From 73d2cd8178c46e7530d1d8455c2b8c8757f45106 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Mon, 24 Aug 2026 17:56:25 +0800
Subject: [PATCH 01/12] [api][spark] Add REST permission management

---
 docs/README.md                                |   2 +-
 docs/docs/concepts/rest/index.md              |   3 +-
 docs/docs/concepts/rest/management-api.md     | 118 ++++
 docs/scripts/validate-rest-openapi.js         | 504 +++++++++++++-----
 docs/sidebars.js                              |   3 +-
 docs/static/rest-management-open-api.yaml     | 361 +++++++++++++
 .../apache/paimon/management/ColumnMask.java  |  68 +++
 .../paimon/management/ColumnSelection.java    |  69 +++
 .../management/ListPermissionsRequest.java    |  92 ++++
 .../apache/paimon/management/Permission.java  | 213 ++++++++
 .../management/PermissionManagement.java      |  31 ++
 .../paimon/management/ResourceType.java       |  33 ++
 .../apache/paimon/management/RowFilter.java   |  68 +++
 .../java/org/apache/paimon/rest/RESTApi.java  |  48 ++
 .../paimon/rest/RESTCatalogOptions.java       |   7 +
 .../paimon/rest/RESTPermissionManagement.java |  57 ++
 .../org/apache/paimon/rest/ResourcePaths.java |  14 +
 .../rest/requests/GrantPermissionRequest.java | 187 +++++++
 .../requests/RevokePermissionRequest.java     | 162 ++++++
 .../responses/ListPermissionsResponse.java    |  74 +++
 .../PermissionManagementJsonTest.java         | 109 ++++
 .../rest/RESTPermissionManagementTest.java    | 232 ++++++++
 .../RequestJacksonCompatibilityTest.java      |   2 +
 .../org/apache/paimon/rest/RESTCatalog.java   |   6 +
 .../apache/paimon/rest/RESTCatalogServer.java | 120 +++++
 .../PaimonSqlExtensions.g4                    |   8 +-
 .../apache/paimon/spark/SparkProcedures.java  |   6 +
 .../procedure/BasePermissionProcedure.java    | 316 +++++++++++
 .../procedure/GrantPermissionProcedure.java   | 110 ++++
 .../procedure/ListPermissionsProcedure.java   | 158 ++++++
 .../procedure/RevokePermissionProcedure.java  |  98 ++++
 .../PaimonSparkTestWithRestCatalogBase.scala  |   7 +-
 .../procedure/PermissionProcedureTest.scala   | 140 +++++
 33 files changed, 3287 insertions(+), 139 deletions(-)
 create mode 100644 docs/docs/concepts/rest/management-api.md
 create mode 100644 docs/static/rest-management-open-api.yaml
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/Permission.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
 create mode 100644 paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
 create mode 100644 paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
 create mode 100644 paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala

