To certify or deprecate many objects, Databricks recommends automating tag assignment (Beta). An automation assigns system.certification_status to every table or volume that matches conditions you define, such as query usage, asset age, owner, description, name or existing tags. The documented example finds every table in a temp catalog that has had no read or write queries in 30 days, marks it deprecated, and emails the owners.

Finally, don't confuse tagging a container with tagging its contents. When you tag a catalog, its schemas and tables inherit that tag only while attribute-based access control (ABAC) policies are evaluated, and even then the tag does not reach the column level. For every other purpose, including what a user sees on a table, each object keeps only its own tags.

Sources2341

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.Anyone with APPLY TAG on a table, plus USE SCHEMA and USE CATALOG, can mark it certified.Why is that wrong?

   Those privileges are enough for ordinary tags only. Certification is a governed system tag, so the user also needs ASSIGN on system.certification_status.

   Covered in Applying the certification status tag

2. 2.Tagging a catalog or schema automatically tags every table beneath it.Why is that wrong?

   Child objects inherit tags only while ABAC policies are evaluated, and never at the column level. Otherwise, each object carries only its own tags.

   Covered in Governed tags, and certifying at scale

3. 3.ALTER GOVERNED TAG ... SET VALUES adds the listed values to the existing allowed values.Why is that wrong?

   SET VALUES is declarative. The list you provide replaces every existing allowed value.

   Covered in Governed tags, and certifying at scale