Release 9.2.33.1¶

Fixed Principal Validation Running When Metadata Integration Is Disabled¶

Fixed an issue where principal-validation checks against the metadata integration occasionally ran even when the feature was not enabled, causing intermittent, incorrect errors during role-grant operations.

Policies Can Now Be Scoped to a Higher-Level Resource on Their Own¶

Previously, for MSSQL, MSSQL_19, Databricks SQL Analytics, Redshift, and Lake Formation, a policy had to specify a value all the way down the resource hierarchy (for example, database, schema, and table) even if the intent was to grant access to only the database or the schema. Now, a policy can stop at a higher-level resource and still be saved and enforced on its own — it only applies to the resource mentioned in the policy.

This is now supported for the following resource levels:

• MSSQL and MSSQL_19: database, schema, table
• Databricks SQL Analytics: global, database, table
• Redshift: global, table
• Lake Formation: catalog, tag

Fixed Tag Row-Level Filtering Not Activating After Enabling¶

Fixed an issue where Tag Row-Level Filtering (RLF) was not activated for a service after enabling the feature, causing the updated configuration to not take effect in the service definition cache.

Tag Resources APIs Now Support Enabled-Service Filtering¶

Added the onlyEnabledServices query parameter to the Tag Resources APIs. When onlyEnabledServices=true, the APIs return only resources from enabled services.

Security Fixes¶

Resolved multiple security vulnerabilities to strengthen platform protection and reduce risk exposure.

Fixed Missing entityId and Incomplete Audit Event Payloads¶

Resolved an issue where some audit events had missing entityId values and incomplete payload data. Audit events now capture complete payloads and include entityId whenever available.

Fixed Failure When Re-importing an Exported Scheme¶

• After exporting a scheme, re-importing it could fail or silently drop configured values due to encoding and stale-ID issues.
• These issues are now fixed, and previously exported files remain importable.

Fixed Missing POLICY_RESPONSE Events During Concurrent Offline and On-Demand Processing¶

• Fixed an issue where PolicySync could emit ACCESS audit events for applied grants without the matching POLICY_RESPONSE events when offline and on-demand ChangeLog processing ran in parallel.
• Offline and on-demand processors now use separate policy-grant audit accumulators, so POLICY_RESPONSE counts match applied policies under dual-queue load.

Fixed Empty ChangeLog ID and Type on ACCESS Audit Events Under Load¶

• Fixed an issue where ACCESS audit events could show empty ChangeLog ID and ChangeLog Type during heavy policy updates.
• These fields are now populated correctly so each grant or revoke can be traced back to the related policy change.

Fixed Row Filter Not Re-Applied Before SELECT on Dropped/Recreated Native Tables for Databricks Unity Catalog Connector¶

• Fixed an issue where, for the Databricks Unity Catalog connector, the connector could grant SELECT on a native table with a Row-Level Security (RLS) policy before re-applying the row filter after the table was dropped and recreated.
• The connector now re-applies the row filter (SET ROW FILTER) before basic access grants such as GRANT SELECT.
• If SET ROW FILTER fails, the connector fails closed and does not issue GRANT SELECT, so access is never granted on an unfiltered table.

Lake Formation — Improved Permission Update Performance¶

Resolved an issue that could cause Lake Formation permission updates to take longer than expected when many changes were processed at the same time. Permission updates are now faster and more reliable.

Collibra Tag Sync — Loader and Apply Activity Now Visible in Audits¶

The Collibra connector now records its tag-sync work in the PolicySync audit screen. You can see loader progress (Started / In-progress / Completed) and one clear audit row — including the table/column name — for each tag applied to or removed from a resource. Tag-definition creation and deletion events are also shown, and recovery-mode events now display the correct event type. (This also improves Purview tag-sync audits, since the apply logic is shared.)

Collibra Tag Sync — Tag Definitions Are Now Removed on Full Delete¶

When a tag is removed from its last asset in Collibra, the connector now also removes the leftover tag definition, so Ranger stays in sync with Collibra. This is controlled by a new setting tag.sync.skip.delete.tagdefs. When true, tag-definition deletes are skipped. The default is true for Purview and other connectors. Collibra sets it to false so tag-definition deletes are applied.

Omni Support for PostgreSQL Connector¶

Added Omni support for the PostgreSQL connector, enabling integration with the Omni Metadata Service for centralized metadata and governance.

BigQuery — Fixed Public Group Permission Sync and Revoke¶

Fixed an issue where, when the permission loader ran concurrently, public-group grants (ALL_USERS / ALL_AUTHENTICATED_USERS) could be re-granted on every sync and could remain in place after a policy was disabled. Public grants for these identities now sync and revoke reliably.

BigQuery Omni — Fixed Hierarchical Tag Evaluation for Policy Enforcement¶

Fixed an issue where, when Omni is enabled for BigQuery, newly attached hierarchical tags on resources were not evaluated correctly. Hierarchical tag-based access control, masking, and filtering policies now apply as expected.

MSSQL — Added Support for Configurable Purview Server Name¶

Added support to configure the server name used in Microsoft Purview qualified names for SQL Server Availability Group (AG) deployments.

Asset Pickers Now Show Only Enabled Services¶

The Add Asset picker in Omni Policy and the Product Assets filter now show only enabled services. If the selected service is disabled in the Data Catalog Explore view, the selection automatically moves to the next enabled service. This update also includes minor UI improvements to the sidebar tour.

Diagnostics Server UI Migrated to Trust3 AI Theme¶

Migrated the Diagnostics Server UI from the legacy Privacera theme to the Trust3 AI theme, aligning the interface with the latest product branding and ensuring a consistent user experience.

Support for Cloning a Connector¶

You can now clone an existing connector to quickly create a new one that reuses all of its application settings. Connection details, managed resource lists, and secrets are left blank for you to fill in, so you only enter what is unique to the new connector.

Connector Logging Configurations on the Connector Configs Tab¶

Logging Configurations are now surfaced directly on the Connector Configs tab, alongside the other connector settings, so you no longer need to switch tabs to adjust log levels during connector setup and troubleshooting. Previously, these settings lived only on the Kubernetes Configs tab.

Runtime Plane — PostgreSQL Connector¶

The PostgreSQL connector now supports deployment and management through the Runtime Plane in the Privacera portal (Settings → Runtime Plane).

Supported connectors (cumulative):

• Microsoft SQL Server (MSSQL)
• Databricks Unity Catalog (DBX UC)
• Snowflake
• GCP BigQuery
• Databricks SQL Analytics
• AWS Lake Formation (Supported in EKS Only)
• Amazon Redshift
• PostgreSQL