diff --git a/docs/README.md b/docs/README.md
index 67d65ae18e9f..5e7ba5586c36 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -22,7 +22,7 @@ The site will be available at http://localhost:3000/docs/master/.
 ## Build
 
 ```bash
-# Validate the REST Catalog OpenAPI contract
+# Validate the REST OpenAPI contracts
 yarn test:rest-openapi
 
 # Production build
diff --git a/docs/docs/concepts/rest/index.md b/docs/docs/concepts/rest/index.md
index bd8ada4b6712..8ed168cd4434 100644
--- a/docs/docs/concepts/rest/index.md
+++ b/docs/docs/concepts/rest/index.md
@@ -63,4 +63,5 @@ RESTCatalog supports multiple access authentication methods, including the follo
 
 ## REST Open API
 
-See [REST API](./rest-api).
+See [REST Catalog API](./rest-api) for catalog operations and
+[REST Management API](./management-api) for permission management.
diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
new file mode 100644
index 000000000000..5e5355b57288
--- /dev/null
+++ b/docs/docs/concepts/rest/management-api.md
@@ -0,0 +1,118 @@
+---
+title: "REST Management API"
+hide_table_of_contents: true
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+The OpenAPI 3.1 document below defines the language-neutral control-plane contract for listing,
+granting, and revoking permissions on Paimon catalog resources.
+
+The permission payload uses a flat resource-oriented model. User and role lifecycle,
+authentication, policy persistence, and authorization decisions remain responsibilities of the
+REST Catalog server implementation.
+
+## Client configuration
+
+Permission management is provided directly by `RESTCatalog`; it is not part of the generic
+`Catalog` interface. Configure the remote catalog identifier used in the management endpoint with
+`management.catalog`. The value identifies the `{catalog}` path parameter and is independent of an
+engine's local catalog alias.
+
+For Spark, this can be supplied by the REST server's config response or configured directly:
+
+```properties
+spark.sql.catalog.paimon.management.catalog=my_remote_catalog
+```
+
+Non-REST catalog implementations fail these operations with an explicit unsupported error.
+
+## Spark SQL
+
+Spark exposes the management contract through procedures. Custom `GRANT` and `REVOKE` grammar is
+not required, so the SQL layer remains a thin adapter over the same Java and REST contracts.
+
+Grant access to selected columns:
+
+```sql
+CALL paimon.sys.grant_permission(
+  resource_type => 'COLUMN',
+  access => 'SELECT',
+  principal => 'role:analyst',
+  database => 'sales',
+  table => 'orders',
+  column_names => array('id', 'amount'),
+  expire_time => '2027-01-01T00:00:00Z'
+);
+```
+
+`resource_type`, `access`, and `principal` are required. `CATALOG_ALL` and `DATABASE_ALL` represent
+permissions inherited by descendant resources. `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` are
+independent table-scoped permissions. Exactly one of `column_names` and `excluded_column_names` may
+be set for `COLUMN`.
+
+Grant a row filter separately. The server compiles the expression into its predicate representation:
+
+```sql
+CALL paimon.sys.grant_permission(
+  resource_type => 'ROW_FILTER',
+  access => 'ROW_FILTER',
+  principal => 'role:analyst',
+  database => 'sales',
+  table => 'orders',
+  row_filter => 'region = ''cn'''
+);
+```
+
+List grants using any combination of exact-match filters:
+
+```sql
+CALL paimon.sys.list_permissions(
+  resource_type => 'TABLE',
+  principal => 'role:analyst',
+  max_results => 100,
+  page_token => '<opaque token from a previous result>'
+);
+```
+
+Listing `CATALOG` also includes `CATALOG_ALL`, listing `DATABASE` includes `DATABASE_ALL`, and
+listing `TABLE` includes `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` rows. The result mirrors the
+flat permission payload with separate JSON columns for columns, row filters, and column masking.
+The next-page token is repeated on each row and is null when no further page exists.
+
+Revoke by stable permission identity. Constraints and expiration are deliberately omitted:
+
+```sql
+CALL paimon.sys.revoke_permission(
+  resource_type => 'COLUMN',
+  access => 'SELECT',
+  principal => 'role:analyst',
+  database => 'sales',
+  table => 'orders'
+);
+```
+
+Grant uses upsert behavior. Revoke identifies a permission by resource type, resource, access, and
+principal; row-filter, column-masking, column-selection, and expiration payloads are not part of
+that identity. Revoking a permission which does not exist may return HTTP 404.
+
+## OpenAPI contract
+
+<body>
+    <iframe src="/docs/master/rest-management-open-api.yaml" width="100%" height="800px" />
+</body>
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index 62e3598cf555..2dabbce60812 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -20,8 +20,7 @@ const fs = require('fs');
 const path = require('path');
 const yaml = require('js-yaml');
 
-const specPath = path.resolve(__dirname, '..', 'static', 'rest-catalog-open-api.yaml');
-const spec = yaml.load(fs.readFileSync(specPath, 'utf8'));
+const HTTP_METHODS = new Set(['get', 'post', 'put', 'delete', 'patch', 'head', 'options', 'trace']);
 
 function check(condition, message) {
   if (!condition) {
@@ -33,82 +32,179 @@ function decodePointerSegment(segment) {
   return segment.replace(/~1/g, '/').replace(/~0/g, '~');
 }
 
-function resolveLocalRef(ref) {
-  check(ref.startsWith('#/'), `Only local OpenAPI references are supported, found: ${ref}`);
-  return ref
-    .slice(2)
-    .split('/')
-    .map(decodePointerSegment)
-    .reduce((current, segment) => {
-      check(
-        current && Object.prototype.hasOwnProperty.call(current, segment),
-        `Unresolved OpenAPI reference: ${ref}`,
-      );
-      return current[segment];
-    }, spec);
-}
+function validateCommon(fileName) {
+  const specPath = path.resolve(__dirname, '..', 'static', fileName);
+  const spec = yaml.load(fs.readFileSync(specPath, 'utf8'));
 
-function visit(value) {
-  if (Array.isArray(value)) {
-    value.forEach(visit);
-    return;
+  function checkSpec(condition, message) {
+    check(condition, `${fileName}: ${message}`);
   }
-  if (!value || typeof value !== 'object') {
-    return;
+
+  function resolveLocalRef(ref) {
+    checkSpec(ref.startsWith('#/'), `Only local OpenAPI references are supported, found: ${ref}`);
+    return ref
+      .slice(2)
+      .split('/')
+      .map(decodePointerSegment)
+      .reduce((current, segment) => {
+        checkSpec(
+          current && Object.prototype.hasOwnProperty.call(current, segment),
+          `Unresolved OpenAPI reference: ${ref}`,
+        );
+        return current[segment];
+      }, spec);
   }
-  check(!Object.prototype.hasOwnProperty.call(value, 'nullable'), 'OpenAPI 3.1 schemas must not use nullable');
-  if (typeof value.$ref === 'string') {
-    resolveLocalRef(value.$ref);
+
+  function visit(value) {
+    if (Array.isArray(value)) {
+      value.forEach(visit);
+      return;
+    }
+    if (!value || typeof value !== 'object') {
+      return;
+    }
+    checkSpec(
+      !Object.prototype.hasOwnProperty.call(value, 'nullable'),
+      'OpenAPI 3.1 schemas must not use nullable',
+    );
+    if (typeof value.$ref === 'string') {
+      resolveLocalRef(value.$ref);
+    }
+    Object.values(value).forEach(visit);
   }
-  Object.values(value).forEach(visit);
-}
 
-function schema(name) {
-  const value = spec.components && spec.components.schemas && spec.components.schemas[name];
-  check(value, `Missing OpenAPI schema: ${name}`);
-  return value;
-}
+  function schema(name) {
+    const value = spec.components && spec.components.schemas && spec.components.schemas[name];
+    checkSpec(value, `Missing OpenAPI schema: ${name}`);
+    return value;
+  }
 
-function requireProperties(schemaName, names) {
-  const properties = schema(schemaName).properties || {};
-  names.forEach((name) => {
-    check(properties[name], `Schema ${schemaName} is missing property: ${name}`);
-  });
-  return properties;
-}
+  function requireProperties(schemaName, names) {
+    const properties = schema(schemaName).properties || {};
+    names.forEach((name) => {
+      checkSpec(properties[name], `Schema ${schemaName} is missing property: ${name}`);
+    });
+    return properties;
+  }
+
+  function requireRequiredProperties(schemaName, names) {
+    const required = schema(schemaName).required || [];
+    names.forEach((name) => {
+      checkSpec(required.includes(name), `Schema ${schemaName} must require property: ${name}`);
+    });
+  }
 
-function requireTypedIntegerProperties(schemaName, names) {
-  const properties = requireProperties(schemaName, names);
-  names.forEach((name) => {
-    check(
-      properties[name].type === 'integer' && properties[name].format === 'int64',
-      `Schema ${schemaName}.${name} must be an int64 integer`,
+  function requireTypedIntegerProperties(schemaName, names) {
+    const properties = requireProperties(schemaName, names);
+    names.forEach((name) => {
+      checkSpec(
+        properties[name].type === 'integer' && properties[name].format === 'int64',
+        `Schema ${schemaName}.${name} must be an int64 integer`,
+      );
+    });
+  }
+
+  function requireSchemaReference(schemaName, composition, referencedSchemaName) {
+    const references = schema(schemaName)[composition] || [];
+    const expected = `#/components/schemas/${referencedSchemaName}`;
+    checkSpec(
+      references.some((reference) => reference.$ref === expected),
+      `Schema ${schemaName}.${composition} is missing reference: ${expected}`,
     );
-  });
-}
+  }
+
+  function validatePathParameters(resourcePath, pathItem, operation) {
+    const templateNames = Array.from(resourcePath.matchAll(/\{([^}]+)\}/g), (match) => match[1]);
+    const parameters = [...(pathItem.parameters || []), ...(operation.parameters || [])];
+    const pathParameters = parameters.filter((parameter) => parameter.in === 'path');
+    templateNames.forEach((name) => {
+      const parameter = pathParameters.find((candidate) => candidate.name === name);
+      checkSpec(parameter, `Path ${resourcePath} is missing path parameter: ${name}`);
+      checkSpec(
+        parameter.required === true,
+        `Path parameter ${resourcePath}.${name} must be required`,
+      );
+    });
+    pathParameters.forEach((parameter) => {
+      checkSpec(
+        templateNames.includes(parameter.name),
+        `Path ${resourcePath} declares unused path parameter: ${parameter.name}`,
+      );
+    });
+  }
 
-function requireSchemaReference(schemaName, composition, referencedSchemaName) {
-  const references = schema(schemaName)[composition] || [];
-  const expected = `#/components/schemas/${referencedSchemaName}`;
-  check(
-    references.some((reference) => reference.$ref === expected),
-    `Schema ${schemaName}.${composition} is missing reference: ${expected}`,
+  checkSpec(spec.openapi === '3.1.1', `Expected OpenAPI 3.1.1, found: ${spec.openapi}`);
+  checkSpec(
+    spec.paths && spec.components && spec.components.schemas,
+    'Incomplete OpenAPI document',
   );
+  visit(spec);
+
+  const operations = new Map();
+  for (const [resourcePath, pathItem] of Object.entries(spec.paths)) {
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (!HTTP_METHODS.has(method)) {
+        continue;
+      }
+      validatePathParameters(resourcePath, pathItem, operation);
+      checkSpec(
+        operation.operationId,
+        `Operation ${method.toUpperCase()} ${resourcePath} has no operationId`,
+      );
+      checkSpec(
+        !operations.has(operation.operationId),
+        `Duplicate operationId: ${operation.operationId}`,
+      );
+      operations.set(operation.operationId, operation);
+    }
+  }
+
+  function requireOperation(operationId) {
+    const operation = operations.get(operationId);
+    checkSpec(operation, `Missing operationId: ${operationId}`);
+    return operation;
+  }
+
+  function requireResponses(operationId, statusCodes) {
+    const responses = requireOperation(operationId).responses || {};
+    statusCodes.forEach((statusCode) => {
+      checkSpec(
+        responses[statusCode],
+        `Operation ${operationId} is missing response: ${statusCode}`,
+      );
+    });
+  }
+
+  return {
+    spec,
+    operations,
+    schema,
+    requireOperation,
+    requireProperties,
+    requireRequiredProperties,
+    requireTypedIntegerProperties,
+    requireSchemaReference,
+    requireResponses,
+    checkSpec,
+  };
 }
 
-function requireArrayOfIdentifiers(schemaName, propertyName) {
-  const properties = requireProperties(schemaName, [propertyName]);
-  check(properties[propertyName].type === 'array', `Schema ${schemaName}.${propertyName} must be an array`);
-  check(
+function requireArrayOfIdentifiers(contract, schemaName, propertyName) {
+  const properties = contract.requireProperties(schemaName, [propertyName]);
+  contract.checkSpec(
+    properties[propertyName].type === 'array',
+    `Schema ${schemaName}.${propertyName} must be an array`,
+  );
+  contract.checkSpec(
     properties[propertyName].items &&
       properties[propertyName].items.$ref === '#/components/schemas/Identifier',
     `Schema ${schemaName}.${propertyName} items must reference Identifier`,
   );
 }
 
-function requireNullableStringProperty(schemaName, propertyName) {
-  const property = requireProperties(schemaName, [propertyName])[propertyName];
-  check(
+function requireNullableStringProperty(contract, schemaName, propertyName) {
+  const property = contract.requireProperties(schemaName, [propertyName])[propertyName];
+  contract.checkSpec(
     Array.isArray(property.type) &&
       property.type.includes('string') &&
       property.type.includes('null'),
@@ -116,85 +212,227 @@ function requireNullableStringProperty(schemaName, propertyName) {
   );
 }
 
-check(spec.openapi === '3.1.1', `Expected OpenAPI 3.1.1, found: ${spec.openapi}`);
-check(spec.paths && spec.components && spec.components.schemas, 'Incomplete OpenAPI document');
-visit(spec);
+function requireExactEnum(contract, schemaName, expectedValues) {
+  const actualValues = contract.schema(schemaName).enum || [];
+  contract.checkSpec(
+    actualValues.length === expectedValues.length &&
+      expectedValues.every((value) => actualValues.includes(value)),
+    `Schema ${schemaName} must define enum values: ${expectedValues.join(', ')}`,
+  );
+}
+
+function validateCatalogOpenApi() {
+  const contract = validateCommon('rest-catalog-open-api.yaml');
+  [
+    'getConfig',
+    'createDatabase',
+    'getDatabase',
+    'alterDatabase',
+    'dropDatabase',
+    'createTable',
+    'getTable',
+    'alterTable',
+    'dropTable',
+  ].forEach(contract.requireOperation);
 
-const operationIds = new Set();
-for (const pathItem of Object.values(spec.paths)) {
-  for (const operation of Object.values(pathItem)) {
-    if (!operation || typeof operation !== 'object' || !operation.operationId) {
-      continue;
-    }
-    check(!operationIds.has(operation.operationId), `Duplicate operationId: ${operation.operationId}`);
-    operationIds.add(operation.operationId);
-  }
+  contract.requireProperties('ConfigResponse', ['defaults', 'overrides']);
+  contract.requireProperties('CreateDatabaseRequest', ['name', 'options']);
+  contract.requireProperties('AlterDatabaseRequest', ['removals', 'updates']);
+  contract.requireProperties('CreateTableRequest', ['identifier', 'schema']);
+  contract.requireProperties('AlterTableRequest', ['changes']);
+  contract.requireProperties('Identifier', ['database', 'object']);
+  contract.requireProperties('Schema', [
+    'fields',
+    'partitionKeys',
+    'primaryKeys',
+    'options',
+    'comment',
+  ]);
+  contract.requireProperties('DataField', ['id', 'name', 'type', 'description', 'defaultValue']);
+
+  contract.requireSchemaReference('DataType', 'oneOf', 'VectorType');
+  contract.requireProperties('VectorType', ['type', 'element', 'length']);
+  contract.requireSchemaReference('SchemaChange', 'anyOf', 'DropPrimaryKey');
+  contract.checkSpec(
+    contract.schema('BaseSchemaChange').discriminator.mapping.dropPrimaryKey ===
+      '#/components/schemas/DropPrimaryKey',
+    'BaseSchemaChange discriminator is missing dropPrimaryKey',
+  );
+  const dropPrimaryKey = contract.requireProperties('DropPrimaryKey', ['action']);
+  contract.checkSpec(
+    dropPrimaryKey.action.const === 'dropPrimaryKey',
+    'Schema DropPrimaryKey.action must be dropPrimaryKey',
+  );
+  contract.checkSpec(
+    contract.schema('BaseInstant').discriminator.propertyName === 'type',
+    'BaseInstant discriminator must use the JSON field type',
+  );
+
+  const updateViewComment = contract.requireProperties('UpdateViewComment', ['action', 'comment']);
+  contract.checkSpec(
+    !updateViewComment.key,
+    'Schema UpdateViewComment must use comment instead of key',
+  );
+  ['UpdateComment', 'UpdateViewComment', 'UpdateFunctionComment'].forEach((schemaName) =>
+    requireNullableStringProperty(contract, schemaName, 'comment'),
+  );
+
+  const errorResourceTypes =
+    contract.requireProperties('ErrorResponse', ['resourceType']).resourceType.enum || [];
+  ['FUNCTION', 'DEFINITION'].forEach((resourceType) => {
+    contract.checkSpec(
+      errorResourceTypes.includes(resourceType),
+      `Schema ErrorResponse.resourceType is missing value: ${resourceType}`,
+    );
+  });
+
+  requireArrayOfIdentifiers(contract, 'ListTablesGloballyResponse', 'tables');
+  requireArrayOfIdentifiers(contract, 'ListViewsGloballyResponse', 'views');
+  requireArrayOfIdentifiers(contract, 'ListFunctionsGloballyResponse', 'functions');
+  contract.requireProperties('ListFunctionsGloballyResponse', ['nextPageToken']);
+  const getFunctionProperties = contract.requireProperties('GetFunctionResponse', ['uuid']);
+  contract.checkSpec(
+    getFunctionProperties.uuid.type === 'string',
+    'Schema GetFunctionResponse.uuid must be a string',
+  );
+
+  ['GetDatabaseResponse', 'GetTableResponse', 'GetViewResponse', 'GetFunctionResponse'].forEach(
+    (schemaName) => contract.requireTypedIntegerProperties(schemaName, ['createdAt', 'updatedAt']),
+  );
+  return contract.operations.size;
 }
 
-[
-  'getConfig',
-  'createDatabase',
-  'getDatabase',
-  'alterDatabase',
-  'dropDatabase',
-  'createTable',
-  'getTable',
-  'alterTable',
-  'dropTable',
-].forEach((operationId) => {
-  check(operationIds.has(operationId), `Missing provider-facing operationId: ${operationId}`);
-});
-
-requireProperties('ConfigResponse', ['defaults', 'overrides']);
-requireProperties('CreateDatabaseRequest', ['name', 'options']);
-requireProperties('AlterDatabaseRequest', ['removals', 'updates']);
-requireProperties('CreateTableRequest', ['identifier', 'schema']);
-requireProperties('AlterTableRequest', ['changes']);
-requireProperties('Identifier', ['database', 'object']);
-requireProperties('Schema', ['fields', 'partitionKeys', 'primaryKeys', 'options', 'comment']);
-requireProperties('DataField', ['id', 'name', 'type', 'description', 'defaultValue']);
-
-requireSchemaReference('DataType', 'oneOf', 'VectorType');
-requireProperties('VectorType', ['type', 'element', 'length']);
-requireSchemaReference('SchemaChange', 'anyOf', 'DropPrimaryKey');
-check(
-  schema('BaseSchemaChange').discriminator.mapping.dropPrimaryKey ===
-    '#/components/schemas/DropPrimaryKey',
-  'BaseSchemaChange discriminator is missing dropPrimaryKey',
-);
-const dropPrimaryKey = requireProperties('DropPrimaryKey', ['action']);
-check(
-  dropPrimaryKey.action.const === 'dropPrimaryKey',
-  'Schema DropPrimaryKey.action must be dropPrimaryKey',
-);
-check(
-  schema('BaseInstant').discriminator.propertyName === 'type',
-  'BaseInstant discriminator must use the JSON field type',
-);
+function validateManagementOpenApi() {
+  const contract = validateCommon('rest-management-open-api.yaml');
+  const operationIds = ['listPermissions', 'grantPermission', 'revokePermission'];
+  operationIds.forEach(contract.requireOperation);
+  operationIds.forEach((operationId) =>
+    contract.requireResponses(operationId, ['200', '400', '401', '403', '404', '500']),
+  );
 
-const updateViewComment = requireProperties('UpdateViewComment', ['action', 'comment']);
-check(!updateViewComment.key, 'Schema UpdateViewComment must use comment instead of key');
-['UpdateComment', 'UpdateViewComment', 'UpdateFunctionComment'].forEach((schemaName) =>
-  requireNullableStringProperty(schemaName, 'comment'),
-);
+  const permissionFields = [
+    'resourceType',
+    'catalog',
+    'database',
+    'table',
+    'function',
+    'view',
+    'columns',
+    'rowFilter',
+    'columnMasking',
+    'access',
+    'principal',
+    'expireTime',
+  ];
+  contract.requireProperties('Permission', permissionFields);
+  contract.requireRequiredProperties('Permission', ['resourceType', 'access', 'principal']);
 
-const errorResourceTypes = requireProperties('ErrorResponse', ['resourceType']).resourceType.enum || [];
-['FUNCTION', 'DEFINITION'].forEach((resourceType) => {
-  check(
-    errorResourceTypes.includes(resourceType),
-    `Schema ErrorResponse.resourceType is missing value: ${resourceType}`,
+  const grantProperties = contract.requireProperties('GrantPermissionRequest', permissionFields);
+  contract.requireRequiredProperties('GrantPermissionRequest', [
+    'resourceType',
+    'access',
+    'principal',
+  ]);
+  contract.checkSpec(
+    !grantProperties.permission,
+    'Schema GrantPermissionRequest must use the flat permission shape',
   );
-});
 
-requireArrayOfIdentifiers('ListTablesGloballyResponse', 'tables');
-requireArrayOfIdentifiers('ListViewsGloballyResponse', 'views');
-requireArrayOfIdentifiers('ListFunctionsGloballyResponse', 'functions');
-requireProperties('ListFunctionsGloballyResponse', ['nextPageToken']);
-const getFunctionProperties = requireProperties('GetFunctionResponse', ['uuid']);
-check(getFunctionProperties.uuid.type === 'string', 'Schema GetFunctionResponse.uuid must be a string');
+  const revokeFields = [
+    'resourceType',
+    'catalog',
+    'database',
+    'table',
+    'function',
+    'view',
+    'columns',
+    'access',
+    'principal',
+  ];
+  const revokeProperties = contract.requireProperties('RevokePermissionRequest', revokeFields);
+  contract.requireRequiredProperties('RevokePermissionRequest', [
+    'resourceType',
+    'access',
+    'principal',
+  ]);
+  ['rowFilter', 'columnMasking', 'expireTime'].forEach((field) =>
+    contract.checkSpec(
+      !revokeProperties[field],
+      `Schema RevokePermissionRequest must omit grant-only field: ${field}`,
+    ),
+  );
 
-['GetDatabaseResponse', 'GetTableResponse', 'GetViewResponse', 'GetFunctionResponse'].forEach(
-  (schemaName) => requireTypedIntegerProperties(schemaName, ['createdAt', 'updatedAt']),
-);
+  const listProperties = contract.requireProperties('ListPermissionsResponse', [
+    'permissions',
+    'nextPageToken',
+  ]);
+  contract.requireRequiredProperties('ListPermissionsResponse', ['permissions']);
+  contract.checkSpec(
+    listProperties.permissions.type === 'array' &&
+      listProperties.permissions.items.$ref === '#/components/schemas/Permission',
+    'Schema ListPermissionsResponse.permissions must be an array of Permission',
+  );
 
-console.log(`Validated REST OpenAPI contract with ${operationIds.size} operations.`);
+  const columnSelection = contract.requireProperties('ColumnSelection', [
+    'columnNames',
+    'excludedColumnNames',
+  ]);
+  contract.checkSpec(
+    columnSelection.columnNames.uniqueItems === true &&
+      columnSelection.excludedColumnNames.uniqueItems === true,
+    'Schema ColumnSelection values must be unique',
+  );
+  contract.checkSpec(
+    Array.isArray(contract.schema('ColumnSelection').oneOf) &&
+      contract.schema('ColumnSelection').oneOf.length === 2,
+    'Schema ColumnSelection must require exactly one selection mode',
+  );
+
+  contract.requireProperties('RowFilter', ['expression', 'predicate']);
+  contract.requireProperties('ColumnMask', ['expression', 'transform']);
+  contract.checkSpec(
+    contract.schema('ExpireTime').type === 'string',
+    'Schema ExpireTime must use the ISO-8601 string representation',
+  );
+
+  requireExactEnum(contract, 'ResourceType', [
+    'CATALOG',
+    'CATALOG_ALL',
+    'DATABASE',
+    'DATABASE_ALL',
+    'TABLE',
+    'FUNCTION',
+    'VIEW',
+    'COLUMN',
+    'ROW_FILTER',
+    'COLUMN_MASKING',
+  ]);
+
+  const listParameters = contract
+    .requireOperation('listPermissions')
+    .parameters.filter((parameter) => parameter.in === 'query');
+  ['resourceType', 'database', 'table', 'function', 'view', 'principal', 'pageToken', 'maxResults'].forEach(
+    (name) =>
+      contract.checkSpec(
+        listParameters.some((parameter) => parameter.name === name),
+        `Operation listPermissions is missing query parameter: ${name}`,
+      ),
+  );
+  contract.checkSpec(
+    listParameters.find((parameter) => parameter.name === 'resourceType').required === true,
+    'Operation listPermissions must require resourceType',
+  );
+
+  contract.checkSpec(
+    contract.operations.size === operationIds.length,
+    'The initial management contract must stay limited to list, grant, and revoke',
+  );
+  return contract.operations.size;
+}
+
+const catalogOperationCount = validateCatalogOpenApi();
+const managementOperationCount = validateManagementOpenApi();
+console.log(`Validated REST Catalog OpenAPI contract with ${catalogOperationCount} operations.`);
+console.log(
+  `Validated REST Management OpenAPI contract with ${managementOperationCount} operations.`,
+);
diff --git a/docs/sidebars.js b/docs/sidebars.js
index cb70d4ad19fd..cd2b6b2d95f3 100644
--- a/docs/sidebars.js
+++ b/docs/sidebars.js
@@ -31,7 +31,8 @@ const sidebars = {
           "concepts/rest/dlf",
           "concepts/rest/tables",
           "concepts/rest/pvfs",
-          "concepts/rest/rest-api"
+          "concepts/rest/rest-api",
+          "concepts/rest/management-api"
         ]
       },
       {
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
new file mode 100644
index 000000000000..f2aba26e2090
--- /dev/null
+++ b/docs/static/rest-management-open-api.yaml
@@ -0,0 +1,361 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+openapi: 3.1.1
+info:
+  title: Paimon REST Management API
+  version: 1.0.0
+  description: |
+    Control-plane API for listing, granting, and revoking permissions. Permission payloads use a
+    flat resource-oriented model, and the resource paths belong to the Paimon REST Management API.
+  license:
+    name: Apache 2.0
+    url: https://www.apache.org/licenses/LICENSE-2.0.html
+servers:
+  - url: http://localhost:8080
+security:
+  - BearerAuth: []
+paths:
+  /v1/catalogs/{catalog}/permissions:
+    get:
+      tags: [permission]
+      summary: List Permissions
+      operationId: listPermissions
+      description: |
+        Lists explicitly granted permissions. Filtering CATALOG also returns CATALOG_ALL;
+        DATABASE also returns DATABASE_ALL; TABLE also returns COLUMN, ROW_FILTER, and
+        COLUMN_MASKING permissions.
+      parameters:
+        - name: catalog
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: resourceType
+          in: query
+          required: true
+          schema:
+            $ref: '#/components/schemas/ResourceType'
+        - name: database
+          in: query
+          schema:
+            type: string
+        - name: table
+          in: query
+          schema:
+            type: string
+        - name: function
+          in: query
+          schema:
+            type: string
+        - name: view
+          in: query
+          schema:
+            type: string
+        - name: principal
+          in: query
+          schema:
+            type: string
+        - name: pageToken
+          in: query
+          schema:
+            type: string
+        - name: maxResults
+          in: query
+          schema:
+            type: integer
+            format: int32
+            minimum: 1
+      responses:
+        "200":
+          description: Permission list.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ListPermissionsResponse'
+        "400":
+          $ref: '#/components/responses/BadRequestErrorResponse'
+        "401":
+          $ref: '#/components/responses/UnauthorizedErrorResponse'
+        "403":
+          $ref: '#/components/responses/ForbiddenErrorResponse'
+        "404":
+          $ref: '#/components/responses/ResourceNotExistErrorResponse'
+        "500":
+          $ref: '#/components/responses/ServerErrorResponse'
+  /v1/catalogs/{catalog}/permissions/grant:
+    post:
+      tags: [permission]
+      summary: Grant Permission
+      operationId: grantPermission
+      parameters:
+        - name: catalog
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GrantPermissionRequest'
+      responses:
+        "200":
+          description: Permission granted.
+        "400":
+          $ref: '#/components/responses/BadRequestErrorResponse'
+        "401":
+          $ref: '#/components/responses/UnauthorizedErrorResponse'
+        "403":
+          $ref: '#/components/responses/ForbiddenErrorResponse'
+        "404":
+          $ref: '#/components/responses/ResourceNotExistErrorResponse'
+        "500":
+          $ref: '#/components/responses/ServerErrorResponse'
+  /v1/catalogs/{catalog}/permissions/revoke:
+    post:
+      tags: [permission]
+      summary: Revoke Permission
+      operationId: revokePermission
+      description: Revokes the matching permission. A missing permission may return HTTP 404.
+      parameters:
+        - name: catalog
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RevokePermissionRequest'
+      responses:
+        "200":
+          description: Permission revoked.
+        "400":
+          $ref: '#/components/responses/BadRequestErrorResponse'
+        "401":
+          $ref: '#/components/responses/UnauthorizedErrorResponse'
+        "403":
+          $ref: '#/components/responses/ForbiddenErrorResponse'
+        "404":
+          $ref: '#/components/responses/ResourceNotExistErrorResponse'
+        "500":
+          $ref: '#/components/responses/ServerErrorResponse'
+components:
+  securitySchemes:
+    BearerAuth:
+      type: http
+      scheme: bearer
+  parameters:
+    Catalog:
+      name: catalog
+      in: path
+      required: true
+      schema:
+        type: string
+      description: Remote catalog identifier.
+  responses:
+    BadRequestErrorResponse:
+      description: The permission or list filter is invalid.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    UnauthorizedErrorResponse:
+      description: Authentication is required or has failed.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    ForbiddenErrorResponse:
+      description: The authenticated caller may not manage the requested permission.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    ResourceNotExistErrorResponse:
+      description: The catalog, resource, principal, or permission does not exist.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    ServerErrorResponse:
+      description: The server failed to process the request.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+  schemas:
+    GrantPermissionRequest:
+      type: object
+      required: [resourceType, access, principal]
+      properties:
+        resourceType:
+          $ref: '#/components/schemas/ResourceType'
+        catalog:
+          type: string
+        database:
+          type: string
+        table:
+          type: string
+        function:
+          type: string
+        view:
+          type: string
+        columns:
+          $ref: '#/components/schemas/ColumnSelection'
+        rowFilter:
+          $ref: '#/components/schemas/RowFilter'
+        columnMasking:
+          $ref: '#/components/schemas/ColumnMasking'
+        access:
+          type: string
+        principal:
+          type: string
+        expireTime:
+          $ref: '#/components/schemas/ExpireTime'
+    RevokePermissionRequest:
+      type: object
+      required: [resourceType, access, principal]
+      properties:
+        resourceType:
+          $ref: '#/components/schemas/ResourceType'
+        catalog:
+          type: string
+        database:
+          type: string
+        table:
+          type: string
+        function:
+          type: string
+        view:
+          type: string
+        columns:
+          $ref: '#/components/schemas/ColumnSelection'
+        access:
+          type: string
+        principal:
+          type: string
+    ListPermissionsResponse:
+      type: object
+      required: [permissions]
+      properties:
+        permissions:
+          type: array
+          items:
+            $ref: '#/components/schemas/Permission'
+        nextPageToken:
+          type: string
+    Permission:
+      type: object
+      required: [resourceType, access, principal]
+      properties:
+        resourceType:
+          $ref: '#/components/schemas/ResourceType'
+        catalog:
+          type: string
+        database:
+          type: string
+        table:
+          type: string
+        function:
+          type: string
+        view:
+          type: string
+        columns:
+          $ref: '#/components/schemas/ColumnSelection'
+        rowFilter:
+          $ref: '#/components/schemas/RowFilter'
+        columnMasking:
+          $ref: '#/components/schemas/ColumnMasking'
+        access:
+          type: string
+          description: Permission access such as SELECT, INSERT, UPDATE, DELETE, ALTER, or ALL.
+        principal:
+          type: string
+          description: Principal identifier understood by the server.
+        expireTime:
+          $ref: '#/components/schemas/ExpireTime'
+    ResourceType:
+      type: string
+      enum:
+        - CATALOG
+        - CATALOG_ALL
+        - DATABASE
+        - DATABASE_ALL
+        - TABLE
+        - FUNCTION
+        - VIEW
+        - COLUMN
+        - ROW_FILTER
+        - COLUMN_MASKING
+    ColumnSelection:
+      type: object
+      properties:
+        columnNames:
+          type: array
+          uniqueItems: true
+          items:
+            type: string
+        excludedColumnNames:
+          type: array
+          uniqueItems: true
+          items:
+            type: string
+      oneOf:
+        - required: [columnNames]
+        - required: [excludedColumnNames]
+    RowFilter:
+      type: object
+      properties:
+        expression:
+          type: string
+        predicate:
+          type: string
+      description: Grant requests provide expression; list responses may also include predicate.
+    ColumnMask:
+      type: object
+      properties:
+        expression:
+          type: string
+        transform:
+          type: string
+      description: Grant requests provide expression; list responses may also include transform.
+    ColumnMasking:
+      type: object
+      additionalProperties:
+        $ref: '#/components/schemas/ColumnMask'
+    ExpireTime:
+      type: string
+      description: Expiration time in ISO-8601 UTC form, for example 2025-12-31T23:59:59Z.
+      examples:
+        - 2025-12-31T23:59:59Z
+    ErrorResponse:
+      type: object
+      required: [message, code]
+      properties:
+        message:
+          type: string
+        resourceType:
+          type: string
+        resourceName:
+          type: string
+        code:
+          type: integer
+          format: int32
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
new file mode 100644
index 000000000000..6ff044970db9
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+
+/** Column-mask expression and its optional server-compiled transform. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class ColumnMask {
+
+    private static final String FIELD_EXPRESSION = "expression";
+    private static final String FIELD_TRANSFORM = "transform";
+
+    @Nullable
+    @JsonProperty(FIELD_EXPRESSION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String expression;
+
+    @Nullable
+    @JsonProperty(FIELD_TRANSFORM)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String transform;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_EXPRESSION, FIELD_TRANSFORM})
+    public ColumnMask(
+            @Nullable @JsonProperty(FIELD_EXPRESSION) String expression,
+            @Nullable @JsonProperty(FIELD_TRANSFORM) String transform) {
+        this.expression = expression;
+        this.transform = transform;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXPRESSION)
+    public String getExpression() {
+        return expression;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_TRANSFORM)
+    public String getTransform() {
+        return transform;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java b/paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java
new file mode 100644
index 000000000000..652f70bcc6b5
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.List;
+
+/** Included or excluded columns attached to a column permission. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class ColumnSelection {
+
+    private static final String FIELD_COLUMN_NAMES = "columnNames";
+    private static final String FIELD_EXCLUDED_COLUMN_NAMES = "excludedColumnNames";
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMN_NAMES)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final List<String> columnNames;
+
+    @Nullable
+    @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final List<String> excludedColumnNames;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_COLUMN_NAMES, FIELD_EXCLUDED_COLUMN_NAMES})
+    public ColumnSelection(
+            @Nullable @JsonProperty(FIELD_COLUMN_NAMES) List<String> columnNames,
+            @Nullable @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES) List<String> excludedColumnNames) {
+        this.columnNames = columnNames;
+        this.excludedColumnNames = excludedColumnNames;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_NAMES)
+    public List<String> getColumnNames() {
+        return columnNames;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXCLUDED_COLUMN_NAMES)
+    public List<String> getExcludedColumnNames() {
+        return excludedColumnNames;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
new file mode 100644
index 000000000000..0b009af3a8c1
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import javax.annotation.Nullable;
+
+/** Resource filters and pagination for listing explicitly granted permissions. */
+public class ListPermissionsRequest {
+
+    private final ResourceType resourceType;
+    @Nullable private final String database;
+    @Nullable private final String table;
+    @Nullable private final String function;
+    @Nullable private final String view;
+    @Nullable private final String principal;
+    @Nullable private final String pageToken;
+    @Nullable private final Integer maxResults;
+
+    public ListPermissionsRequest(
+            ResourceType resourceType,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view,
+            @Nullable String principal,
+            @Nullable String pageToken,
+            @Nullable Integer maxResults) {
+        this.resourceType = resourceType;
+        this.database = database;
+        this.table = table;
+        this.function = function;
+        this.view = view;
+        this.principal = principal;
+        this.pageToken = pageToken;
+        this.maxResults = maxResults;
+    }
+
+    public ResourceType getResourceType() {
+        return resourceType;
+    }
+
+    @Nullable
+    public String getDatabase() {
+        return database;
+    }
+
+    @Nullable
+    public String getTable() {
+        return table;
+    }
+
+    @Nullable
+    public String getFunction() {
+        return function;
+    }
+
+    @Nullable
+    public String getView() {
+        return view;
+    }
+
+    @Nullable
+    public String getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    public String getPageToken() {
+        return pageToken;
+    }
+
+    @Nullable
+    public Integer getMaxResults() {
+        return maxResults;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/Permission.java b/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
new file mode 100644
index 000000000000..3e5c100669db
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
@@ -0,0 +1,213 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.Map;
+
+/** Permission grant on a catalog resource. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class Permission {
+
+    private static final String FIELD_RESOURCE_TYPE = "resourceType";
+    private static final String FIELD_CATALOG = "catalog";
+    private static final String FIELD_DATABASE = "database";
+    private static final String FIELD_TABLE = "table";
+    private static final String FIELD_FUNCTION = "function";
+    private static final String FIELD_VIEW = "view";
+    private static final String FIELD_COLUMNS = "columns";
+    private static final String FIELD_ROW_FILTER = "rowFilter";
+    private static final String FIELD_COLUMN_MASKING = "columnMasking";
+    private static final String FIELD_ACCESS = "access";
+    private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_EXPIRE_TIME = "expireTime";
+
+    @JsonProperty(FIELD_RESOURCE_TYPE)
+    private final ResourceType resourceType;
+
+    @Nullable
+    @JsonProperty(FIELD_CATALOG)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String catalog;
+
+    @Nullable
+    @JsonProperty(FIELD_DATABASE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String database;
+
+    @Nullable
+    @JsonProperty(FIELD_TABLE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String table;
+
+    @Nullable
+    @JsonProperty(FIELD_FUNCTION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String function;
+
+    @Nullable
+    @JsonProperty(FIELD_VIEW)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String view;
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMNS)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final ColumnSelection columns;
+
+    @Nullable
+    @JsonProperty(FIELD_ROW_FILTER)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final RowFilter rowFilter;
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMN_MASKING)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final Map<String, ColumnMask> columnMasking;
+
+    @JsonProperty(FIELD_ACCESS)
+    private final String access;
+
+    @JsonProperty(FIELD_PRINCIPAL)
+    private final String principal;
+
+    @Nullable
+    @JsonProperty(FIELD_EXPIRE_TIME)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String expireTime;
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_RESOURCE_TYPE,
+        FIELD_CATALOG,
+        FIELD_DATABASE,
+        FIELD_TABLE,
+        FIELD_FUNCTION,
+        FIELD_VIEW,
+        FIELD_COLUMNS,
+        FIELD_ROW_FILTER,
+        FIELD_COLUMN_MASKING,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL,
+        FIELD_EXPIRE_TIME
+    })
+    public Permission(
+            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
+            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
+            @Nullable @JsonProperty(FIELD_DATABASE) String database,
+            @Nullable @JsonProperty(FIELD_TABLE) String table,
+            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
+            @Nullable @JsonProperty(FIELD_VIEW) String view,
+            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
+            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
+            @Nullable @JsonProperty(FIELD_COLUMN_MASKING) Map<String, ColumnMask> columnMasking,
+            @JsonProperty(FIELD_ACCESS) String access,
+            @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
+        this.resourceType = resourceType;
+        this.catalog = catalog;
+        this.database = database;
+        this.table = table;
+        this.function = function;
+        this.view = view;
+        this.columns = columns;
+        this.rowFilter = rowFilter;
+        this.columnMasking = columnMasking;
+        this.access = access;
+        this.principal = principal;
+        this.expireTime = expireTime;
+    }
+
+    @JsonGetter(FIELD_RESOURCE_TYPE)
+    public ResourceType getResourceType() {
+        return resourceType;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_CATALOG)
+    public String getCatalog() {
+        return catalog;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_DATABASE)
+    public String getDatabase() {
+        return database;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_TABLE)
+    public String getTable() {
+        return table;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_FUNCTION)
+    public String getFunction() {
+        return function;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_VIEW)
+    public String getView() {
+        return view;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMNS)
+    public ColumnSelection getColumns() {
+        return columns;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_ROW_FILTER)
+    public RowFilter getRowFilter() {
+        return rowFilter;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_MASKING)
+    public Map<String, ColumnMask> getColumnMasking() {
+        return columnMasking;
+    }
+
+    @JsonGetter(FIELD_ACCESS)
+    public String getAccess() {
+        return access;
+    }
+
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXPIRE_TIME)
+    public String getExpireTime() {
+        return expireTime;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
new file mode 100644
index 000000000000..9764cf9fda2d
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.PagedList;
+
+/** Control-plane contract for managing permissions on catalog resources. */
+public interface PermissionManagement {
+
+    PagedList<Permission> listPermissions(ListPermissionsRequest request);
+
+    void grantPermission(Permission permission);
+
+    void revokePermission(Permission permission);
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
new file mode 100644
index 000000000000..1beed2be1c2e
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
@@ -0,0 +1,33 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+/** Resource types supported by permission management. */
+public enum ResourceType {
+    CATALOG,
+    CATALOG_ALL,
+    DATABASE,
+    DATABASE_ALL,
+    TABLE,
+    VIEW,
+    FUNCTION,
+    COLUMN,
+    ROW_FILTER,
+    COLUMN_MASKING
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
new file mode 100644
index 000000000000..9787960050b8
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+
+/** Row-filter expression and its optional server-compiled predicate. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class RowFilter {
+
+    private static final String FIELD_EXPRESSION = "expression";
+    private static final String FIELD_PREDICATE = "predicate";
+
+    @Nullable
+    @JsonProperty(FIELD_EXPRESSION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String expression;
+
+    @Nullable
+    @JsonProperty(FIELD_PREDICATE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String predicate;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_EXPRESSION, FIELD_PREDICATE})
+    public RowFilter(
+            @Nullable @JsonProperty(FIELD_EXPRESSION) String expression,
+            @Nullable @JsonProperty(FIELD_PREDICATE) String predicate) {
+        this.expression = expression;
+        this.predicate = predicate;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXPRESSION)
+    public String getExpression() {
+        return expression;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_PREDICATE)
+    public String getPredicate() {
+        return predicate;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index 238a3969ff04..f6314736f554 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -25,6 +25,8 @@
 import org.apache.paimon.catalog.Identifier;
 import org.apache.paimon.consumer.ConsumerInfo;
 import org.apache.paimon.function.FunctionChange;
+import org.apache.paimon.management.ListPermissionsRequest;
+import org.apache.paimon.management.Permission;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
@@ -48,6 +50,7 @@
 import org.apache.paimon.rest.requests.CreateViewRequest;
 import org.apache.paimon.rest.requests.DropPartitionsRequest;
 import org.apache.paimon.rest.requests.ForwardBranchRequest;
+import org.apache.paimon.rest.requests.GrantPermissionRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByNamesRequest;
 import org.apache.paimon.rest.requests.MarkDonePartitionsRequest;
@@ -55,6 +58,7 @@
 import org.apache.paimon.rest.requests.RenameTableRequest;
 import org.apache.paimon.rest.requests.ReplaceTableRequest;
 import org.apache.paimon.rest.requests.ResetConsumerRequest;
+import org.apache.paimon.rest.requests.RevokePermissionRequest;
 import org.apache.paimon.rest.requests.RollbackSchemaRequest;
 import org.apache.paimon.rest.requests.RollbackTableRequest;
 import org.apache.paimon.rest.responses.AlterDatabaseResponse;
@@ -79,6 +83,7 @@
 import org.apache.paimon.rest.responses.ListFunctionsGloballyResponse;
 import org.apache.paimon.rest.responses.ListFunctionsResponse;
 import org.apache.paimon.rest.responses.ListPartitionsResponse;
+import org.apache.paimon.rest.responses.ListPermissionsResponse;
 import org.apache.paimon.rest.responses.ListSnapshotsResponse;
 import org.apache.paimon.rest.responses.ListTableDetailsResponse;
 import org.apache.paimon.rest.responses.ListTablesGloballyResponse;
@@ -833,6 +838,42 @@ public AuthTableQueryResponse authTableQuery(
                 restAuthFunction);
     }
 
+    /** Lists explicitly granted permissions for a catalog. */
+    public ListPermissionsResponse listPermissions(String catalog, ListPermissionsRequest request) {
+        Map<String, String> queryParams = Maps.newHashMap();
+        putQueryParameter(queryParams, "resourceType", request.getResourceType().name());
+        putQueryParameter(queryParams, "database", request.getDatabase());
+        putQueryParameter(queryParams, "table", request.getTable());
+        putQueryParameter(queryParams, "function", request.getFunction());
+        putQueryParameter(queryParams, "view", request.getView());
+        putQueryParameter(queryParams, "principal", request.getPrincipal());
+        if (request.getMaxResults() != null && request.getMaxResults() > 0) {
+            queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
+        }
+        putQueryParameter(queryParams, PAGE_TOKEN, request.getPageToken());
+        return client.get(
+                ResourcePaths.permissions(catalog),
+                queryParams,
+                ListPermissionsResponse.class,
+                restAuthFunction);
+    }
+
+    /** Grants a permission for a catalog. */
+    public void grantPermission(String catalog, Permission permission) {
+        client.post(
+                ResourcePaths.grantPermission(catalog),
+                new GrantPermissionRequest(permission),
+                restAuthFunction);
+    }
+
+    /** Revokes a permission for a catalog. */
+    public void revokePermission(String catalog, Permission permission) {
+        client.post(
+                ResourcePaths.revokePermission(catalog),
+                new RevokePermissionRequest(permission),
+                restAuthFunction);
+    }
+
     /**
      * Drop table.
      *
@@ -1727,4 +1768,11 @@ private final Map<String, String> buildPagedQueryParams(
     RESTAuthFunction authFunction() {
         return restAuthFunction;
     }
+
+    private static void putQueryParameter(
+            Map<String, String> queryParams, String name, @Nullable String value) {
+        if (StringUtils.isNotEmpty(value)) {
+            queryParams.put(name, value);
+        }
+    }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
index e7da1f6827dc..95a918614da3 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
@@ -42,6 +42,13 @@ public class RESTCatalogOptions {
                     .noDefaultValue()
                     .withDescription("REST Catalog auth token provider.");
 
+    public static final ConfigOption<String> MANAGEMENT_CATALOG =
+            ConfigOptions.key("management.catalog")
+                    .stringType()
+                    .noDefaultValue()
+                    .withDescription(
+                            "Remote catalog identifier used by optional REST management APIs.");
+
     public static final ConfigOption<String> DLF_REGION =
             ConfigOptions.key("dlf.region")
                     .stringType()
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
new file mode 100644
index 000000000000..6b838d100267
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.management.ListPermissionsRequest;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.rest.responses.ListPermissionsResponse;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/** REST implementation of permission management, bound to one remote catalog identifier. */
+public class RESTPermissionManagement implements PermissionManagement {
+
+    private final RESTApi api;
+    private final String catalog;
+
+    public RESTPermissionManagement(RESTApi api, String catalog) {
+        checkArgument(
+                catalog != null && !catalog.isEmpty(), "Management catalog is not configured");
+        this.api = api;
+        this.catalog = catalog;
+    }
+
+    @Override
+    public PagedList<Permission> listPermissions(ListPermissionsRequest request) {
+        ListPermissionsResponse response = api.listPermissions(catalog, request);
+        return new PagedList<>(response.getPermissions(), response.getNextPageToken());
+    }
+
+    @Override
+    public void grantPermission(Permission permission) {
+        api.grantPermission(catalog, permission);
+    }
+
+    @Override
+    public void revokePermission(Permission permission) {
+        api.revokePermission(catalog, permission);
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
index ae09705467cc..ff3a31ca3ecc 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
@@ -42,6 +42,8 @@ public class ResourcePaths {
     protected static final String REGISTER = "register";
     protected static final String FUNCTIONS = "functions";
     protected static final String FUNCTION_DETAILS = "function-details";
+    protected static final String CATALOGS = "catalogs";
+    protected static final String PERMISSIONS = "permissions";
     protected static final String ID = "id";
 
     private static final Joiner SLASH = Joiner.on("/").skipNulls();
@@ -50,6 +52,18 @@ public static String config() {
         return String.format("%s/config", V1);
     }
 
+    public static String permissions(String catalog) {
+        return SLASH.join(V1, CATALOGS, encodeString(catalog), PERMISSIONS);
+    }
+
+    public static String grantPermission(String catalog) {
+        return SLASH.join(permissions(catalog), "grant");
+    }
+
+    public static String revokePermission(String catalog) {
+        return SLASH.join(permissions(catalog), "revoke");
+    }
+
     public static ResourcePaths forCatalogProperties(Options options) {
         return new ResourcePaths(options.get(RESTCatalogInternalOptions.PREFIX));
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
new file mode 100644
index 000000000000..7b761360ac31
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
@@ -0,0 +1,187 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.requests;
+
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.ColumnSelection;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.management.RowFilter;
+import org.apache.paimon.rest.RESTRequest;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.Map;
+
+/** Flat request for granting a permission. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class GrantPermissionRequest implements RESTRequest {
+
+    private static final String FIELD_RESOURCE_TYPE = "resourceType";
+    private static final String FIELD_CATALOG = "catalog";
+    private static final String FIELD_DATABASE = "database";
+    private static final String FIELD_TABLE = "table";
+    private static final String FIELD_FUNCTION = "function";
+    private static final String FIELD_VIEW = "view";
+    private static final String FIELD_COLUMNS = "columns";
+    private static final String FIELD_ROW_FILTER = "rowFilter";
+    private static final String FIELD_COLUMN_MASKING = "columnMasking";
+    private static final String FIELD_ACCESS = "access";
+    private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_EXPIRE_TIME = "expireTime";
+
+    private final Permission permission;
+
+    public GrantPermissionRequest(Permission permission) {
+        this.permission = permission;
+    }
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_RESOURCE_TYPE,
+        FIELD_CATALOG,
+        FIELD_DATABASE,
+        FIELD_TABLE,
+        FIELD_FUNCTION,
+        FIELD_VIEW,
+        FIELD_COLUMNS,
+        FIELD_ROW_FILTER,
+        FIELD_COLUMN_MASKING,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL,
+        FIELD_EXPIRE_TIME
+    })
+    public GrantPermissionRequest(
+            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
+            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
+            @Nullable @JsonProperty(FIELD_DATABASE) String database,
+            @Nullable @JsonProperty(FIELD_TABLE) String table,
+            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
+            @Nullable @JsonProperty(FIELD_VIEW) String view,
+            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
+            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
+            @Nullable @JsonProperty(FIELD_COLUMN_MASKING) Map<String, ColumnMask> columnMasking,
+            @JsonProperty(FIELD_ACCESS) String access,
+            @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
+        this.permission =
+                new Permission(
+                        resourceType,
+                        catalog,
+                        database,
+                        table,
+                        function,
+                        view,
+                        columns,
+                        rowFilter,
+                        columnMasking,
+                        access,
+                        principal,
+                        expireTime);
+    }
+
+    public Permission permission() {
+        return permission;
+    }
+
+    @JsonGetter(FIELD_RESOURCE_TYPE)
+    public ResourceType getResourceType() {
+        return permission.getResourceType();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_CATALOG)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getCatalog() {
+        return permission.getCatalog();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_DATABASE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getDatabase() {
+        return permission.getDatabase();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_TABLE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getTable() {
+        return permission.getTable();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_FUNCTION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getFunction() {
+        return permission.getFunction();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_VIEW)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getView() {
+        return permission.getView();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMNS)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public ColumnSelection getColumns() {
+        return permission.getColumns();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_ROW_FILTER)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public RowFilter getRowFilter() {
+        return permission.getRowFilter();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_MASKING)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public Map<String, ColumnMask> getColumnMasking() {
+        return permission.getColumnMasking();
+    }
+
+    @JsonGetter(FIELD_ACCESS)
+    public String getAccess() {
+        return permission.getAccess();
+    }
+
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return permission.getPrincipal();
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXPIRE_TIME)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getExpireTime() {
+        return permission.getExpireTime();
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
new file mode 100644
index 000000000000..15441c7b520e
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
@@ -0,0 +1,162 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.requests;
+
+import org.apache.paimon.management.ColumnSelection;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.rest.RESTRequest;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+
+/** Flat request for revoking a permission by its resource identity. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class RevokePermissionRequest implements RESTRequest {
+
+    private static final String FIELD_RESOURCE_TYPE = "resourceType";
+    private static final String FIELD_CATALOG = "catalog";
+    private static final String FIELD_DATABASE = "database";
+    private static final String FIELD_TABLE = "table";
+    private static final String FIELD_FUNCTION = "function";
+    private static final String FIELD_VIEW = "view";
+    private static final String FIELD_COLUMNS = "columns";
+    private static final String FIELD_ACCESS = "access";
+    private static final String FIELD_PRINCIPAL = "principal";
+
+    private final ResourceType resourceType;
+    @Nullable private final String catalog;
+    @Nullable private final String database;
+    @Nullable private final String table;
+    @Nullable private final String function;
+    @Nullable private final String view;
+    @Nullable private final ColumnSelection columns;
+    private final String access;
+    private final String principal;
+
+    public RevokePermissionRequest(Permission permission) {
+        this(
+                permission.getResourceType(),
+                permission.getCatalog(),
+                permission.getDatabase(),
+                permission.getTable(),
+                permission.getFunction(),
+                permission.getView(),
+                permission.getColumns(),
+                permission.getAccess(),
+                permission.getPrincipal());
+    }
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_RESOURCE_TYPE,
+        FIELD_CATALOG,
+        FIELD_DATABASE,
+        FIELD_TABLE,
+        FIELD_FUNCTION,
+        FIELD_VIEW,
+        FIELD_COLUMNS,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL
+    })
+    public RevokePermissionRequest(
+            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
+            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
+            @Nullable @JsonProperty(FIELD_DATABASE) String database,
+            @Nullable @JsonProperty(FIELD_TABLE) String table,
+            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
+            @Nullable @JsonProperty(FIELD_VIEW) String view,
+            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
+            @JsonProperty(FIELD_ACCESS) String access,
+            @JsonProperty(FIELD_PRINCIPAL) String principal) {
+        this.resourceType = resourceType;
+        this.catalog = catalog;
+        this.database = database;
+        this.table = table;
+        this.function = function;
+        this.view = view;
+        this.columns = columns;
+        this.access = access;
+        this.principal = principal;
+    }
+
+    @JsonGetter(FIELD_RESOURCE_TYPE)
+    public ResourceType getResourceType() {
+        return resourceType;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_CATALOG)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getCatalog() {
+        return catalog;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_DATABASE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getDatabase() {
+        return database;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_TABLE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getTable() {
+        return table;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_FUNCTION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getFunction() {
+        return function;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_VIEW)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getView() {
+        return view;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMNS)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public ColumnSelection getColumns() {
+        return columns;
+    }
+
+    @JsonGetter(FIELD_ACCESS)
+    public String getAccess() {
+        return access;
+    }
+
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return principal;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
new file mode 100644
index 000000000000..af3e13a6568c
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.responses;
+
+import org.apache.paimon.management.Permission;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.List;
+
+/** Response for listing permissions. */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class ListPermissionsResponse implements PagedResponse<Permission> {
+
+    private static final String FIELD_PERMISSIONS = "permissions";
+    private static final String FIELD_NEXT_PAGE_TOKEN = "nextPageToken";
+
+    @JsonProperty(FIELD_PERMISSIONS)
+    private final List<Permission> permissions;
+
+    @Nullable
+    @JsonProperty(FIELD_NEXT_PAGE_TOKEN)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String nextPageToken;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_PERMISSIONS, FIELD_NEXT_PAGE_TOKEN})
+    public ListPermissionsResponse(
+            @JsonProperty(FIELD_PERMISSIONS) List<Permission> permissions,
+            @Nullable @JsonProperty(FIELD_NEXT_PAGE_TOKEN) String nextPageToken) {
+        this.permissions = permissions;
+        this.nextPageToken = nextPageToken;
+    }
+
+    @JsonGetter(FIELD_PERMISSIONS)
+    public List<Permission> getPermissions() {
+        return permissions;
+    }
+
+    @Override
+    @Nullable
+    @JsonGetter(FIELD_NEXT_PAGE_TOKEN)
+    public String getNextPageToken() {
+        return nextPageToken;
+    }
+
+    @Override
+    public List<Permission> data() {
+        return permissions;
+    }
+}
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
new file mode 100644
index 000000000000..31f5c27efd37
--- /dev/null
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -0,0 +1,109 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.rest.RESTApi;
+import org.apache.paimon.rest.requests.GrantPermissionRequest;
+import org.apache.paimon.rest.requests.RevokePermissionRequest;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/** JSON compatibility tests for the permission management contract. */
+public class PermissionManagementJsonTest {
+
+    private static final String PERMISSION_JSON =
+            "{\"resourceType\":\"COLUMN\",\"catalog\":\"catalog-name\","
+                    + "\"database\":\"sales\",\"table\":\"orders\","
+                    + "\"columns\":{\"columnNames\":[\"id\",\"amount\"]},"
+                    + "\"access\":\"SELECT\",\"principal\":\"role:analyst\","
+                    + "\"expireTime\":\"2027-01-01T00:00:00Z\"}";
+
+    @Test
+    void testPermissionDeserializesWithShadedAndExternalJackson() throws Exception {
+        Permission shaded = RESTApi.fromJson(PERMISSION_JSON, Permission.class);
+        Permission external =
+                new com.fasterxml.jackson.databind.ObjectMapper()
+                        .readValue(PERMISSION_JSON, Permission.class);
+
+        assertPermission(shaded);
+        assertPermission(external);
+    }
+
+    @Test
+    void testGrantAndRevokeUseFlatWireShapes() throws Exception {
+        Permission permission = RESTApi.fromJson(PERMISSION_JSON, Permission.class);
+        Map<?, ?> grant =
+                RESTApi.fromJson(RESTApi.toJson(new GrantPermissionRequest(permission)), Map.class);
+        assertThat(grant.get("resourceType")).isEqualTo("COLUMN");
+        assertThat(grant.get("catalog")).isEqualTo("catalog-name");
+        assertThat(grant.get("database")).isEqualTo("sales");
+        assertThat(grant.get("table")).isEqualTo("orders");
+        assertThat(grant.get("access")).isEqualTo("SELECT");
+        assertThat(grant.get("principal")).isEqualTo("role:analyst");
+        assertThat(grant.get("expireTime")).isEqualTo("2027-01-01T00:00:00Z");
+        assertThat(grant.containsKey("permission")).isFalse();
+
+        Map<?, ?> revoke =
+                RESTApi.fromJson(
+                        RESTApi.toJson(new RevokePermissionRequest(permission)), Map.class);
+        assertThat(revoke.get("resourceType")).isEqualTo("COLUMN");
+        assertThat(revoke.get("catalog")).isEqualTo("catalog-name");
+        assertThat(revoke.get("database")).isEqualTo("sales");
+        assertThat(revoke.get("table")).isEqualTo("orders");
+        assertThat(revoke.get("access")).isEqualTo("SELECT");
+        assertThat(revoke.get("principal")).isEqualTo("role:analyst");
+        assertThat(revoke.containsKey("expireTime")).isFalse();
+        assertThat(revoke.containsKey("rowFilter")).isFalse();
+        assertThat(revoke.containsKey("columnMasking")).isFalse();
+    }
+
+    @Test
+    void testRowFilterAndColumnMaskUseExpressionPayloads() throws Exception {
+        String json =
+                "{\"resourceType\":\"ROW_FILTER\",\"database\":\"sales\","
+                        + "\"table\":\"orders\",\"rowFilter\":{\"expression\":\"region = 'cn'\","
+                        + "\"predicate\":\"predicate-json\"},\"columnMasking\":{\"email\":{"
+                        + "\"expression\":\"UPPER(email)\",\"transform\":\"transform-json\"}},"
+                        + "\"access\":\"ROW_FILTER\",\"principal\":\"role:analyst\"}";
+
+        Permission permission = RESTApi.fromJson(json, Permission.class);
+        assertThat(permission.getRowFilter().getExpression()).isEqualTo("region = 'cn'");
+        assertThat(permission.getRowFilter().getPredicate()).isEqualTo("predicate-json");
+        assertThat(permission.getColumnMasking().get("email").getExpression())
+                .isEqualTo("UPPER(email)");
+        assertThat(permission.getColumnMasking().get("email").getTransform())
+                .isEqualTo("transform-json");
+    }
+
+    private static void assertPermission(Permission permission) {
+        assertThat(permission.getResourceType()).isEqualTo(ResourceType.COLUMN);
+        assertThat(permission.getCatalog()).isEqualTo("catalog-name");
+        assertThat(permission.getDatabase()).isEqualTo("sales");
+        assertThat(permission.getTable()).isEqualTo("orders");
+        assertThat(permission.getColumns().getColumnNames()).containsExactly("id", "amount");
+        assertThat(permission.getColumns().getExcludedColumnNames()).isNull();
+        assertThat(permission.getAccess()).isEqualTo("SELECT");
+        assertThat(permission.getPrincipal()).isEqualTo("role:analyst");
+        assertThat(permission.getExpireTime()).isEqualTo("2027-01-01T00:00:00Z");
+    }
+}
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
new file mode 100644
index 000000000000..5d64b087ef0b
--- /dev/null
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
@@ -0,0 +1,232 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.management.ListPermissionsRequest;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.options.Options;
+import org.apache.paimon.rest.exceptions.ForbiddenException;
+import org.apache.paimon.rest.exceptions.NoSuchResourceException;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.apache.paimon.rest.RESTCatalogInternalOptions.PREFIX;
+import static org.apache.paimon.rest.RESTCatalogOptions.TOKEN;
+import static org.apache.paimon.rest.RESTCatalogOptions.TOKEN_PROVIDER;
+import static org.apache.paimon.rest.RESTCatalogOptions.URI;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/** Behavioral tests for REST permission management. */
+public class RESTPermissionManagementTest {
+
+    private static final String BASE_PATH = "/v1/catalogs/catalog+name/permissions";
+
+    private HttpServer server;
+    private PermissionManagement management;
+    private final AtomicReference<String> grantBody = new AtomicReference<>();
+    private final AtomicReference<String> revokeBody = new AtomicReference<>();
+    private final AtomicReference<String> authorization = new AtomicReference<>();
+    private final AtomicReference<String> listQuery = new AtomicReference<>();
+
+    @BeforeEach
+    void setUp() throws Exception {
+        server = HttpServer.create(new InetSocketAddress(0), 0);
+        server.createContext(
+                "/v1/catalogs/",
+                exchange -> {
+                    authorization.set(exchange.getRequestHeaders().getFirst("Authorization"));
+                    String path = exchange.getRequestURI().getRawPath();
+                    if (BASE_PATH.equals(path) && "GET".equals(exchange.getRequestMethod())) {
+                        listQuery.set(exchange.getRequestURI().getRawQuery());
+                        respond(
+                                exchange,
+                                200,
+                                "{\"permissions\":[{\"resourceType\":\"TABLE\","
+                                        + "\"database\":\"sales\",\"table\":\"orders\","
+                                        + "\"access\":\"SELECT\","
+                                        + "\"principal\":\"role:analyst\"}],"
+                                        + "\"nextPageToken\":\"next\"}");
+                    } else if ((BASE_PATH + "/grant").equals(path)) {
+                        String body = readBody(exchange);
+                        grantBody.set(body);
+                        if (body.contains("denied")) {
+                            respond(exchange, 403, "{\"message\":\"forbidden\",\"code\":403}");
+                        } else {
+                            respond(exchange, 200, null);
+                        }
+                    } else if ((BASE_PATH + "/revoke").equals(path)) {
+                        String body = readBody(exchange);
+                        revokeBody.set(body);
+                        if (body.contains("missing")) {
+                            respond(
+                                    exchange,
+                                    404,
+                                    "{\"message\":\"permission does not exist\","
+                                            + "\"resourceType\":\"PERMISSION\","
+                                            + "\"resourceName\":\"missing\",\"code\":404}");
+                        } else {
+                            respond(exchange, 200, null);
+                        }
+                    } else {
+                        respond(exchange, 404, "{\"message\":\"missing\",\"code\":404}");
+                    }
+                });
+        server.start();
+
+        Options options = new Options();
+        options.set(URI, "http://127.0.0.1:" + server.getAddress().getPort());
+        options.set(TOKEN_PROVIDER, "bear");
+        options.set(TOKEN, "secret");
+        options.set(PREFIX, "unused");
+        management = new RESTPermissionManagement(new RESTApi(options, false), "catalog name");
+    }
+
+    @AfterEach
+    void tearDown() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    void testListUsesEncodedCatalogAndCompleteFilters() throws Exception {
+        PagedList<Permission> page =
+                management.listPermissions(
+                        new ListPermissionsRequest(
+                                ResourceType.TABLE,
+                                "sales",
+                                "orders",
+                                null,
+                                null,
+                                "role:analyst",
+                                "start",
+                                25));
+
+        assertThat(page.getElements()).hasSize(1);
+        assertThat(page.getElements().get(0).getPrincipal()).isEqualTo("role:analyst");
+        assertThat(page.getNextPageToken()).isEqualTo("next");
+        assertThat(queryParameters(listQuery.get()))
+                .containsEntry("principal", "role:analyst")
+                .containsEntry("resourceType", "TABLE")
+                .containsEntry("database", "sales")
+                .containsEntry("table", "orders")
+                .containsEntry("maxResults", "25")
+                .containsEntry("pageToken", "start");
+        assertThat(authorization.get()).isEqualTo("Bearer secret");
+    }
+
+    @Test
+    void testGrantAndRevokeUseFlatWireShapes() throws Exception {
+        Permission permission = permission("role:analyst");
+        management.grantPermission(permission);
+        management.revokePermission(permission);
+
+        Map<?, ?> grant = RESTApi.fromJson(grantBody.get(), Map.class);
+        assertThat(grant.get("resourceType")).isEqualTo("TABLE");
+        assertThat(grant.get("database")).isEqualTo("sales");
+        assertThat(grant.get("table")).isEqualTo("orders");
+        assertThat(grant.get("access")).isEqualTo("SELECT");
+        assertThat(grant.get("principal")).isEqualTo("role:analyst");
+        assertThat(grant.containsKey("permission")).isFalse();
+
+        Map<?, ?> revoke = RESTApi.fromJson(revokeBody.get(), Map.class);
+        assertThat(revoke.get("resourceType")).isEqualTo("TABLE");
+        assertThat(revoke.get("database")).isEqualTo("sales");
+        assertThat(revoke.get("table")).isEqualTo("orders");
+        assertThat(revoke.get("access")).isEqualTo("SELECT");
+        assertThat(revoke.get("principal")).isEqualTo("role:analyst");
+        assertThat(revoke.containsKey("expireTime")).isFalse();
+    }
+
+    @Test
+    void testForbiddenGrantPreservesRESTErrorTranslation() {
+        assertThatThrownBy(() -> management.grantPermission(permission("denied")))
+                .isInstanceOf(ForbiddenException.class)
+                .hasMessageContaining("forbidden");
+    }
+
+    @Test
+    void testMissingRevokeIsNotSilentlyIdempotent() {
+        assertThatThrownBy(() -> management.revokePermission(permission("missing")))
+                .isInstanceOf(NoSuchResourceException.class)
+                .hasMessageContaining("permission does not exist");
+    }
+
+    private static Permission permission(String principal) {
+        return new Permission(
+                ResourceType.TABLE,
+                null,
+                "sales",
+                "orders",
+                null,
+                null,
+                null,
+                null,
+                null,
+                "SELECT",
+                principal,
+                null);
+    }
+
+    private static Map<String, String> queryParameters(String query) throws Exception {
+        Map<String, String> values = new HashMap<>();
+        for (String parameter : query.split("&")) {
+            String[] pair = parameter.split("=", 2);
+            values.put(URLDecoder.decode(pair[0], "UTF-8"), URLDecoder.decode(pair[1], "UTF-8"));
+        }
+        return values;
+    }
+
+    private static String readBody(HttpExchange exchange) throws IOException {
+        byte[] data = new byte[8192];
+        int read = exchange.getRequestBody().read(data);
+        return read < 0 ? "" : new String(data, 0, read, StandardCharsets.UTF_8);
+    }
+
+    private static void respond(HttpExchange exchange, int code, String body) throws IOException {
+        if (body == null) {
+            exchange.sendResponseHeaders(code, 0);
+            exchange.getResponseBody().close();
+        } else {
+            byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(code, bytes.length);
+            try (OutputStream output = exchange.getResponseBody()) {
+                output.write(bytes);
+            }
+        }
+        exchange.close();
+    }
+}
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
index 51bf7c8831f5..30ebab546325 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
@@ -169,9 +169,11 @@ public class RequestJacksonCompatibilityTest {
                             CreatePartitionsRequest.class,
                             CreateTableRequest.class,
                             CreateViewRequest.class,
+                            GrantPermissionRequest.class,
                             RegisterTableRequest.class,
                             RenameTableRequest.class,
                             ReplaceTableRequest.class,
+                            RevokePermissionRequest.class,
                             RollbackTableRequest.class)
                     .collect(Collectors.toSet());
 
diff --git a/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java b/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
index a24fb2354912..75a92f0fdc01 100644
--- a/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
+++ b/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
@@ -39,6 +39,7 @@
 import org.apache.paimon.fs.cache.LocalCacheManager;
 import org.apache.paimon.function.Function;
 import org.apache.paimon.function.FunctionChange;
+import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
@@ -137,6 +138,11 @@ public RESTCatalogLoader catalogLoader() {
         return new RESTCatalogLoader(context);
     }
 
+    public PermissionManagement permissionManagement() {
+        return new RESTPermissionManagement(
+                api, context.options().get(RESTCatalogOptions.MANAGEMENT_CATALOG));
+    }
+
     @Override
     public List<String> listDatabases() {
         return api.listDatabases();
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 733b4b1c9fef..988af82f848e 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -40,6 +40,8 @@
 import org.apache.paimon.function.FunctionChange;
 import org.apache.paimon.function.FunctionDefinition;
 import org.apache.paimon.function.FunctionImpl;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.operation.Lock;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
@@ -63,12 +65,14 @@
 import org.apache.paimon.rest.requests.CreateTagRequest;
 import org.apache.paimon.rest.requests.CreateViewRequest;
 import org.apache.paimon.rest.requests.DropPartitionsRequest;
+import org.apache.paimon.rest.requests.GrantPermissionRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByNamesRequest;
 import org.apache.paimon.rest.requests.MarkDonePartitionsRequest;
 import org.apache.paimon.rest.requests.RenameTableRequest;
 import org.apache.paimon.rest.requests.ReplaceTableRequest;
 import org.apache.paimon.rest.requests.ResetConsumerRequest;
+import org.apache.paimon.rest.requests.RevokePermissionRequest;
 import org.apache.paimon.rest.requests.RollbackSchemaRequest;
 import org.apache.paimon.rest.requests.RollbackTableRequest;
 import org.apache.paimon.rest.responses.AlterDatabaseResponse;
@@ -93,6 +97,7 @@
 import org.apache.paimon.rest.responses.ListFunctionsGloballyResponse;
 import org.apache.paimon.rest.responses.ListFunctionsResponse;
 import org.apache.paimon.rest.responses.ListPartitionsResponse;
+import org.apache.paimon.rest.responses.ListPermissionsResponse;
 import org.apache.paimon.rest.responses.ListSnapshotsResponse;
 import org.apache.paimon.rest.responses.ListTableDetailsResponse;
 import org.apache.paimon.rest.responses.ListTablesGloballyResponse;
@@ -195,6 +200,7 @@ public class RESTCatalogServer {
     public static final String AUTHORIZATION_HEADER_KEY = "Authorization";
 
     private final String databaseUri;
+    private final @Nullable String permissionUri;
 
     private final CatalogContext catalogContext;
     private final RESTFileSystemCatalog catalog;
@@ -202,6 +208,8 @@ public class RESTCatalogServer {
 
     private final Map<String, Database> databaseStore = new HashMap<>();
     private final Map<String, TableMetadata> tableMetadataStore = new HashMap<>();
+    private final List<Permission> permissionStore =
+            new java.util.concurrent.CopyOnWriteArrayList<>();
 
     private final List<ListPartitionsByFilterRequest> receivedListPartitionsByFilterRequests =
             new java.util.concurrent.CopyOnWriteArrayList<>();
@@ -238,6 +246,10 @@ public RESTCatalogServer(
                 this.configResponse.getDefaults().get(RESTCatalogInternalOptions.PREFIX.key());
         this.resourcePaths = new ResourcePaths(prefix);
         this.databaseUri = resourcePaths.databases();
+        String managementCatalog =
+                this.configResponse.getDefaults().get(RESTCatalogOptions.MANAGEMENT_CATALOG.key());
+        this.permissionUri =
+                managementCatalog == null ? null : ResourcePaths.permissions(managementCatalog);
         Options conf = new Options();
         this.configResponse.getDefaults().forEach(conf::setString);
         conf.setString(WAREHOUSE.key(), dataPath);
@@ -384,6 +396,11 @@ public MockResponse dispatch(RecordedRequest request) {
                                     .queryParameter(WAREHOUSE.key())
                                     .equals(warehouse)) {
                         return mockResponse(configResponse, 200);
+                    } else if (permissionUri != null
+                            && (permissionUri.equals(resourcePath)
+                                    || request.getPath().startsWith(permissionUri + "/"))) {
+                        return permissionsApiHandler(
+                                request.getMethod(), resourcePath, data, parameters);
                     } else if (databaseUri.equals(request.getPath())
                             || request.getPath().contains(databaseUri + "?")) {
                         return databasesApiHandler(restAuthParameter.method(), data, parameters);
@@ -3113,6 +3130,109 @@ private static int getMaxResults(Map<String, String> parameters) {
         return maxResults;
     }
 
+    private MockResponse permissionsApiHandler(
+            String method, String resourcePath, String data, Map<String, String> parameters)
+            throws JsonProcessingException {
+        if ("GET".equals(method) && permissionUri.equals(resourcePath)) {
+            List<Permission> filtered =
+                    permissionStore.stream()
+                            .filter(permission -> matchesPermission(permission, parameters))
+                            .collect(Collectors.toList());
+            int start =
+                    parameters.containsKey(PAGE_TOKEN)
+                            ? Integer.parseInt(parameters.get(PAGE_TOKEN))
+                            : 0;
+            int end = Math.min(start + getMaxResults(parameters), filtered.size());
+            List<Permission> page = new ArrayList<>(filtered.subList(start, end));
+            String nextPageToken = end < filtered.size() ? String.valueOf(end) : null;
+            return mockResponse(new ListPermissionsResponse(page, nextPageToken), 200);
+        }
+
+        if ("POST".equals(method) && (permissionUri + "/grant").equals(resourcePath)) {
+            Permission permission =
+                    RESTApi.fromJson(data, GrantPermissionRequest.class).permission();
+            permissionStore.removeIf(existing -> sameIdentity(existing, permission));
+            permissionStore.add(permission);
+            return new MockResponse().setResponseCode(200);
+        }
+
+        if ("POST".equals(method) && (permissionUri + "/revoke").equals(resourcePath)) {
+            RevokePermissionRequest request = RESTApi.fromJson(data, RevokePermissionRequest.class);
+            boolean removed =
+                    permissionStore.removeIf(
+                            permission ->
+                                    sameIdentity(
+                                            permission,
+                                            new Permission(
+                                                    request.getResourceType(),
+                                                    request.getCatalog(),
+                                                    request.getDatabase(),
+                                                    request.getTable(),
+                                                    request.getFunction(),
+                                                    request.getView(),
+                                                    request.getColumns(),
+                                                    null,
+                                                    null,
+                                                    request.getAccess(),
+                                                    request.getPrincipal(),
+                                                    null)));
+            return removed
+                    ? new MockResponse().setResponseCode(200)
+                    : mockResponse(
+                            new ErrorResponse(
+                                    "PERMISSION",
+                                    request.getPrincipal(),
+                                    "Permission does not exist.",
+                                    404),
+                            404);
+        }
+
+        return new MockResponse().setResponseCode(404);
+    }
+
+    private static boolean matchesPermission(
+            Permission permission, Map<String, String> parameters) {
+        return matches(parameters, "principal", permission.getPrincipal())
+                && matchesResourceType(parameters, permission.getResourceType())
+                && matches(parameters, "database", permission.getDatabase())
+                && matches(parameters, "table", permission.getTable())
+                && matches(parameters, "function", permission.getFunction())
+                && matches(parameters, "view", permission.getView());
+    }
+
+    private static boolean matches(
+            Map<String, String> parameters, String key, @Nullable String value) {
+        return !parameters.containsKey(key) || Objects.equals(parameters.get(key), value);
+    }
+
+    private static boolean matchesResourceType(
+            Map<String, String> parameters, ResourceType resourceType) {
+        String filter = parameters.get("resourceType");
+        if (filter == null || filter.equals(resourceType.name())) {
+            return true;
+        }
+        if (ResourceType.CATALOG.name().equals(filter)) {
+            return resourceType == ResourceType.CATALOG_ALL;
+        }
+        if (ResourceType.DATABASE.name().equals(filter)) {
+            return resourceType == ResourceType.DATABASE_ALL;
+        }
+        return ResourceType.TABLE.name().equals(filter)
+                && (resourceType == ResourceType.COLUMN
+                        || resourceType == ResourceType.ROW_FILTER
+                        || resourceType == ResourceType.COLUMN_MASKING);
+    }
+
+    private static boolean sameIdentity(Permission left, Permission right) {
+        return left.getResourceType() == right.getResourceType()
+                && Objects.equals(left.getDatabase(), right.getDatabase())
+                && Objects.equals(left.getTable(), right.getTable())
+                && Objects.equals(left.getFunction(), right.getFunction())
+                && Objects.equals(left.getView(), right.getView())
+                && left.getAccess().equalsIgnoreCase(right.getAccess())
+                && left.getPrincipal().equals(right.getPrincipal());
+    }
+
     private <T> String getNextPageTokenForEntities(List<T> entities, Integer maxResults) {
         if (entities == null
                 || entities.isEmpty()
diff --git a/paimon-spark/paimon-spark-common/src/main/antlr4/org.apache.spark.sql.catalyst.parser.extensions/PaimonSqlExtensions.g4 b/paimon-spark/paimon-spark-common/src/main/antlr4/org.apache.spark.sql.catalyst.parser.extensions/PaimonSqlExtensions.g4
index 8c2e45b34ec2..bbd2728d9d91 100644
--- a/paimon-spark/paimon-spark-common/src/main/antlr4/org.apache.spark.sql.catalyst.parser.extensions/PaimonSqlExtensions.g4
+++ b/paimon-spark/paimon-spark-common/src/main/antlr4/org.apache.spark.sql.catalyst.parser.extensions/PaimonSqlExtensions.g4
@@ -167,6 +167,7 @@ overwriteClause
 expression
     : constant
     | stringMap
+    | stringArray
     ;
 
 constant
@@ -180,6 +181,10 @@ stringMap
     : MAP '(' constant (',' constant)* ')'
     ;
 
+stringArray
+    : ARRAY '(' (constant (',' constant)*)? ')'
+    ;
+
 booleanValue
     : TRUE | FALSE
     ;
@@ -214,7 +219,7 @@ nonReserved
     : ALTER | AS | CALL | CREATE | DAYS | DELETE | EXISTS | HOURS | IF | LIKE
     | NOT | OF | OR | TABLE | REPLACE | RETAIN | VERSION | TAG
     | TRUE | FALSE
-    | MAP
+    | ARRAY | MAP
     | COPY | INTO | FROM | FILE_FORMAT | PATTERN | FORCE | ON_ERROR | ABORT_STATEMENT | CONTINUE | SKIP_FILE | OVERWRITE
     | CSV
     | JSON
@@ -249,6 +254,7 @@ TRUE: 'TRUE';
 FALSE: 'FALSE';
 
 MAP: 'MAP';
+ARRAY: 'ARRAY';
 
 COPY: 'COPY';
 INTO: 'INTO';
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
index 60b5747e3db7..02c3a90a94bc 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
@@ -39,6 +39,8 @@
 import org.apache.paimon.spark.procedure.ExpireSnapshotsProcedure;
 import org.apache.paimon.spark.procedure.ExpireTagsProcedure;
 import org.apache.paimon.spark.procedure.FastForwardProcedure;
+import org.apache.paimon.spark.procedure.GrantPermissionProcedure;
+import org.apache.paimon.spark.procedure.ListPermissionsProcedure;
 import org.apache.paimon.spark.procedure.MarkPartitionDoneProcedure;
 import org.apache.paimon.spark.procedure.MaterializeDeletionVectorsProcedure;
 import org.apache.paimon.spark.procedure.MergeBranchProcedure;
@@ -57,6 +59,7 @@
 import org.apache.paimon.spark.procedure.ReplaceTagProcedure;
 import org.apache.paimon.spark.procedure.RescaleProcedure;
 import org.apache.paimon.spark.procedure.ResetConsumerProcedure;
+import org.apache.paimon.spark.procedure.RevokePermissionProcedure;
 import org.apache.paimon.spark.procedure.RewriteFileIndexProcedure;
 import org.apache.paimon.spark.procedure.RollbackProcedure;
 import org.apache.paimon.spark.procedure.RollbackToTimestampProcedure;
@@ -134,6 +137,9 @@ private static Map<String, Supplier<ProcedureBuilder>> initProcedureBuilders() {
         procedureBuilders.put("rewrite_file_index", RewriteFileIndexProcedure::builder);
         procedureBuilders.put("copy", CopyFilesProcedure::builder);
         procedureBuilders.put("reassign_row_id", ReassignRowIdProcedure::builder);
+        procedureBuilders.put("grant_permission", GrantPermissionProcedure::builder);
+        procedureBuilders.put("revoke_permission", RevokePermissionProcedure::builder);
+        procedureBuilders.put("list_permissions", ListPermissionsProcedure::builder);
         return procedureBuilders.build();
     }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
new file mode 100644
index 000000000000..f869a9555cb4
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
@@ -0,0 +1,316 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.catalog.Catalog;
+import org.apache.paimon.catalog.DelegateCatalog;
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.ColumnSelection;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.management.RowFilter;
+import org.apache.paimon.rest.RESTCatalog;
+import org.apache.paimon.spark.catalog.WithPaimonCatalog;
+
+import org.apache.spark.sql.catalyst.util.ArrayData;
+import org.apache.spark.sql.catalyst.util.MapData;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+
+import javax.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/** Shared REST catalog lookup and argument validation for permission procedures. */
+abstract class BasePermissionProcedure extends BaseProcedure {
+
+    protected BasePermissionProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    protected PermissionManagement permissionManagement() {
+        checkArgument(
+                tableCatalog() instanceof WithPaimonCatalog,
+                "Catalog '%s' is not a Paimon catalog.",
+                tableCatalog().name());
+        Catalog root =
+                DelegateCatalog.rootCatalog(((WithPaimonCatalog) tableCatalog()).paimonCatalog());
+        checkArgument(
+                root instanceof RESTCatalog,
+                "Catalog '%s' does not support permission management.",
+                tableCatalog().name());
+        return ((RESTCatalog) root).permissionManagement();
+    }
+
+    protected static Permission permission(
+            ResourceType resourceType,
+            String access,
+            String principal,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view,
+            @Nullable ArrayData columnNames,
+            @Nullable ArrayData excludedColumnNames,
+            @Nullable String rowFilter,
+            @Nullable MapData columnMasking,
+            @Nullable String expireTime) {
+        database = emptyToNull(database);
+        table = emptyToNull(table);
+        function = emptyToNull(function);
+        view = emptyToNull(view);
+        access = requiredUpperCase(access, "access");
+        checkPrincipal(principal);
+        validateResource(resourceType, database, table, function, view);
+
+        List<String> included = toStrings(columnNames, "column_names");
+        List<String> excluded = toStrings(excludedColumnNames, "excluded_column_names");
+        checkArgument(
+                included == null || excluded == null,
+                "Only one of column_names and excluded_column_names may be specified.");
+        ColumnSelection columns =
+                included == null && excluded == null
+                        ? null
+                        : new ColumnSelection(included, excluded);
+
+        rowFilter = emptyToNull(rowFilter);
+        Map<String, ColumnMask> masks = toColumnMasks(columnMasking);
+        validatePolicy(resourceType, access, columns, rowFilter, masks, expireTime);
+
+        return new Permission(
+                resourceType,
+                null,
+                database,
+                table,
+                function,
+                view,
+                columns,
+                rowFilter == null ? null : new RowFilter(rowFilter, null),
+                masks,
+                access,
+                principal,
+                emptyToNull(expireTime));
+    }
+
+    protected static Permission revokePermission(
+            ResourceType resourceType,
+            String access,
+            String principal,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view) {
+        database = emptyToNull(database);
+        table = emptyToNull(table);
+        function = emptyToNull(function);
+        view = emptyToNull(view);
+        validateResource(resourceType, database, table, function, view);
+        checkPrincipal(principal);
+        return new Permission(
+                resourceType,
+                null,
+                database,
+                table,
+                function,
+                view,
+                null,
+                null,
+                null,
+                requiredUpperCase(access, "access"),
+                principal,
+                null);
+    }
+
+    private static void validateResource(
+            ResourceType resourceType,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view) {
+        switch (resourceType) {
+            case CATALOG:
+            case CATALOG_ALL:
+                checkArgument(
+                        database == null && table == null && function == null && view == null,
+                        "%s resource cannot specify database, table, function, or view.",
+                        resourceType);
+                break;
+            case DATABASE:
+            case DATABASE_ALL:
+                checkArgument(database != null, "%s resource requires database.", resourceType);
+                checkArgument(
+                        table == null && function == null && view == null,
+                        "%s resource cannot specify table, function, or view.",
+                        resourceType);
+                break;
+            case TABLE:
+            case COLUMN:
+            case ROW_FILTER:
+            case COLUMN_MASKING:
+                checkArgument(
+                        database != null && table != null,
+                        "%s resource requires database and table.",
+                        resourceType);
+                checkArgument(
+                        function == null && view == null,
+                        "%s resource cannot specify function or view.",
+                        resourceType);
+                break;
+            case FUNCTION:
+                checkArgument(
+                        database != null && function != null,
+                        "FUNCTION resource requires database and function.");
+                checkArgument(
+                        table == null && view == null, "FUNCTION cannot specify table or view.");
+                break;
+            case VIEW:
+                checkArgument(
+                        database != null && view != null,
+                        "VIEW resource requires database and view.");
+                checkArgument(
+                        table == null && function == null,
+                        "VIEW cannot specify table or function.");
+                break;
+            default:
+                throw new IllegalArgumentException("Unsupported resource type: " + resourceType);
+        }
+    }
+
+    private static void validatePolicy(
+            ResourceType resourceType,
+            String access,
+            @Nullable ColumnSelection columns,
+            @Nullable String rowFilter,
+            @Nullable Map<String, ColumnMask> columnMasking,
+            @Nullable String expireTime) {
+        if (resourceType == ResourceType.COLUMN) {
+            checkArgument(
+                    "SELECT".equals(access), "COLUMN permission only supports SELECT access.");
+            checkArgument(
+                    columns != null,
+                    "COLUMN permission requires column_names or excluded_column_names.");
+        } else {
+            checkArgument(columns == null, "Columns are supported only for COLUMN permissions.");
+        }
+
+        if (resourceType == ResourceType.ROW_FILTER) {
+            checkArgument(
+                    "ROW_FILTER".equals(access),
+                    "ROW_FILTER permission requires ROW_FILTER access.");
+            checkArgument(rowFilter != null, "ROW_FILTER permission requires row_filter.");
+            checkArgument(
+                    emptyToNull(expireTime) == null,
+                    "expire_time is not supported for ROW_FILTER permissions.");
+        } else {
+            checkArgument(
+                    rowFilter == null, "row_filter is supported only for ROW_FILTER permissions.");
+        }
+
+        if (resourceType == ResourceType.COLUMN_MASKING) {
+            checkArgument(
+                    "COLUMN_MASKING".equals(access),
+                    "COLUMN_MASKING permission requires COLUMN_MASKING access.");
+            checkArgument(
+                    columnMasking != null, "COLUMN_MASKING permission requires column_masking.");
+            checkArgument(
+                    emptyToNull(expireTime) == null,
+                    "expire_time is not supported for COLUMN_MASKING permissions.");
+        } else {
+            checkArgument(
+                    columnMasking == null,
+                    "column_masking is supported only for COLUMN_MASKING permissions.");
+        }
+    }
+
+    protected static <E extends Enum<E>> E enumValue(
+            String value, Class<E> enumClass, String argument) {
+        checkArgument(!isBlank(value), "%s cannot be empty.", argument);
+        try {
+            return Enum.valueOf(enumClass, value.toUpperCase(Locale.ROOT));
+        } catch (IllegalArgumentException e) {
+            throw new IllegalArgumentException(
+                    String.format(
+                            "Invalid %s '%s'. Expected one of %s.",
+                            argument, value, Arrays.toString(enumClass.getEnumConstants())),
+                    e);
+        }
+    }
+
+    protected static void checkPrincipal(String principal) {
+        checkArgument(!isBlank(principal), "principal cannot be empty.");
+    }
+
+    private static String requiredUpperCase(String value, String argument) {
+        checkArgument(!isBlank(value), "%s cannot be empty.", argument);
+        return value.toUpperCase(Locale.ROOT);
+    }
+
+    @Nullable
+    private static List<String> toStrings(@Nullable ArrayData data, String argument) {
+        if (data == null) {
+            return null;
+        }
+        checkArgument(data.numElements() > 0, "%s cannot be empty.", argument);
+        List<String> result = new ArrayList<>(data.numElements());
+        for (int i = 0; i < data.numElements(); i++) {
+            checkArgument(!data.isNullAt(i), "%s cannot contain null.", argument);
+            String value = data.getUTF8String(i).toString();
+            checkArgument(!isBlank(value), "%s cannot contain empty values.", argument);
+            result.add(value);
+        }
+        return result;
+    }
+
+    @Nullable
+    private static Map<String, ColumnMask> toColumnMasks(@Nullable MapData data) {
+        if (data == null) {
+            return null;
+        }
+        checkArgument(data.numElements() > 0, "column_masking cannot be empty.");
+        Map<String, ColumnMask> result = new HashMap<>();
+        for (int i = 0; i < data.numElements(); i++) {
+            checkArgument(
+                    !data.keyArray().isNullAt(i) && !data.valueArray().isNullAt(i),
+                    "column_masking cannot contain null keys or values.");
+            String key = data.keyArray().getUTF8String(i).toString();
+            String value = data.valueArray().getUTF8String(i).toString();
+            checkArgument(
+                    !isBlank(key) && !isBlank(value),
+                    "column_masking cannot contain empty keys or values.");
+            result.put(key, new ColumnMask(value, null));
+        }
+        return result;
+    }
+
+    @Nullable
+    protected static String emptyToNull(@Nullable String value) {
+        return isBlank(value) ? null : value;
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
new file mode 100644
index 000000000000..8ddff7f08ec6
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Grants a permission through a REST catalog. */
+public class GrantPermissionProcedure extends BasePermissionProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("resource_type", StringType),
+                ProcedureParameter.required("access", StringType),
+                ProcedureParameter.required("principal", StringType),
+                ProcedureParameter.optional("database", StringType),
+                ProcedureParameter.optional("table", StringType),
+                ProcedureParameter.optional("function", StringType),
+                ProcedureParameter.optional("view", StringType),
+                ProcedureParameter.optional("column_names", DataTypes.createArrayType(StringType)),
+                ProcedureParameter.optional(
+                        "excluded_column_names", DataTypes.createArrayType(StringType)),
+                ProcedureParameter.optional("row_filter", StringType),
+                ProcedureParameter.optional(
+                        "column_masking", DataTypes.createMapType(StringType, StringType)),
+                ProcedureParameter.optional("expire_time", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                    });
+
+    private GrantPermissionProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        ResourceType resourceType =
+                enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
+        Permission permission =
+                permission(
+                        resourceType,
+                        args.getString(1),
+                        args.getString(2),
+                        args.isNullAt(3) ? null : args.getString(3),
+                        args.isNullAt(4) ? null : args.getString(4),
+                        args.isNullAt(5) ? null : args.getString(5),
+                        args.isNullAt(6) ? null : args.getString(6),
+                        args.isNullAt(7) ? null : args.getArray(7),
+                        args.isNullAt(8) ? null : args.getArray(8),
+                        args.isNullAt(9) ? null : args.getString(9),
+                        args.isNullAt(10) ? null : args.getMap(10),
+                        args.isNullAt(11) ? null : args.getString(11));
+
+        permissionManagement().grantPermission(permission);
+        return new InternalRow[] {newInternalRow(true)};
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<GrantPermissionProcedure>() {
+            @Override
+            protected GrantPermissionProcedure doBuild() {
+                return new GrantPermissionProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "GrantPermissionProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
new file mode 100644
index 000000000000..80b1c0c00bcd
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
@@ -0,0 +1,158 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.management.ListPermissionsRequest;
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.utils.JsonSerdeUtil;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+import org.apache.spark.unsafe.types.UTF8String;
+
+import java.util.List;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.spark.sql.types.DataTypes.IntegerType;
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Lists explicitly granted permissions. */
+public class ListPermissionsProcedure extends BasePermissionProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("resource_type", StringType),
+                ProcedureParameter.optional("database", StringType),
+                ProcedureParameter.optional("table", StringType),
+                ProcedureParameter.optional("function", StringType),
+                ProcedureParameter.optional("view", StringType),
+                ProcedureParameter.optional("principal", StringType),
+                ProcedureParameter.optional("max_results", IntegerType),
+                ProcedureParameter.optional("page_token", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        field("resource_type", StringType, false),
+                        field("catalog", StringType, true),
+                        field("database", StringType, true),
+                        field("table", StringType, true),
+                        field("function", StringType, true),
+                        field("view", StringType, true),
+                        field("columns_json", StringType, true),
+                        field("row_filter_json", StringType, true),
+                        field("column_masking_json", StringType, true),
+                        field("access", StringType, false),
+                        field("principal", StringType, false),
+                        field("expire_time", StringType, true),
+                        field("next_page_token", StringType, true)
+                    });
+
+    private ListPermissionsProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        ResourceType resourceType =
+                enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
+        Integer maxResults = args.isNullAt(6) ? null : args.getInt(6);
+        checkArgument(maxResults == null || maxResults > 0, "max_results must be greater than 0.");
+
+        ListPermissionsRequest request =
+                new ListPermissionsRequest(
+                        resourceType,
+                        args.isNullAt(1) ? null : emptyToNull(args.getString(1)),
+                        args.isNullAt(2) ? null : emptyToNull(args.getString(2)),
+                        args.isNullAt(3) ? null : emptyToNull(args.getString(3)),
+                        args.isNullAt(4) ? null : emptyToNull(args.getString(4)),
+                        args.isNullAt(5) ? null : emptyToNull(args.getString(5)),
+                        args.isNullAt(7) ? null : emptyToNull(args.getString(7)),
+                        maxResults);
+        PagedList<Permission> page = permissionManagement().listPermissions(request);
+        List<Permission> permissions = page.getElements();
+        if (permissions == null || permissions.isEmpty()) {
+            return new InternalRow[0];
+        }
+
+        InternalRow[] rows = new InternalRow[permissions.size()];
+        for (int i = 0; i < permissions.size(); i++) {
+            Permission permission = permissions.get(i);
+            rows[i] =
+                    newInternalRow(
+                            string(permission.getResourceType().name()),
+                            string(permission.getCatalog()),
+                            string(permission.getDatabase()),
+                            string(permission.getTable()),
+                            string(permission.getFunction()),
+                            string(permission.getView()),
+                            json(permission.getColumns()),
+                            json(permission.getRowFilter()),
+                            json(permission.getColumnMasking()),
+                            string(permission.getAccess()),
+                            string(permission.getPrincipal()),
+                            string(permission.getExpireTime()),
+                            string(page.getNextPageToken()));
+        }
+        return rows;
+    }
+
+    private static StructField field(
+            String name, org.apache.spark.sql.types.DataType type, boolean nullable) {
+        return new StructField(name, type, nullable, Metadata.empty());
+    }
+
+    private static UTF8String string(String value) {
+        return value == null ? null : UTF8String.fromString(value);
+    }
+
+    private static UTF8String json(Object value) {
+        return value == null ? null : string(JsonSerdeUtil.toFlatJson(value));
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<ListPermissionsProcedure>() {
+            @Override
+            protected ListPermissionsProcedure doBuild() {
+                return new ListPermissionsProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "ListPermissionsProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
new file mode 100644
index 000000000000..b7173c9b72cf
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ResourceType;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Revokes a permission by its resource identity. */
+public class RevokePermissionProcedure extends BasePermissionProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("resource_type", StringType),
+                ProcedureParameter.required("access", StringType),
+                ProcedureParameter.required("principal", StringType),
+                ProcedureParameter.optional("database", StringType),
+                ProcedureParameter.optional("table", StringType),
+                ProcedureParameter.optional("function", StringType),
+                ProcedureParameter.optional("view", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                    });
+
+    private RevokePermissionProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        ResourceType resourceType =
+                enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
+        Permission permission =
+                revokePermission(
+                        resourceType,
+                        args.getString(1),
+                        args.getString(2),
+                        args.isNullAt(3) ? null : args.getString(3),
+                        args.isNullAt(4) ? null : args.getString(4),
+                        args.isNullAt(5) ? null : args.getString(5),
+                        args.isNullAt(6) ? null : args.getString(6));
+
+        permissionManagement().revokePermission(permission);
+        return new InternalRow[] {newInternalRow(true)};
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<RevokePermissionProcedure>() {
+            @Override
+            protected RevokePermissionProcedure doBuild() {
+                return new RevokePermissionProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "RevokePermissionProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
index b8b8d53e21b0..8192d1b426a9 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
@@ -19,7 +19,7 @@
 package org.apache.paimon.spark
 
 import org.apache.paimon.options.CatalogOptions
-import org.apache.paimon.rest.{RESTCatalogFactory, RESTCatalogInternalOptions, RESTCatalogServer}
+import org.apache.paimon.rest.{RESTCatalogFactory, RESTCatalogInternalOptions, RESTCatalogOptions, RESTCatalogServer}
 import org.apache.paimon.rest.auth.{AuthProviderEnum, BearTokenAuthProvider}
 import org.apache.paimon.rest.responses.ConfigResponse
 import org.apache.paimon.shade.guava30.com.google.common.collect.ImmutableMap
@@ -42,8 +42,11 @@ class PaimonSparkTestWithRestCatalogBase extends PaimonSparkTestBase {
         RESTCatalogInternalOptions.PREFIX.key,
         "paimon",
         CatalogOptions.WAREHOUSE.key,
+        warehouse,
+        RESTCatalogOptions.MANAGEMENT_CATALOG.key,
         warehouse),
-      ImmutableMap.of())
+      ImmutableMap.of()
+    )
     val authProvider = new BearTokenAuthProvider(initToken)
     restCatalogServer =
       new RESTCatalogServer(tempDBDir.getCanonicalPath, authProvider, config, warehouse)
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
new file mode 100644
index 000000000000..00c882c99093
--- /dev/null
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure
+
+import org.apache.paimon.spark.{PaimonSparkTestBase, PaimonSparkTestWithRestCatalogBase}
+
+import org.apache.spark.sql.Row
+import org.assertj.core.api.Assertions.assertThat
+
+/** End-to-end tests for permission management procedures. */
+class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
+
+  test("grant, list and revoke a permission") {
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'column',
+                  |  access => 'select',
+                  |  principal => 'role:analyst',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  column_names => array('id', 'amount'),
+                  |  expire_time => '2027-01-01T00:00:00Z')
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    val permission = spark
+      .sql("""CALL sys.list_permissions(
+             |  principal => 'role:analyst',
+             |  resource_type => 'TABLE')
+             |""".stripMargin)
+      .head()
+    assertThat(permission.getString(0)).isEqualTo("COLUMN")
+    assertThat(permission.isNullAt(1)).isTrue
+    assertThat(permission.getString(2)).isEqualTo("sales")
+    assertThat(permission.getString(3)).isEqualTo("orders")
+    assertThat(permission.getString(6)).contains("\"columnNames\":[\"id\",\"amount\"]")
+    assertThat(permission.getString(9)).isEqualTo("SELECT")
+    assertThat(permission.getString(10)).isEqualTo("role:analyst")
+    assertThat(permission.getString(11)).isEqualTo("2027-01-01T00:00:00Z")
+    assertThat(permission.isNullAt(12)).isTrue
+
+    checkAnswer(
+      spark.sql("""CALL sys.revoke_permission(
+                  |  resource_type => 'COLUMN',
+                  |  access => 'SELECT',
+                  |  principal => 'role:analyst',
+                  |  database => 'sales',
+                  |  table => 'orders')
+                  |""".stripMargin),
+      Row(true)
+    )
+    checkAnswer(
+      spark.sql(
+        "CALL sys.list_permissions(resource_type => 'COLUMN', principal => 'role:analyst')"
+      ),
+      Nil
+    )
+  }
+
+  test("list permissions supports opaque pagination tokens") {
+    grantCatalogPermission("role:first")
+    grantCatalogPermission("role:second")
+
+    val first = spark
+      .sql("CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1)")
+      .head()
+    assertThat(first.getString(10)).isEqualTo("role:first")
+    assertThat(first.getString(12)).isEqualTo("1")
+
+    val second = spark
+      .sql(
+        "CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1, page_token => '1')"
+      )
+      .head()
+    assertThat(second.getString(10)).isEqualTo("role:second")
+    assertThat(second.isNullAt(12)).isTrue
+  }
+
+  test("policy payload is limited to its matching resource type") {
+    val error = intercept[IllegalArgumentException] {
+      spark
+        .sql("""CALL sys.grant_permission(
+               |  resource_type => 'TABLE',
+               |  access => 'SELECT',
+               |  principal => 'role:writer',
+               |  database => 'sales',
+               |  table => 'orders',
+               |  column_names => array('id'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(error.getMessage)
+      .contains("Columns are supported only for COLUMN permissions")
+  }
+
+  private def grantCatalogPermission(principal: String): Unit = {
+    checkAnswer(
+      spark.sql(s"""CALL sys.grant_permission(
+                   |  resource_type => 'CATALOG_ALL',
+                   |  access => 'SELECT',
+                   |  principal => '$principal')
+                   |""".stripMargin),
+      Row(true)
+    )
+  }
+}
+
+/** Permission procedures must fail clearly for catalogs without the management capability. */
+class PermissionProcedureUnsupportedCatalogTest extends PaimonSparkTestBase {
+
+  test("filesystem catalog does not expose permission management") {
+    val error = intercept[IllegalArgumentException] {
+      spark
+        .sql("""CALL sys.grant_permission(
+               |  resource_type => 'CATALOG',
+               |  access => 'ALL',
+               |  principal => 'role:admin')
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(error.getMessage).contains("does not support permission management")
+  }
+}

From 2065aeb5973ba9eb6527be3764c231cc40c87b0e Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Mon, 24 Aug 2026 18:19:29 +0800
Subject: [PATCH 02/12] [api][spark] Fix permission management compatibility

---
 .../management/ListPermissionsRequest.java    |  9 +++
 .../apache/paimon/management/Permission.java  | 30 +++++++++-
 .../paimon/management/ResourceType.java       | 11 +++-
 .../PermissionManagementJsonTest.java         | 57 +++++++++++++++++++
 ...stractPaimonSparkSqlExtensionsParser.scala |  1 +
 .../CatalogQualifiedCreateTableLikeTest.scala |  5 ++
 6 files changed, 111 insertions(+), 2 deletions(-)

diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
index 0b009af3a8c1..3a9f1cfb8ba2 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -20,6 +20,8 @@
 
 import javax.annotation.Nullable;
 
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
 /** Resource filters and pagination for listing explicitly granted permissions. */
 public class ListPermissionsRequest {
 
@@ -41,6 +43,9 @@ public ListPermissionsRequest(
             @Nullable String principal,
             @Nullable String pageToken,
             @Nullable Integer maxResults) {
+        checkArgument(
+                !isBlank(database) || (isBlank(table) && isBlank(function) && isBlank(view)),
+                "database is required when table, function, or view is specified.");
         this.resourceType = resourceType;
         this.database = database;
         this.table = table;
@@ -89,4 +94,8 @@ public String getPageToken() {
     public Integer getMaxResults() {
         return maxResults;
     }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/Permission.java b/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
index 3e5c100669db..c8bad02e5b76 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
@@ -116,7 +116,7 @@ public class Permission {
         FIELD_EXPIRE_TIME
     })
     public Permission(
-            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
+            @JsonProperty(FIELD_RESOURCE_TYPE) String resourceType,
             @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
             @Nullable @JsonProperty(FIELD_DATABASE) String database,
             @Nullable @JsonProperty(FIELD_TABLE) String table,
@@ -128,6 +128,34 @@ public Permission(
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
+        this(
+                ResourceType.fromString(resourceType),
+                catalog,
+                database,
+                table,
+                function,
+                view,
+                columns,
+                rowFilter,
+                columnMasking,
+                access,
+                principal,
+                expireTime);
+    }
+
+    public Permission(
+            ResourceType resourceType,
+            @Nullable String catalog,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view,
+            @Nullable ColumnSelection columns,
+            @Nullable RowFilter rowFilter,
+            @Nullable Map<String, ColumnMask> columnMasking,
+            String access,
+            String principal,
+            @Nullable String expireTime) {
         this.resourceType = resourceType;
         this.catalog = catalog;
         this.database = database;
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
index 1beed2be1c2e..d2f1c30e4666 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
@@ -18,6 +18,10 @@
 
 package org.apache.paimon.management;
 
+import javax.annotation.Nullable;
+
+import java.util.Locale;
+
 /** Resource types supported by permission management. */
 public enum ResourceType {
     CATALOG,
@@ -29,5 +33,10 @@ public enum ResourceType {
     FUNCTION,
     COLUMN,
     ROW_FILTER,
-    COLUMN_MASKING
+    COLUMN_MASKING;
+
+    @Nullable
+    public static ResourceType fromString(@Nullable String value) {
+        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
+    }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index 31f5c27efd37..2dcc787c0801 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -27,6 +27,7 @@
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 /** JSON compatibility tests for the permission management contract. */
 public class PermissionManagementJsonTest {
@@ -49,6 +50,62 @@ void testPermissionDeserializesWithShadedAndExternalJackson() throws Exception {
         assertPermission(external);
     }
 
+    @Test
+    void testPermissionDeserializesLowerCaseResourceType() throws Exception {
+        String lowerCaseJson = PERMISSION_JSON.replace("\"COLUMN\"", "\"column\"");
+
+        Permission shaded = RESTApi.fromJson(lowerCaseJson, Permission.class);
+        Permission external =
+                new com.fasterxml.jackson.databind.ObjectMapper()
+                        .readValue(lowerCaseJson, Permission.class);
+
+        assertPermission(shaded);
+        assertPermission(external);
+    }
+
+    @Test
+    void testListObjectFiltersRequireDatabase() {
+        assertThatThrownBy(
+                        () ->
+                                new ListPermissionsRequest(
+                                        ResourceType.TABLE,
+                                        null,
+                                        "orders",
+                                        null,
+                                        null,
+                                        null,
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("database is required");
+        assertThatThrownBy(
+                        () ->
+                                new ListPermissionsRequest(
+                                        ResourceType.FUNCTION,
+                                        null,
+                                        null,
+                                        "calculate_tax",
+                                        null,
+                                        null,
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("database is required");
+        assertThatThrownBy(
+                        () ->
+                                new ListPermissionsRequest(
+                                        ResourceType.VIEW,
+                                        null,
+                                        null,
+                                        null,
+                                        "daily_orders",
+                                        null,
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("database is required");
+    }
+
     @Test
     void testGrantAndRevokeUseFlatWireShapes() throws Exception {
         Permission permission = RESTApi.fromJson(PERMISSION_JSON, Permission.class);
diff --git a/paimon-spark/paimon-spark-common/src/main/scala/org/apache/spark/sql/catalyst/parser/extensions/AbstractPaimonSparkSqlExtensionsParser.scala b/paimon-spark/paimon-spark-common/src/main/scala/org/apache/spark/sql/catalyst/parser/extensions/AbstractPaimonSparkSqlExtensionsParser.scala
index 7770143c8012..6cede203d4b0 100644
--- a/paimon-spark/paimon-spark-common/src/main/scala/org/apache/spark/sql/catalyst/parser/extensions/AbstractPaimonSparkSqlExtensionsParser.scala
+++ b/paimon-spark/paimon-spark-common/src/main/scala/org/apache/spark/sql/catalyst/parser/extensions/AbstractPaimonSparkSqlExtensionsParser.scala
@@ -71,6 +71,7 @@ abstract class AbstractPaimonSparkSqlExtensionsParser(val delegate: ParserInterf
     PaimonSqlExtensionsParser.TAG,
     PaimonSqlExtensionsParser.TRUE,
     PaimonSqlExtensionsParser.FALSE,
+    PaimonSqlExtensionsParser.ARRAY,
     PaimonSqlExtensionsParser.MAP,
     PaimonSqlExtensionsParser.COPY,
     PaimonSqlExtensionsParser.INTO,
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/sql/CatalogQualifiedCreateTableLikeTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/sql/CatalogQualifiedCreateTableLikeTest.scala
index c4eb2cd6443a..350462fc1ca0 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/sql/CatalogQualifiedCreateTableLikeTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/sql/CatalogQualifiedCreateTableLikeTest.scala
@@ -139,6 +139,11 @@ class CatalogQualifiedCreateTableLikeTest extends PaimonSparkTestBase {
     Assertions.assertEquals("skip_file", skipFileCommand.targetIdent.name())
     Assertions.assertEquals(Seq("test"), skipFileCommand.targetIdent.namespace().toSeq)
 
+    val arrayCommand =
+      parseCreateTableLikeCommand("CREATE TABLE paimon.test.array LIKE paimon.test.source_tbl")
+    Assertions.assertEquals("array", arrayCommand.targetIdent.name())
+    Assertions.assertEquals(Seq("test"), arrayCommand.targetIdent.namespace().toSeq)
+
     val nestedIdentifierCommand =
       parseCreateTableLikeCommand(
         "CREATE TABLE paimon.test.extra.target_tbl LIKE paimon.test.extra.source_tbl")

From f125eb6b09be065525741a86d3dab4ed30bd8bd3 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 08:59:22 +0800
Subject: [PATCH 03/12] [docs] Expand REST permission management examples

---
 docs/docs/concepts/rest/management-api.md | 224 ++++++++++++++++++++--
 1 file changed, 206 insertions(+), 18 deletions(-)

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index 5e5355b57288..56aed6396565 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -47,9 +47,101 @@ Non-REST catalog implementations fail these operations with an explicit unsuppor
 Spark exposes the management contract through procedures. Custom `GRANT` and `REVOKE` grammar is
 not required, so the SQL layer remains a thin adapter over the same Java and REST contracts.
 
-Grant access to selected columns:
+The examples below assume that the Spark catalog is named `paimon`. Replace it with the local
+catalog name from `spark.sql.catalog.<catalog-name>`. Procedure arguments are named so optional
+resource fields can be omitted. `resource_type` and `access` are case-insensitive and are sent to
+the server in upper case; `principal` is an opaque, non-empty identifier understood by the server.
+
+### Resource types
+
+The resource type determines which locator arguments are required and which arguments must be
+omitted.
+
+| Resource type | Required locator | Meaning |
+| --- | --- | --- |
+| `CATALOG` | none | A permission on the catalog itself. |
+| `CATALOG_ALL` | none | A catalog permission inherited by descendant resources. |
+| `DATABASE` | `database` | A permission on one database. |
+| `DATABASE_ALL` | `database` | A database permission inherited by descendant resources. |
+| `TABLE` | `database`, `table` | A permission on one table. |
+| `FUNCTION` | `database`, `function` | A permission on one function. |
+| `VIEW` | `database`, `view` | A permission on one view. |
+| `COLUMN` | `database`, `table` | A `SELECT` permission on selected table columns. |
+| `ROW_FILTER` | `database`, `table` | A row-filter policy granted separately from table access. |
+| `COLUMN_MASKING` | `database`, `table` | Column-masking policies granted separately from table access. |
+
+### Grant permissions
+
+`grant_permission` creates or replaces a grant with the same permission identity and returns one
+row with `result = true` when the server accepts the request.
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `resource_type` | yes | One of the resource types listed above. |
+| `access` | yes | Access name such as `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, or `ALL`. The server defines the supported access names, except for the policy-specific values below. |
+| `principal` | yes | Principal identifier, for example `user:alice` or `role:analyst`. |
+| `database` | conditional | Required for database-, table-, function-, view-, and policy-scoped resources. |
+| `table` | conditional | Required for `TABLE`, `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING`. |
+| `function` | conditional | Required only for `FUNCTION`. |
+| `view` | conditional | Required only for `VIEW`. |
+| `column_names` | conditional | Non-empty `array<string>` of included columns for `COLUMN`. Mutually exclusive with `excluded_column_names`. |
+| `excluded_column_names` | conditional | Non-empty `array<string>` granting all columns except the listed columns for `COLUMN`. |
+| `row_filter` | conditional | Required only for `ROW_FILTER`; `access` must also be `ROW_FILTER`. |
+| `column_masking` | conditional | Non-empty `map<string, string>` from column name to masking expression for `COLUMN_MASKING`; `access` must also be `COLUMN_MASKING`. |
+| `expire_time` | no | ISO-8601 UTC expiration time. It is not supported for `ROW_FILTER` or `COLUMN_MASKING`. |
+
+Grant catalog, database, table, function, and view permissions by selecting the matching locator:
+
+```sql
+-- SELECT on all resources below the catalog.
+CALL paimon.sys.grant_permission(
+  resource_type => 'CATALOG_ALL',
+  access => 'SELECT',
+  principal => 'role:analyst'
+);
+
+-- ALL access on one database until the specified time.
+CALL paimon.sys.grant_permission(
+  resource_type => 'DATABASE',
+  access => 'ALL',
+  principal => 'role:data_engineer',
+  database => 'sales',
+  expire_time => '2027-01-01T00:00:00Z'
+);
+
+-- SELECT on one table.
+CALL paimon.sys.grant_permission(
+  resource_type => 'TABLE',
+  access => 'SELECT',
+  principal => 'user:alice',
+  database => 'sales',
+  table => 'orders'
+);
+
+-- ALL access on one function.
+CALL paimon.sys.grant_permission(
+  resource_type => 'FUNCTION',
+  access => 'ALL',
+  principal => 'role:analyst',
+  database => 'sales',
+  function => 'calculate_tax'
+);
+
+-- SELECT on one view.
+CALL paimon.sys.grant_permission(
+  resource_type => 'VIEW',
+  access => 'SELECT',
+  principal => 'role:analyst',
+  database => 'sales',
+  view => 'daily_orders'
+);
+```
+
+A `COLUMN` grant must use `SELECT` access and specify exactly one of `column_names` and
+`excluded_column_names`:
 
 ```sql
+-- Grant access only to the selected columns.
 CALL paimon.sys.grant_permission(
   resource_type => 'COLUMN',
   access => 'SELECT',
@@ -59,16 +151,24 @@ CALL paimon.sys.grant_permission(
   column_names => array('id', 'amount'),
   expire_time => '2027-01-01T00:00:00Z'
 );
-```
 
-`resource_type`, `access`, and `principal` are required. `CATALOG_ALL` and `DATABASE_ALL` represent
-permissions inherited by descendant resources. `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` are
-independent table-scoped permissions. Exactly one of `column_names` and `excluded_column_names` may
-be set for `COLUMN`.
+-- Grant access to every column except sensitive columns.
+CALL paimon.sys.grant_permission(
+  resource_type => 'COLUMN',
+  access => 'SELECT',
+  principal => 'role:support',
+  database => 'sales',
+  table => 'customers',
+  excluded_column_names => array('id_card_number', 'phone_number')
+);
+```
 
-Grant a row filter separately. The server compiles the expression into its predicate representation:
+Grant row filtering and column masking as independent table-scoped permissions. The REST server
+interprets each expression and may return its compiled predicate or transform when the grant is
+listed. Policy grants do not accept `expire_time`.
 
 ```sql
+-- Restrict visible rows.
 CALL paimon.sys.grant_permission(
   resource_type => 'ROW_FILTER',
   access => 'ROW_FILTER',
@@ -77,27 +177,106 @@ CALL paimon.sys.grant_permission(
   table => 'orders',
   row_filter => 'region = ''cn'''
 );
+
+-- Apply a different masking expression to each named column.
+CALL paimon.sys.grant_permission(
+  resource_type => 'COLUMN_MASKING',
+  access => 'COLUMN_MASKING',
+  principal => 'role:support',
+  database => 'sales',
+  table => 'customers',
+  column_masking => map(
+    'email', 'UPPER(email)',
+    'phone_number', 'NULL'
+  )
+);
 ```
 
-List grants using any combination of exact-match filters:
+### List permissions
+
+`list_permissions` returns explicitly granted permissions and supports exact-match resource and
+principal filters. `resource_type` is required. `database` is required whenever `table`,
+`function`, or `view` is specified.
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `resource_type` | yes | Resource type to list. The related-type expansion described below also applies. |
+| `database` | no | Exact database filter. |
+| `table` | no | Exact table filter; requires `database`. |
+| `function` | no | Exact function filter; requires `database`. |
+| `view` | no | Exact view filter; requires `database`. |
+| `principal` | no | Exact principal filter. |
+| `max_results` | no | Positive maximum number of results requested from the server. |
+| `page_token` | no | Opaque token returned by a previous call. |
+
+For example, list all grants that affect a table for a principal:
 
 ```sql
 CALL paimon.sys.list_permissions(
   resource_type => 'TABLE',
-  principal => 'role:analyst',
-  max_results => 100,
-  page_token => '<opaque token from a previous result>'
+  database => 'sales',
+  table => 'orders',
+  principal => 'role:analyst'
 );
 ```
 
 Listing `CATALOG` also includes `CATALOG_ALL`, listing `DATABASE` includes `DATABASE_ALL`, and
-listing `TABLE` includes `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` rows. The result mirrors the
-flat permission payload with separate JSON columns for columns, row filters, and column masking.
-The next-page token is repeated on each row and is null when no further page exists.
+listing `TABLE` includes `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` rows. This makes a table query
+useful for inspecting both ordinary access and policies affecting that table.
+
+Use `max_results` and the returned `next_page_token` to page through a larger result. The token is
+server-defined and must be passed back unchanged:
+
+```sql
+-- First page.
+CALL paimon.sys.list_permissions(
+  resource_type => 'CATALOG',
+  max_results => 100
+);
 
-Revoke by stable permission identity. Constraints and expiration are deliberately omitted:
+-- Next page. Copy the token from the first page.
+CALL paimon.sys.list_permissions(
+  resource_type => 'CATALOG',
+  max_results => 100,
+  page_token => '<opaque next_page_token>'
+);
+```
+
+The procedure returns the following columns:
+
+| Column | Description |
+| --- | --- |
+| `resource_type` | Actual resource type of the grant. |
+| `catalog` | Catalog carried in the returned permission payload, if provided by the server. |
+| `database` | Database locator. |
+| `table` | Table locator. |
+| `function` | Function locator. |
+| `view` | View locator. |
+| `columns_json` | Included or excluded column selection as JSON. |
+| `row_filter_json` | Row-filter expression and optional compiled predicate as JSON. |
+| `column_masking_json` | Column-to-mask mapping as JSON. |
+| `access` | Granted access. |
+| `principal` | Granted principal. |
+| `expire_time` | Grant expiration time, if any. |
+| `next_page_token` | Token for the next page. It is repeated on every row and is null on the final page. |
+
+### Revoke permissions
+
+`revoke_permission` identifies a grant by `resource_type`, its resource locator, `access`, and
+`principal`. Column selection, row-filter, column-masking, and expiration payloads are deliberately
+omitted. It returns one row with `result = true` when the server accepts the request.
 
 ```sql
+-- Revoke a table permission.
+CALL paimon.sys.revoke_permission(
+  resource_type => 'TABLE',
+  access => 'SELECT',
+  principal => 'user:alice',
+  database => 'sales',
+  table => 'orders'
+);
+
+-- Revoke a column permission, regardless of its included or excluded columns.
 CALL paimon.sys.revoke_permission(
   resource_type => 'COLUMN',
   access => 'SELECT',
@@ -105,11 +284,20 @@ CALL paimon.sys.revoke_permission(
   database => 'sales',
   table => 'orders'
 );
+
+-- Revoke a function permission.
+CALL paimon.sys.revoke_permission(
+  resource_type => 'FUNCTION',
+  access => 'ALL',
+  principal => 'role:analyst',
+  database => 'sales',
+  function => 'calculate_tax'
+);
 ```
 
-Grant uses upsert behavior. Revoke identifies a permission by resource type, resource, access, and
-principal; row-filter, column-masking, column-selection, and expiration payloads are not part of
-that identity. Revoking a permission which does not exist may return HTTP 404.
+Revoking a permission which does not exist may return HTTP 404. Resource arguments are validated
+before a request is sent: conflicting locators are rejected, table-level resources require both
+`database` and `table`, and function and view resources require their matching locator.
 
 ## OpenAPI contract
 

From 8392062c9fe2b2d38cb3f22c0b1e88b8dfddd9fa Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 17:37:44 +0800
Subject: [PATCH 04/12] [api][spark] Add REST permission and data policy
 management

---
 docs/docs/concepts/rest/management-api.md     | 519 +++++----
 docs/scripts/validate-rest-openapi.js         | 287 +++--
 docs/static/rest-management-open-api.yaml     | 826 +++++++++++----
 .../apache/paimon/management/ColumnMask.java  |  76 +-
 .../apache/paimon/management/DataPolicy.java  | 202 ++++
 .../management/ListPermissionsRequest.java    | 119 ++-
 .../management/ListPoliciesRequest.java       | 108 ++
 .../apache/paimon/management/Permission.java  | 241 -----
 .../paimon/management/PermissionAccess.java   | 152 +++
 .../management/PermissionAssignment.java      | 154 +++
 .../paimon/management/PermissionIdentity.java |  90 ++
 .../management/PermissionManagement.java      |   8 +-
 .../paimon/management/PermissionResource.java | 205 ++++
 .../paimon/management/PermissionScope.java    |  37 +
 .../paimon/management/PolicyArgument.java     |  90 ++
 .../paimon/management/PolicyIdentity.java     |  51 +
 .../paimon/management/PolicyManagement.java   |  37 +
 .../apache/paimon/management/PolicyType.java  |  37 +
 .../paimon/management/PrincipalRef.java       |  90 ++
 .../paimon/management/PrincipalType.java      |  39 +
 .../paimon/management/ResourceType.java       |  10 +-
 .../apache/paimon/management/RowFilter.java   |  64 +-
 .../org/apache/paimon/rest/HttpClient.java    |  14 +
 .../apache/paimon/rest/HttpClientUtils.java   |   5 +
 .../java/org/apache/paimon/rest/RESTApi.java  | 113 +-
 .../paimon/rest/RESTCatalogOptions.java       |   7 -
 .../org/apache/paimon/rest/RESTClient.java    |   3 +
 .../paimon/rest/RESTPermissionManagement.java |  27 +-
 .../paimon/rest/RESTPolicyManagement.java     |  64 ++
 .../org/apache/paimon/rest/ResourcePaths.java |  42 +-
 .../rest/requests/GrantPermissionRequest.java | 153 +--
 .../paimon/rest/requests/PolicyRequest.java   | 141 +++
 .../requests/RevokePermissionRequest.java     | 141 +--
 .../paimon/rest/responses/ErrorResponse.java  |   2 +
 .../rest/responses/GetPolicyResponse.java     |  48 +
 .../responses/ListPermissionsResponse.java    |  14 +-
 .../responses/ListPoliciesResponse.java}      |  57 +-
 .../PermissionManagementJsonTest.java         | 397 +++++--
 .../rest/RESTPermissionManagementTest.java    | 131 +--
 .../paimon/rest/RESTPolicyManagementTest.java | 223 ++++
 .../RequestJacksonCompatibilityTest.java      |   1 +
 .../org/apache/paimon/rest/RESTCatalog.java   |  11 +-
 .../org/apache/paimon/rest/PolicyKey.java     |  50 +
 .../apache/paimon/rest/RESTCatalogServer.java | 987 +++++++++++++++---
 .../paimon/rest/RESTPermissionStore.java      | 155 +++
 .../paimon/rest/RESTPermissionStoreTest.java  | 111 ++
 .../apache/paimon/rest/ResourcePathsTest.java |  29 +
 .../paimon/rest/TableLifecycleLocks.java      |  38 +
 .../apache/paimon/spark/SparkProcedures.java  |   8 +
 .../procedure/BasePermissionProcedure.java    | 260 +----
 .../spark/procedure/BasePolicyProcedure.java  | 162 +++
 .../CreateOrReplacePolicyBaseProcedure.java   |  89 ++
 .../CreateOrReplacePolicyProcedure.java       |  50 +
 .../procedure/CreatePolicyProcedure.java      |  50 +
 .../spark/procedure/DropPolicyProcedure.java  |  85 ++
 .../procedure/GrantPermissionProcedure.java   |  36 +-
 .../procedure/ListPermissionsProcedure.java   |  70 +-
 .../procedure/ListPoliciesProcedure.java      | 163 +++
 .../procedure/RevokePermissionProcedure.java  |  21 +-
 .../PaimonSparkTestWithRestCatalogBase.scala  |  18 +-
 .../procedure/PermissionProcedureTest.scala   | 495 ++++++++-
 61 files changed, 6198 insertions(+), 1715 deletions(-)
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/Permission.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyType.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
 rename paimon-api/src/main/java/org/apache/paimon/{management/ColumnSelection.java => rest/responses/ListPoliciesResponse.java} (55%)
 create mode 100644 paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/TableLifecycleLocks.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
 create mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index 56aed6396565..e84734f85e9f 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -20,287 +20,442 @@ See the License for the specific language governing permissions and
 limitations under the License.
 -->
 
-The OpenAPI 3.1 document below defines the language-neutral control-plane contract for listing,
-granting, and revoking permissions on Paimon catalog resources.
+The REST Management API is an experimental OpenAPI 3.1 control-plane extension for object
+privileges, row filters, and column masks in a Paimon REST Catalog. Its current contract version is
+`0.3.0` and may evolve incompatibly while the design is being validated.
 
-The permission payload uses a flat resource-oriented model. User and role lifecycle,
-authentication, policy persistence, and authorization decisions remain responsibilities of the
-REST Catalog server implementation.
+`RESTCatalog` exposes `permissionManagement()` and `policyManagement()` directly. These methods are
+intentionally not part of the generic `Catalog` interface. A non-REST catalog therefore reports an
+unsupported-operation error when a management procedure is called.
 
-## Client configuration
+## Catalog addressing
 
-Permission management is provided directly by `RESTCatalog`; it is not part of the generic
-`Catalog` interface. Configure the remote catalog identifier used in the management endpoint with
-`management.catalog`. The value identifies the `{catalog}` path parameter and is independent of an
-engine's local catalog alias.
+All management endpoints use the opaque `prefix` returned by the REST Catalog config endpoint. It
+is not a catalog name in a payload and is independent of the local engine alias such as `paimon` in
+`CALL paimon.sys...`.
 
-For Spark, this can be supplied by the REST server's config response or configured directly:
-
-```properties
-spark.sql.catalog.paimon.management.catalog=my_remote_catalog
 ```
+GET  /v1/{prefix}/permissions
+POST /v1/{prefix}/permissions/grant
+POST /v1/{prefix}/permissions/revoke
+
+GET    /v1/{prefix}/databases/{database}/tables/{table}/policies
+POST   /v1/{prefix}/databases/{database}/tables/{table}/policies
+GET    /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
+PUT    /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
+DELETE /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
+```
+
+Policies are currently attached only to tables. The path is the attachment identity, so policy
+request bodies do not repeat a catalog, database, table, resource type, or scope. Catalog- and
+database-level matching can be added later with explicit matching semantics instead of implied
+path inheritance.
+
+The complete wire contract is available in
+[`rest-management-open-api.yaml`](/rest-management-open-api.yaml).
+
+## Privileges and policies are independent
 
-Non-REST catalog implementations fail these operations with an explicit unsupported error.
+A permission grants one access on one resource to one principal. A data policy restricts rows or
+columns visible through an already-authorized read. Creating a policy never grants `SELECT`, and
+revoking `SELECT` does not delete policies.
 
-## Spark SQL
+This separation also defines the expected query path:
 
-Spark exposes the management contract through procedures. Custom `GRANT` and `REVOKE` grammar is
-not required, so the SQL layer remains a thin adapter over the same Java and REST contracts.
+1. The server evaluates object privileges.
+2. The server resolves all row-filter and column-masking policies applicable to the caller.
+3. The existing REST Catalog table authorization endpoint returns the compiled Paimon predicate
+   and column transforms to the engine.
+4. The engine applies those restrictions when planning the scan.
 
-The examples below assume that the Spark catalog is named `paimon`. Replace it with the local
-catalog name from `spark.sql.catalog.<catalog-name>`. Procedure arguments are named so optional
-resource fields can be omitted. `resource_type` and `access` are case-insensitive and are sent to
-the server in upper case; `principal` is an opaque, non-empty identifier understood by the server.
+Management payloads store function references and arguments, not executable SQL text or compiled
+Paimon expressions. Function lookup, signature checking, policy conflict detection, and expression
+compilation are server responsibilities.
 
-### Resource types
+## Permission model
 
-The resource type determines which locator arguments are required and which arguments must be
-omitted.
+Permission resources are structured objects:
 
-| Resource type | Required locator | Meaning |
+| Resource type | Required locator | Example |
 | --- | --- | --- |
-| `CATALOG` | none | A permission on the catalog itself. |
-| `CATALOG_ALL` | none | A catalog permission inherited by descendant resources. |
-| `DATABASE` | `database` | A permission on one database. |
-| `DATABASE_ALL` | `database` | A database permission inherited by descendant resources. |
-| `TABLE` | `database`, `table` | A permission on one table. |
-| `FUNCTION` | `database`, `function` | A permission on one function. |
-| `VIEW` | `database`, `view` | A permission on one view. |
-| `COLUMN` | `database`, `table` | A `SELECT` permission on selected table columns. |
-| `ROW_FILTER` | `database`, `table` | A row-filter policy granted separately from table access. |
-| `COLUMN_MASKING` | `database`, `table` | Column-masking policies granted separately from table access. |
+| `CATALOG` | none | `{"type":"CATALOG"}` |
+| `DATABASE` | `database` | `{"type":"DATABASE","database":"sales"}` |
+| `TABLE` | `database`, `table` | `{"type":"TABLE","database":"sales","table":"orders"}` |
+| `FUNCTION` | `database`, `function` | `{"type":"FUNCTION","database":"sales","function":"calculate_tax"}` |
+| `VIEW` | `database`, `view` | `{"type":"VIEW","database":"sales","view":"daily_orders"}` |
 
-### Grant permissions
+`SELF` applies only to the referenced resource and is the default. `DESCENDANTS` applies below a
+`CATALOG` or `DATABASE`; it is invalid on `TABLE`, `FUNCTION`, and `VIEW` resources.
+
+Principals are `{type, id}` pairs. Supported types are `USER`, `GROUP`, `ROLE`, and `SERVICE`.
+Principal ids are opaque stable identifiers in the server namespace.
+
+Built-in accesses are resource-specific:
+
+| Resource | `SELF` accesses |
+| --- | --- |
+| `CATALOG` | `USE_CATALOG`, `CREATE_DATABASE`, `MANAGE_PERMISSIONS` |
+| `DATABASE` | `USE_DATABASE`, `CREATE_TABLE`, `CREATE_VIEW`, `CREATE_FUNCTION`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
+| `TABLE` | `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
+| `VIEW` | `SELECT`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
+| `FUNCTION` | `EXECUTE`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
 
-`grant_permission` creates or replaces a grant with the same permission identity and returns one
-row with `result = true` when the server accepts the request.
+Inputs are case-insensitive and responses use upper case. Implementations may add namespaced
+accesses such as `vendor.example/SOME_ACCESS`; unknown unnamespaced accesses are rejected.
 
-| Argument | Required | Description |
+An assignment identity is `resource`, `scope`, `access`, and `principal`. Granting the same identity
+replaces its expiry. Revocation is idempotent. `includeInherited` only expands resource ancestry;
+resolving group membership and role inheritance remains a server responsibility.
+
+## Data policy model
+
+A data policy is a named entity attached directly to one table. Its principal selectors use
+`TO` and `EXCEPT` semantics: it applies when the caller matches at least one `toPrincipals`
+entry and no `exceptPrincipals` entry. `EXCEPT` wins when both match.
+
+Each policy contains exactly one typed definition:
+
+| Definition | Required fields | Result |
 | --- | --- | --- |
-| `resource_type` | yes | One of the resource types listed above. |
-| `access` | yes | Access name such as `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, or `ALL`. The server defines the supported access names, except for the policy-specific values below. |
-| `principal` | yes | Principal identifier, for example `user:alice` or `role:analyst`. |
-| `database` | conditional | Required for database-, table-, function-, view-, and policy-scoped resources. |
-| `table` | conditional | Required for `TABLE`, `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING`. |
-| `function` | conditional | Required only for `FUNCTION`. |
-| `view` | conditional | Required only for `VIEW`. |
-| `column_names` | conditional | Non-empty `array<string>` of included columns for `COLUMN`. Mutually exclusive with `excluded_column_names`. |
-| `excluded_column_names` | conditional | Non-empty `array<string>` granting all columns except the listed columns for `COLUMN`. |
-| `row_filter` | conditional | Required only for `ROW_FILTER`; `access` must also be `ROW_FILTER`. |
-| `column_masking` | conditional | Non-empty `map<string, string>` from column name to masking expression for `COLUMN_MASKING`; `access` must also be `COLUMN_MASKING`. |
-| `expire_time` | no | ISO-8601 UTC expiration time. It is not supported for `ROW_FILTER` or `COLUMN_MASKING`. |
-
-Grant catalog, database, table, function, and view permissions by selecting the matching locator:
+| `rowFilter` | `functionName`, ordered `functionArguments` | A boolean predicate applied to every scan. |
+| `columnMask` | `functionName`, `onColumn`, ordered `functionArguments` | A value compatible with the protected column. |
+
+The common fields are `name`, non-empty `toPrincipals`, optional `exceptPrincipals`, and an
+optional `comment`. A function argument is exactly one of `{"column":"region"}` or
+`{"constant":"APAC"}`. Constants are strings and may be empty; column names may not be empty.
+
+For a row filter, the arguments are passed positionally and the function must return boolean. For a
+column mask, `onColumn` is the protected input and `functionArguments` contains additional
+positional arguments. The REST server resolves the named function and compiles it into the existing
+Paimon predicate or column transform returned by table query authorization.
+
+Policy create and create-or-replace must be rejected unless all of these conditions hold:
+
+1. The target database and table exist.
+2. The table has `query-auth.enabled=true`; otherwise a stored policy could be silently bypassed.
+3. Every `TO` and `EXCEPT` principal exists.
+4. The policy function exists, has a compatible signature, and can be compiled by the server.
+5. `onColumn` and every column argument exist in the target table.
+
+These invariants continue to apply for the whole table lifecycle. Servers must bind policies to a
+stable table identity, preserve that binding across table renames, and remove the policies when the
+table is dropped. A table with policies must reject changes that disable `query-auth.enabled` or
+remove or rename a protected or argument column, unless the policy update and schema change are
+performed atomically.
+
+At authorization time, an unresolved function, invalid signature, or ambiguous set of masks must
+fail closed rather than omit a restriction. Multiple row filters may be combined with `AND`.
+Servers must define deterministic conflict handling when more than one mask targets the same column.
+
+This experimental contract deliberately does not define governed tags, catalog/database policy
+inheritance, or tag-driven matching. Those features need explicit match conditions and conflict
+rules before being added.
+
+## Spark SQL procedures
+
+The following examples assume a Spark catalog named `paimon`. Replace it with the catalog name in
+`spark.sql.catalog.<catalog-name>`.
+
+### Grant permissions
+
+`grant_permission` returns one row with `result = true` when the server accepts the assignment.
+
+Grant catalog access or a privilege inherited by catalog descendants:
 
 ```sql
--- SELECT on all resources below the catalog.
 CALL paimon.sys.grant_permission(
-  resource_type => 'CATALOG_ALL',
+  resource_type => 'CATALOG',
+  access => 'USE_CATALOG',
+  principal_type => 'ROLE',
+  principal => 'catalog_user'
+);
+
+CALL paimon.sys.grant_permission(
+  resource_type => 'CATALOG',
+  scope => 'DESCENDANTS',
   access => 'SELECT',
-  principal => 'role:analyst'
+  principal_type => 'GROUP',
+  principal => 'analysts'
 );
+```
 
--- ALL access on one database until the specified time.
+Grant database privileges on the database itself or all objects below it:
+
+```sql
 CALL paimon.sys.grant_permission(
   resource_type => 'DATABASE',
-  access => 'ALL',
-  principal => 'role:data_engineer',
   database => 'sales',
+  access => 'CREATE_TABLE',
+  principal_type => 'ROLE',
+  principal => 'data_engineer'
+);
+
+CALL paimon.sys.grant_permission(
+  resource_type => 'DATABASE',
+  database => 'sales',
+  scope => 'DESCENDANTS',
+  access => 'SELECT',
+  principal_type => 'ROLE',
+  principal => 'sales_reader',
   expire_time => '2027-01-01T00:00:00Z'
 );
+```
 
--- SELECT on one table.
+Grant table, function, and view access with the matching locator:
+
+```sql
 CALL paimon.sys.grant_permission(
   resource_type => 'TABLE',
-  access => 'SELECT',
-  principal => 'user:alice',
   database => 'sales',
-  table => 'orders'
+  table => 'orders',
+  access => 'SELECT',
+  principal_type => 'USER',
+  principal => 'alice'
 );
 
--- ALL access on one function.
 CALL paimon.sys.grant_permission(
   resource_type => 'FUNCTION',
-  access => 'ALL',
-  principal => 'role:analyst',
   database => 'sales',
-  function => 'calculate_tax'
+  function => 'calculate_tax',
+  access => 'EXECUTE',
+  principal_type => 'ROLE',
+  principal => 'analyst'
 );
 
--- SELECT on one view.
 CALL paimon.sys.grant_permission(
   resource_type => 'VIEW',
+  database => 'sales',
+  view => 'daily_orders',
   access => 'SELECT',
-  principal => 'role:analyst',
+  principal_type => 'SERVICE',
+  principal => 'reporting_job'
+);
+```
+
+### List permissions
+
+`list_permissions` always addresses one exact resource. Omit optional filters to list every direct
+assignment on it:
+
+```sql
+CALL paimon.sys.list_permissions(
+  resource_type => 'TABLE',
   database => 'sales',
-  view => 'daily_orders'
+  table => 'orders'
 );
 ```
 
-A `COLUMN` grant must use `SELECT` access and specify exactly one of `column_names` and
-`excluded_column_names`:
+Filter by principal, scope, or access:
 
 ```sql
--- Grant access only to the selected columns.
-CALL paimon.sys.grant_permission(
-  resource_type => 'COLUMN',
-  access => 'SELECT',
-  principal => 'role:analyst',
+CALL paimon.sys.list_permissions(
+  resource_type => 'TABLE',
   database => 'sales',
   table => 'orders',
-  column_names => array('id', 'amount'),
-  expire_time => '2027-01-01T00:00:00Z'
+  principal_type => 'ROLE',
+  principal => 'analyst',
+  access => 'SELECT'
 );
+```
 
--- Grant access to every column except sensitive columns.
-CALL paimon.sys.grant_permission(
-  resource_type => 'COLUMN',
-  access => 'SELECT',
-  principal => 'role:support',
+Include catalog and database descendant assignments effective on a table:
+
+```sql
+CALL paimon.sys.list_permissions(
+  resource_type => 'TABLE',
   database => 'sales',
-  table => 'customers',
-  excluded_column_names => array('id_card_number', 'phone_number')
+  table => 'orders',
+  include_inherited => true
 );
 ```
 
-Grant row filtering and column masking as independent table-scoped permissions. The REST server
-interprets each expression and may return its compiled predicate or transform when the grant is
-listed. Policy grants do not accept `expire_time`.
+The `inherited_from_json` output identifies the direct assignment source. `next_page_token` is
+opaque; pass it back unchanged with the same filters:
 
 ```sql
--- Restrict visible rows.
-CALL paimon.sys.grant_permission(
-  resource_type => 'ROW_FILTER',
-  access => 'ROW_FILTER',
-  principal => 'role:analyst',
+CALL paimon.sys.list_permissions(
+  resource_type => 'TABLE',
   database => 'sales',
   table => 'orders',
-  row_filter => 'region = ''cn'''
+  max_results => 50,
+  page_token => 'opaque-token-from-previous-row'
 );
+```
 
--- Apply a different masking expression to each named column.
-CALL paimon.sys.grant_permission(
-  resource_type => 'COLUMN_MASKING',
-  access => 'COLUMN_MASKING',
-  principal => 'role:support',
+### Revoke permissions
+
+Supply the same four identity fields used by the grant. `expire_time` is not part of identity.
+
+```sql
+CALL paimon.sys.revoke_permission(
+  resource_type => 'DATABASE',
   database => 'sales',
-  table => 'customers',
-  column_masking => map(
-    'email', 'UPPER(email)',
-    'phone_number', 'NULL'
-  )
+  scope => 'DESCENDANTS',
+  access => 'SELECT',
+  principal_type => 'ROLE',
+  principal => 'sales_reader'
 );
 ```
 
-### List permissions
+Repeating the same call succeeds even when the assignment is already absent.
 
-`list_permissions` returns explicitly granted permissions and supports exact-match resource and
-principal filters. `resource_type` is required. `database` is required whenever `table`,
-`function`, or `view` is specified.
+### Create row-filter policies
 
-| Argument | Required | Description |
-| --- | --- | --- |
-| `resource_type` | yes | Resource type to list. The related-type expansion described below also applies. |
-| `database` | no | Exact database filter. |
-| `table` | no | Exact table filter; requires `database`. |
-| `function` | no | Exact function filter; requires `database`. |
-| `view` | no | Exact view filter; requires `database`. |
-| `principal` | no | Exact principal filter. |
-| `max_results` | no | Positive maximum number of results requested from the server. |
-| `page_token` | no | Opaque token returned by a previous call. |
+Before attaching any policy, enable table query authorization:
+
+```sql
+ALTER TABLE paimon.sales.orders
+SET TBLPROPERTIES ('query-auth.enabled' = 'true');
+```
+
+`create_policy` accepts principal selectors as `array<string>` entries encoded as `TYPE:id`.
+Function arguments use `column:value` or `constant:value`. Only the first colon is a delimiter, so
+a principal id or constant may contain later colons. `constant:` represents a valid empty string.
 
-For example, list all grants that affect a table for a principal:
+This example asks the server to resolve
+`security.filter_region(region, 'APAC')` as a boolean predicate:
 
 ```sql
-CALL paimon.sys.list_permissions(
-  resource_type => 'TABLE',
+CALL paimon.sys.create_policy(
   database => 'sales',
   table => 'orders',
-  principal => 'role:analyst'
+  name => 'orders_region_filter',
+  policy_type => 'ROW_FILTER',
+  function_name => 'security.filter_region',
+  function_arguments => array('column:region', 'constant:APAC'),
+  to_principals => array('GROUP:analysts', 'ROLE:reporting'),
+  except_principals => array('USER:alice'),
+  comment => 'Restrict regional order visibility'
 );
 ```
 
-Listing `CATALOG` also includes `CATALOG_ALL`, listing `DATABASE` includes `DATABASE_ALL`, and
-listing `TABLE` includes `COLUMN`, `ROW_FILTER`, and `COLUMN_MASKING` rows. This makes a table query
-useful for inspecting both ordinary access and policies affecting that table.
+The call fails if the name already exists. Use `create_or_replace_policy` when upsert semantics are
+intended.
+
+### Create column-masking policies
 
-Use `max_results` and the returned `next_page_token` to page through a larger result. The token is
-server-defined and must be passed back unchanged:
+For column masking, `on_column` identifies the protected column. Additional columns or constants
+can be supplied positionally:
 
 ```sql
--- First page.
-CALL paimon.sys.list_permissions(
-  resource_type => 'CATALOG',
-  max_results => 100
+CALL paimon.sys.create_policy(
+  database => 'sales',
+  table => 'customers',
+  name => 'mask_phone_by_region',
+  policy_type => 'COLUMN_MASKING',
+  function_name => 'security.mask_phone',
+  on_column => 'phone_number',
+  function_arguments => array('column:region', 'constant:partial'),
+  to_principals => array('ROLE:support'),
+  except_principals => array('ROLE:privacy_admin')
 );
+```
 
--- Next page. Copy the token from the first page.
-CALL paimon.sys.list_permissions(
-  resource_type => 'CATALOG',
-  max_results => 100,
-  page_token => '<opaque next_page_token>'
+A mask with no additional arguments may omit `function_arguments`. An empty-string argument is
+written explicitly:
+
+```sql
+CALL paimon.sys.create_policy(
+  database => 'sales',
+  table => 'customers',
+  name => 'mask_email',
+  policy_type => 'COLUMN_MASKING',
+  function_name => 'security.mask_email',
+  on_column => 'email',
+  function_arguments => array('constant:'),
+  to_principals => array('GROUP:support')
 );
 ```
 
-The procedure returns the following columns:
+`on_column` is required for `COLUMN_MASKING` and rejected for `ROW_FILTER`.
 
-| Column | Description |
-| --- | --- |
-| `resource_type` | Actual resource type of the grant. |
-| `catalog` | Catalog carried in the returned permission payload, if provided by the server. |
-| `database` | Database locator. |
-| `table` | Table locator. |
-| `function` | Function locator. |
-| `view` | View locator. |
-| `columns_json` | Included or excluded column selection as JSON. |
-| `row_filter_json` | Row-filter expression and optional compiled predicate as JSON. |
-| `column_masking_json` | Column-to-mask mapping as JSON. |
-| `access` | Granted access. |
-| `principal` | Granted principal. |
-| `expire_time` | Grant expiration time, if any. |
-| `next_page_token` | Token for the next page. It is repeated on every row and is null on the final page. |
+### Create or fully replace a policy
 
-### Revoke permissions
+`create_or_replace_policy` maps to HTTP `PUT`. It creates an absent policy or fully replaces an
+existing policy with the same table and name; omitted optional values are cleared.
 
-`revoke_permission` identifies a grant by `resource_type`, its resource locator, `access`, and
-`principal`. Column selection, row-filter, column-masking, and expiration payloads are deliberately
-omitted. It returns one row with `result = true` when the server accepts the request.
+```sql
+CALL paimon.sys.create_or_replace_policy(
+  database => 'sales',
+  table => 'orders',
+  name => 'orders_region_filter',
+  policy_type => 'ROW_FILTER',
+  function_name => 'security.filter_region_v2',
+  function_arguments => array('column:region'),
+  to_principals => array('GROUP:analysts'),
+  comment => 'Use the second version of the filter'
+);
+```
+
+This is deliberately separate from `create_policy`: callers must opt in to replacement instead of
+passing a generic `replace` flag.
+
+### List policies
+
+List every policy directly attached to one table:
 
 ```sql
--- Revoke a table permission.
-CALL paimon.sys.revoke_permission(
-  resource_type => 'TABLE',
-  access => 'SELECT',
-  principal => 'user:alice',
+CALL paimon.sys.list_policies(
   database => 'sales',
   table => 'orders'
 );
+```
 
--- Revoke a column permission, regardless of its included or excluded columns.
-CALL paimon.sys.revoke_permission(
-  resource_type => 'COLUMN',
-  access => 'SELECT',
-  principal => 'role:analyst',
+Filter by name, policy type, or principal. `principal_type` and `principal` must be supplied
+together:
+
+```sql
+CALL paimon.sys.list_policies(
   database => 'sales',
-  table => 'orders'
+  table => 'orders',
+  policy_type => 'ROW_FILTER',
+  principal_type => 'GROUP',
+  principal => 'analysts'
 );
+```
 
--- Revoke a function permission.
-CALL paimon.sys.revoke_permission(
-  resource_type => 'FUNCTION',
-  access => 'ALL',
-  principal => 'role:analyst',
+The output columns are `database`, `table`, `name`, `policy_type`, `function_name`,
+`on_column`, `function_arguments_json`, `to_principals_json`, `except_principals_json`,
+`comment`, and `next_page_token`. Pass an opaque continuation token back unchanged with the same
+filters:
+
+```sql
+CALL paimon.sys.list_policies(
+  database => 'sales',
+  table => 'orders',
+  max_results => 50,
+  page_token => 'opaque-token-from-previous-row'
+);
+```
+
+Management listing follows the existing Paimon pagination contract: an empty page terminates
+pagination and therefore has no continuation token. Each Spark procedure returns exactly the page
+selected by `page_token`; pass a non-null `next_page_token` back unchanged to retrieve the next page.
+
+### Drop policies
+
+Drop an existing policy:
+
+```sql
+CALL paimon.sys.drop_policy(
   database => 'sales',
-  function => 'calculate_tax'
+  table => 'orders',
+  name => 'orders_region_filter'
 );
 ```
 
-Revoking a permission which does not exist may return HTTP 404. Resource arguments are validated
-before a request is sent: conflicting locators are rejected, table-level resources require both
-`database` and `table`, and function and view resources require their matching locator.
+By default an absent policy is an error. Set `if_exists => true` for an idempotent operation:
 
-## OpenAPI contract
+```sql
+CALL paimon.sys.drop_policy(
+  database => 'sales',
+  table => 'orders',
+  name => 'orders_region_filter',
+  if_exists => true
+);
+```
 
-<body>
-    <iframe src="/docs/master/rest-management-open-api.yaml" width="100%" height="800px" />
-</body>
+Creating, replacing, dropping, or inspecting permissions and policies requires the server to
+authorize the caller for `MANAGE_PERMISSIONS` on the relevant resource. Authentication, principal
+membership, policy persistence, function resolution, and audit logging remain REST server
+concerns.
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index 2dabbce60812..fd60dc12d2b4 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -115,7 +115,9 @@ function validateCommon(fileName) {
 
   function validatePathParameters(resourcePath, pathItem, operation) {
     const templateNames = Array.from(resourcePath.matchAll(/\{([^}]+)\}/g), (match) => match[1]);
-    const parameters = [...(pathItem.parameters || []), ...(operation.parameters || [])];
+    const parameters = [...(pathItem.parameters || []), ...(operation.parameters || [])].map(
+      (parameter) => (parameter.$ref ? resolveLocalRef(parameter.$ref) : parameter),
+    );
     const pathParameters = parameters.filter((parameter) => parameter.in === 'path');
     templateNames.forEach((name) => {
       const parameter = pathParameters.find((candidate) => candidate.name === name);
@@ -304,128 +306,261 @@ function validateCatalogOpenApi() {
 
 function validateManagementOpenApi() {
   const contract = validateCommon('rest-management-open-api.yaml');
-  const operationIds = ['listPermissions', 'grantPermission', 'revokePermission'];
+  const operationIds = [
+    'listPermissions',
+    'grantPermission',
+    'revokePermission',
+    'listTablePolicies',
+    'createTablePolicy',
+    'getTablePolicy',
+    'createOrReplaceTablePolicy',
+    'dropTablePolicy',
+  ];
+  const resourcePaths = [
+    '/v1/{prefix}/permissions',
+    '/v1/{prefix}/permissions/grant',
+    '/v1/{prefix}/permissions/revoke',
+    '/v1/{prefix}/databases/{database}/tables/{table}/policies',
+    '/v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}',
+  ];
+
+  resourcePaths.forEach((resourcePath) =>
+    contract.checkSpec(
+      contract.spec.paths[resourcePath],
+      `Missing management path: ${resourcePath}`,
+    ),
+  );
+  [
+    '/v1/{prefix}/policies',
+    '/v1/{prefix}/databases/{database}/policies',
+  ].forEach((resourcePath) =>
+    contract.checkSpec(
+      !contract.spec.paths[resourcePath],
+      `Policies must not be attachable outside tables: ${resourcePath}`,
+    ),
+  );
   operationIds.forEach(contract.requireOperation);
-  operationIds.forEach((operationId) =>
+  ['listPermissions', 'grantPermission', 'revokePermission'].forEach((operationId) =>
+    contract.requireResponses(operationId, ['200', '400', '401', '403', '404', '500']),
+  );
+  ['listTablePolicies', 'createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
     contract.requireResponses(operationId, ['200', '400', '401', '403', '404', '500']),
   );
+  ['getTablePolicy', 'dropTablePolicy'].forEach((operationId) =>
+    contract.requireResponses(operationId, ['200', '401', '403', '404', '500']),
+  );
+  ['createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
+    contract.requireResponses(operationId, ['409']),
+  );
+  contract.checkSpec(
+    contract.spec.info.version === '0.3.0' &&
+      contract.spec.info.description.toLowerCase().includes('experimental'),
+    'The management contract must be versioned 0.3.0 and marked experimental',
+  );
 
-  const permissionFields = [
-    'resourceType',
-    'catalog',
-    'database',
-    'table',
-    'function',
-    'view',
-    'columns',
-    'rowFilter',
-    'columnMasking',
+  const assignmentFields = [
+    'resource',
+    'scope',
     'access',
     'principal',
     'expireTime',
+    'inheritedFrom',
   ];
-  contract.requireProperties('Permission', permissionFields);
-  contract.requireRequiredProperties('Permission', ['resourceType', 'access', 'principal']);
-
-  const grantProperties = contract.requireProperties('GrantPermissionRequest', permissionFields);
+  contract.requireProperties('PermissionAssignment', assignmentFields);
+  contract.requireRequiredProperties('PermissionAssignment', [
+    'resource',
+    'scope',
+    'access',
+    'principal',
+  ]);
+  const grantProperties = contract.requireProperties('GrantPermissionRequest', [
+    'resource',
+    'scope',
+    'access',
+    'principal',
+    'expireTime',
+  ]);
   contract.requireRequiredProperties('GrantPermissionRequest', [
-    'resourceType',
+    'resource',
     'access',
     'principal',
   ]);
   contract.checkSpec(
-    !grantProperties.permission,
-    'Schema GrantPermissionRequest must use the flat permission shape',
+    grantProperties.scope.default === 'SELF',
+    'GrantPermissionRequest.scope must default to SELF',
   );
-
-  const revokeFields = [
-    'resourceType',
-    'catalog',
-    'database',
-    'table',
-    'function',
-    'view',
-    'columns',
+  ['inheritedFrom', 'columns', 'policy', 'grantOption'].forEach((field) =>
+    contract.checkSpec(
+      !grantProperties[field],
+      `Schema GrantPermissionRequest must omit field: ${field}`,
+    ),
+  );
+  const revokeProperties = contract.requireProperties('RevokePermissionRequest', [
+    'resource',
+    'scope',
     'access',
     'principal',
-  ];
-  const revokeProperties = contract.requireProperties('RevokePermissionRequest', revokeFields);
+  ]);
   contract.requireRequiredProperties('RevokePermissionRequest', [
-    'resourceType',
+    'resource',
     'access',
     'principal',
   ]);
-  ['rowFilter', 'columnMasking', 'expireTime'].forEach((field) =>
+  contract.checkSpec(
+    revokeProperties.scope.default === 'SELF',
+    'RevokePermissionRequest.scope must default to SELF',
+  );
+  ['expireTime', 'inheritedFrom', 'columns', 'policy', 'grantOption'].forEach((field) =>
     contract.checkSpec(
       !revokeProperties[field],
-      `Schema RevokePermissionRequest must omit grant-only field: ${field}`,
+      `Schema RevokePermissionRequest must omit field: ${field}`,
     ),
   );
 
-  const listProperties = contract.requireProperties('ListPermissionsResponse', [
+  const permissionList = contract.requireProperties('ListPermissionsResponse', [
     'permissions',
     'nextPageToken',
   ]);
-  contract.requireRequiredProperties('ListPermissionsResponse', ['permissions']);
   contract.checkSpec(
-    listProperties.permissions.type === 'array' &&
-      listProperties.permissions.items.$ref === '#/components/schemas/Permission',
-    'Schema ListPermissionsResponse.permissions must be an array of Permission',
+    permissionList.permissions.type === 'array' &&
+      permissionList.permissions.items.$ref === '#/components/schemas/PermissionAssignment',
+    'ListPermissionsResponse.permissions must contain PermissionAssignment values',
   );
+  contract.requireRequiredProperties('ListPermissionsResponse', ['permissions']);
 
-  const columnSelection = contract.requireProperties('ColumnSelection', [
-    'columnNames',
-    'excludedColumnNames',
+  contract.requireProperties('PrincipalRef', ['type', 'id']);
+  contract.requireRequiredProperties('PrincipalRef', ['type', 'id']);
+  requireExactEnum(contract, 'ResourceType', ['CATALOG', 'DATABASE', 'TABLE', 'FUNCTION', 'VIEW']);
+  requireExactEnum(contract, 'PermissionScope', ['SELF', 'DESCENDANTS']);
+  requireExactEnum(contract, 'PrincipalType', ['USER', 'GROUP', 'ROLE', 'SERVICE']);
+  requireExactEnum(contract, 'PolicyType', ['ROW_FILTER', 'COLUMN_MASKING']);
+
+  contract.requireSchemaReference('PolicyRequest', 'oneOf', 'RowFilterPolicyRequest');
+  contract.requireSchemaReference('PolicyRequest', 'oneOf', 'ColumnMaskPolicyRequest');
+  contract.requireSchemaReference('DataPolicy', 'oneOf', 'RowFilterDataPolicy');
+  contract.requireSchemaReference('DataPolicy', 'oneOf', 'ColumnMaskDataPolicy');
+  contract.requireProperties('RowFilter', ['functionName', 'functionArguments']);
+  contract.requireProperties('ColumnMask', ['functionName', 'onColumn', 'functionArguments']);
+  contract.requireRequiredProperties('RowFilter', ['functionName', 'functionArguments']);
+  contract.requireRequiredProperties('ColumnMask', [
+    'functionName',
+    'onColumn',
+    'functionArguments',
   ]);
+  ['RowFilterPolicyRequest', 'ColumnMaskPolicyRequest'].forEach((schemaName) => {
+    const properties = contract.requireProperties(schemaName, [
+      'name',
+      'toPrincipals',
+      'exceptPrincipals',
+      'comment',
+    ]);
+    ['toPrincipals', 'exceptPrincipals'].forEach((field) =>
+      contract.checkSpec(
+        properties[field].items.$ref === '#/components/schemas/PrincipalRef',
+        `${schemaName}.${field} must contain PrincipalRef values`,
+      ),
+    );
+    contract.checkSpec(
+      !properties.scope && !properties.type && !properties.resource,
+      `${schemaName} must not expose policy scope, type, or path resource`,
+    );
+    contract.checkSpec(
+      !(contract.schema(schemaName).required || []).includes('exceptPrincipals'),
+      `${schemaName}.exceptPrincipals must be optional`,
+    );
+  });
+  contract.requireProperties('RowFilterPolicyRequest', ['rowFilter']);
+  contract.requireProperties('ColumnMaskPolicyRequest', ['columnMask']);
   contract.checkSpec(
-    columnSelection.columnNames.uniqueItems === true &&
-      columnSelection.excludedColumnNames.uniqueItems === true,
-    'Schema ColumnSelection values must be unique',
+    Array.isArray(contract.schema('PolicyArgument').oneOf) &&
+      contract.schema('PolicyArgument').oneOf.length === 2,
+    'PolicyArgument must contain exactly one column or constant',
   );
   contract.checkSpec(
-    Array.isArray(contract.schema('ColumnSelection').oneOf) &&
-      contract.schema('ColumnSelection').oneOf.length === 2,
-    'Schema ColumnSelection must require exactly one selection mode',
+    !contract.schema('ConstantPolicyArgument').properties.constant.minLength,
+    'ConstantPolicyArgument.constant must allow the empty string',
   );
-
-  contract.requireProperties('RowFilter', ['expression', 'predicate']);
-  contract.requireProperties('ColumnMask', ['expression', 'transform']);
+  const tablePolicyResource = contract.requireProperties('TablePolicyResource', [
+    'type',
+    'database',
+    'table',
+  ]);
+  contract.checkSpec(
+    tablePolicyResource.type.const === 'TABLE',
+    'Data policies must use a TABLE attachment resource',
+  );
+  const policyList = contract.requireProperties('ListPoliciesResponse', [
+    'policies',
+    'nextPageToken',
+  ]);
   contract.checkSpec(
-    contract.schema('ExpireTime').type === 'string',
-    'Schema ExpireTime must use the ISO-8601 string representation',
-  );
-
-  requireExactEnum(contract, 'ResourceType', [
-    'CATALOG',
-    'CATALOG_ALL',
-    'DATABASE',
-    'DATABASE_ALL',
-    'TABLE',
-    'FUNCTION',
-    'VIEW',
-    'COLUMN',
-    'ROW_FILTER',
-    'COLUMN_MASKING',
+    policyList.policies.items.$ref === '#/components/schemas/DataPolicy',
+    'ListPoliciesResponse.policies must contain DataPolicy values',
+  );
+  contract.requireProperties('GetPolicyResponse', ['policy']);
+  contract.requireProperties('ErrorResponse', [
+    'message',
+    'resourceType',
+    'resourceName',
+    'code',
   ]);
+  contract.requireRequiredProperties('ErrorResponse', ['message', 'code']);
 
-  const listParameters = contract
+  const permissionParameters = contract
     .requireOperation('listPermissions')
-    .parameters.filter((parameter) => parameter.in === 'query');
-  ['resourceType', 'database', 'table', 'function', 'view', 'principal', 'pageToken', 'maxResults'].forEach(
-    (name) =>
-      contract.checkSpec(
-        listParameters.some((parameter) => parameter.name === name),
-        `Operation listPermissions is missing query parameter: ${name}`,
-      ),
+    .parameters.map((parameter) =>
+      parameter.$ref ? parameter.$ref.split('/').pop() : parameter.name,
+    );
+  [
+    'ResourceTypeQuery',
+    'ScopeQuery',
+    'DatabaseQuery',
+    'TableQuery',
+    'FunctionQuery',
+    'ViewQuery',
+    'PrincipalTypeQuery',
+    'PrincipalQuery',
+    'AccessQuery',
+    'IncludeInherited',
+    'PageToken',
+    'MaxResults',
+  ].forEach((name) =>
+    contract.checkSpec(
+      permissionParameters.includes(name),
+      `Operation listPermissions is missing query parameter: ${name}`,
+    ),
   );
   contract.checkSpec(
-    listParameters.find((parameter) => parameter.name === 'resourceType').required === true,
+    contract.spec.components.parameters.ResourceTypeQuery.required === true,
     'Operation listPermissions must require resourceType',
   );
+  const policyParameters = contract
+    .requireOperation('listTablePolicies')
+    .parameters.map((parameter) =>
+      parameter.$ref ? parameter.$ref.split('/').pop() : parameter.name,
+    );
+  contract.checkSpec(
+    !policyParameters.includes('IncludeInherited'),
+    'Table policies must not expose includeInherited',
+  );
+  contract.checkSpec(
+    contract.spec.paths[
+      '/v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}'
+    ].put,
+    'Full policy replacement must use PUT',
+  );
 
   contract.checkSpec(
     contract.operations.size === operationIds.length,
-    'The initial management contract must stay limited to list, grant, and revoke',
+    `The management contract must define exactly ${operationIds.length} operations`,
+  );
+  resourcePaths.forEach((resourcePath) =>
+    contract.checkSpec(
+      contract.spec.paths[resourcePath].parameters.some(
+        (parameter) => parameter.$ref === '#/components/parameters/Prefix',
+      ),
+      `Path ${resourcePath} must reuse components.parameters.Prefix`,
+    ),
   );
   return contract.operations.size;
 }
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index f2aba26e2090..6965c30f7b1d 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -17,10 +17,14 @@
 openapi: 3.1.1
 info:
   title: Paimon REST Management API
-  version: 1.0.0
+  version: 0.3.0
   description: |
-    Control-plane API for listing, granting, and revoking permissions. Permission payloads use a
-    flat resource-oriented model, and the resource paths belong to the Paimon REST Management API.
+    Experimental control-plane extension for permissions, table row filters, and table column
+    masks in one Paimon REST Catalog prefix. A data policy restricts an already-authorized read;
+    it never grants SELECT by itself. Policy creation and replacement are accepted only when the
+    target table exists, has `query-auth.enabled=true`, and all referenced principals, functions,
+    and columns are valid. Principal lifecycle, function implementation, audit, and persistence
+    remain server responsibilities. This contract may evolve incompatibly while experimental.
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0.html
@@ -29,84 +33,60 @@ servers:
 security:
   - BearerAuth: []
 paths:
-  /v1/catalogs/{catalog}/permissions:
+  /v1/{prefix}/permissions:
+    parameters:
+      - $ref: '#/components/parameters/Prefix'
     get:
       tags: [permission]
-      summary: List Permissions
+      summary: List permission assignments on an exact resource
       operationId: listPermissions
       description: |
-        Lists explicitly granted permissions. Filtering CATALOG also returns CATALOG_ALL;
-        DATABASE also returns DATABASE_ALL; TABLE also returns COLUMN, ROW_FILTER, and
-        COLUMN_MASKING permissions.
+        Direct assignments are returned by default. With `includeInherited=true`, the request
+        still names one exact target and the server also returns effective views of ancestor
+        `DESCENDANTS` assignments. An effective view uses the target in `resource`, `SELF` in
+        `scope`, and the source attachment in `inheritedFrom`. Following the catalog pagination
+        contract, an empty page terminates pagination and therefore must not carry a continuation
+        token.
       parameters:
-        - name: catalog
-          in: path
-          required: true
-          schema:
-            type: string
-        - name: resourceType
-          in: query
-          required: true
-          schema:
-            $ref: '#/components/schemas/ResourceType'
-        - name: database
-          in: query
-          schema:
-            type: string
-        - name: table
-          in: query
-          schema:
-            type: string
-        - name: function
-          in: query
-          schema:
-            type: string
-        - name: view
-          in: query
-          schema:
-            type: string
-        - name: principal
-          in: query
-          schema:
-            type: string
-        - name: pageToken
-          in: query
-          schema:
-            type: string
-        - name: maxResults
-          in: query
-          schema:
-            type: integer
-            format: int32
-            minimum: 1
+        - $ref: '#/components/parameters/ResourceTypeQuery'
+        - $ref: '#/components/parameters/ScopeQuery'
+        - $ref: '#/components/parameters/DatabaseQuery'
+        - $ref: '#/components/parameters/TableQuery'
+        - $ref: '#/components/parameters/FunctionQuery'
+        - $ref: '#/components/parameters/ViewQuery'
+        - $ref: '#/components/parameters/PrincipalTypeQuery'
+        - $ref: '#/components/parameters/PrincipalQuery'
+        - $ref: '#/components/parameters/AccessQuery'
+        - $ref: '#/components/parameters/IncludeInherited'
+        - $ref: '#/components/parameters/PageToken'
+        - $ref: '#/components/parameters/MaxResults'
       responses:
-        "200":
-          description: Permission list.
+        '200':
+          description: Permission assignments in stable pagination order.
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/ListPermissionsResponse'
-        "400":
-          $ref: '#/components/responses/BadRequestErrorResponse'
-        "401":
-          $ref: '#/components/responses/UnauthorizedErrorResponse'
-        "403":
-          $ref: '#/components/responses/ForbiddenErrorResponse'
-        "404":
-          $ref: '#/components/responses/ResourceNotExistErrorResponse'
-        "500":
-          $ref: '#/components/responses/ServerErrorResponse'
-  /v1/catalogs/{catalog}/permissions/grant:
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /v1/{prefix}/permissions/grant:
+    parameters:
+      - $ref: '#/components/parameters/Prefix'
     post:
       tags: [permission]
-      summary: Grant Permission
+      summary: Grant or replace a permission assignment
       operationId: grantPermission
-      parameters:
-        - name: catalog
-          in: path
-          required: true
-          schema:
-            type: string
+      description: |
+        Creates an assignment or replaces the assignment with the same `resource`, `scope`,
+        `access`, and `principal`. The referenced resource and principal must exist.
       requestBody:
         required: true
         content:
@@ -114,30 +94,28 @@ paths:
             schema:
               $ref: '#/components/schemas/GrantPermissionRequest'
       responses:
-        "200":
-          description: Permission granted.
-        "400":
-          $ref: '#/components/responses/BadRequestErrorResponse'
-        "401":
-          $ref: '#/components/responses/UnauthorizedErrorResponse'
-        "403":
-          $ref: '#/components/responses/ForbiddenErrorResponse'
-        "404":
-          $ref: '#/components/responses/ResourceNotExistErrorResponse'
-        "500":
-          $ref: '#/components/responses/ServerErrorResponse'
-  /v1/catalogs/{catalog}/permissions/revoke:
+        '200':
+          description: Permission assignment created or replaced.
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /v1/{prefix}/permissions/revoke:
+    parameters:
+      - $ref: '#/components/parameters/Prefix'
     post:
       tags: [permission]
-      summary: Revoke Permission
+      summary: Idempotently revoke a permission assignment
       operationId: revokePermission
-      description: Revokes the matching permission. A missing permission may return HTTP 404.
-      parameters:
-        - name: catalog
-          in: path
-          required: true
-          schema:
-            type: string
+      description: |
+        Makes the assignment absent. A 404 identifies a missing resource or principal, not an
+        already-absent assignment.
       requestBody:
         required: true
         content:
@@ -145,217 +123,661 @@ paths:
             schema:
               $ref: '#/components/schemas/RevokePermissionRequest'
       responses:
-        "200":
-          description: Permission revoked.
-        "400":
-          $ref: '#/components/responses/BadRequestErrorResponse'
-        "401":
-          $ref: '#/components/responses/UnauthorizedErrorResponse'
-        "403":
-          $ref: '#/components/responses/ForbiddenErrorResponse'
-        "404":
-          $ref: '#/components/responses/ResourceNotExistErrorResponse'
-        "500":
-          $ref: '#/components/responses/ServerErrorResponse'
+        '200':
+          description: Permission assignment is absent.
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+
+  /v1/{prefix}/databases/{database}/tables/{table}/policies:
+    parameters:
+      - $ref: '#/components/parameters/Prefix'
+      - $ref: '#/components/parameters/Database'
+      - $ref: '#/components/parameters/Table'
+    get:
+      tags: [policy]
+      summary: List policies attached directly to a table
+      operationId: listTablePolicies
+      description: |
+        Policies have no ancestor scope in this contract. Following the catalog pagination
+        contract, an empty page terminates pagination and therefore must not carry a continuation
+        token.
+      parameters:
+        - $ref: '#/components/parameters/PolicyNameQuery'
+        - $ref: '#/components/parameters/PolicyTypeQuery'
+        - $ref: '#/components/parameters/PrincipalTypeQuery'
+        - $ref: '#/components/parameters/PrincipalQuery'
+        - $ref: '#/components/parameters/PageToken'
+        - $ref: '#/components/parameters/MaxResults'
+      responses:
+        '200':
+          description: Table policies in stable pagination order.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ListPoliciesResponse'
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    post:
+      tags: [policy]
+      summary: Create a table policy
+      operationId: createTablePolicy
+      description: |
+        Fails with 409 when the policy name already exists or the table has not enabled query
+        authorization. Referenced principals, the policy function, protected column, and column
+        arguments are validated before persistence.
+      requestBody:
+        $ref: '#/components/requestBodies/PolicyRequest'
+      responses:
+        '200':
+          description: Policy created.
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/ServerError'
+  /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}:
+    parameters:
+      - $ref: '#/components/parameters/Prefix'
+      - $ref: '#/components/parameters/Database'
+      - $ref: '#/components/parameters/Table'
+      - $ref: '#/components/parameters/PolicyName'
+    get:
+      tags: [policy]
+      summary: Get a table policy
+      operationId: getTablePolicy
+      responses:
+        '200':
+          description: Named table policy.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GetPolicyResponse'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    put:
+      tags: [policy]
+      summary: Create or fully replace a table policy
+      operationId: createOrReplaceTablePolicy
+      description: |
+        Upserts the named policy and replaces every mutable field. The table attachment and policy
+        name are immutable and the body name must equal `policyName`. The same validation and
+        `query-auth.enabled=true` requirement as create applies.
+      requestBody:
+        $ref: '#/components/requestBodies/PolicyRequest'
+      responses:
+        '200':
+          description: Policy created or fully replaced.
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
+        '500':
+          $ref: '#/components/responses/ServerError'
+    delete:
+      tags: [policy]
+      summary: Drop a table policy
+      operationId: dropTablePolicy
+      description: Returns 404 when the policy is absent; clients may expose idempotency explicitly.
+      responses:
+        '200':
+          description: Policy dropped.
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/ServerError'
+
 components:
   securitySchemes:
     BearerAuth:
       type: http
       scheme: bearer
   parameters:
-    Catalog:
-      name: catalog
+    Prefix:
+      name: prefix
       in: path
       required: true
+      description: Opaque REST catalog prefix returned by the catalog config endpoint.
       schema:
         type: string
-      description: Remote catalog identifier.
+        minLength: 1
+    Database:
+      name: database
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+    Table:
+      name: table
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+    PolicyName:
+      name: policyName
+      in: path
+      required: true
+      schema:
+        type: string
+        minLength: 1
+    ResourceTypeQuery:
+      name: resourceType
+      in: query
+      required: true
+      schema:
+        $ref: '#/components/schemas/ResourceType'
+    ScopeQuery:
+      name: scope
+      in: query
+      schema:
+        $ref: '#/components/schemas/PermissionScope'
+    DatabaseQuery:
+      name: database
+      in: query
+      schema:
+        type: string
+    TableQuery:
+      name: table
+      in: query
+      schema:
+        type: string
+    FunctionQuery:
+      name: function
+      in: query
+      schema:
+        type: string
+    ViewQuery:
+      name: view
+      in: query
+      schema:
+        type: string
+    PrincipalTypeQuery:
+      name: principalType
+      in: query
+      description: Must be supplied together with `principal`.
+      schema:
+        $ref: '#/components/schemas/PrincipalType'
+    PrincipalQuery:
+      name: principal
+      in: query
+      description: Must be supplied together with `principalType`.
+      schema:
+        type: string
+        minLength: 1
+    AccessQuery:
+      name: access
+      in: query
+      schema:
+        type: string
+        minLength: 1
+    IncludeInherited:
+      name: includeInherited
+      in: query
+      schema:
+        type: boolean
+        default: false
+    PolicyNameQuery:
+      name: name
+      in: query
+      schema:
+        type: string
+    PolicyTypeQuery:
+      name: type
+      in: query
+      schema:
+        $ref: '#/components/schemas/PolicyType'
+    PageToken:
+      name: pageToken
+      in: query
+      description: Opaque continuation token returned by the preceding response.
+      schema:
+        type: string
+    MaxResults:
+      name: maxResults
+      in: query
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 1000
+
+  requestBodies:
+    PolicyRequest:
+      required: true
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/PolicyRequest'
+
   responses:
-    BadRequestErrorResponse:
-      description: The permission or list filter is invalid.
+    BadRequest:
+      description: Invalid request shape, resource identity, function, signature, or column.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
-    UnauthorizedErrorResponse:
-      description: Authentication is required or has failed.
+    Unauthorized:
+      description: Missing or invalid authentication.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
-    ForbiddenErrorResponse:
-      description: The authenticated caller may not manage the requested permission.
+    Forbidden:
+      description: Caller cannot manage the target resource.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
-    ResourceNotExistErrorResponse:
-      description: The catalog, resource, principal, or permission does not exist.
+    NotFound:
+      description: Referenced resource, principal, policy, or function does not exist.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
-    ServerErrorResponse:
-      description: The server failed to process the request.
+    Conflict:
+      description: Existing policy conflict or query authorization is not enabled.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
+    ServerError:
+      description: Unexpected server error.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+
   schemas:
-    GrantPermissionRequest:
+    ResourceType:
+      type: string
+      enum: [CATALOG, DATABASE, TABLE, FUNCTION, VIEW]
+    PermissionScope:
+      type: string
+      enum: [SELF, DESCENDANTS]
+    PrincipalType:
+      type: string
+      enum: [USER, GROUP, ROLE, SERVICE]
+    PolicyType:
+      type: string
+      enum: [ROW_FILTER, COLUMN_MASKING]
+    PrincipalRef:
       type: object
-      required: [resourceType, access, principal]
+      additionalProperties: false
+      required: [type, id]
       properties:
-        resourceType:
-          $ref: '#/components/schemas/ResourceType'
-        catalog:
+        type:
+          $ref: '#/components/schemas/PrincipalType'
+        id:
+          type: string
+          minLength: 1
+    PermissionResource:
+      description: Exact catalog-scoped resource identity; fields not selected by type are invalid.
+      oneOf:
+        - $ref: '#/components/schemas/CatalogResource'
+        - $ref: '#/components/schemas/DatabaseResource'
+        - $ref: '#/components/schemas/TableResource'
+        - $ref: '#/components/schemas/FunctionResource'
+        - $ref: '#/components/schemas/ViewResource'
+      discriminator:
+        propertyName: type
+        mapping:
+          CATALOG: '#/components/schemas/CatalogResource'
+          DATABASE: '#/components/schemas/DatabaseResource'
+          TABLE: '#/components/schemas/TableResource'
+          FUNCTION: '#/components/schemas/FunctionResource'
+          VIEW: '#/components/schemas/ViewResource'
+    CatalogResource:
+      type: object
+      additionalProperties: false
+      required: [type]
+      properties:
+        type:
+          const: CATALOG
+    DatabaseResource:
+      type: object
+      additionalProperties: false
+      required: [type, database]
+      properties:
+        type:
+          const: DATABASE
+        database:
           type: string
+          minLength: 1
+    TableResource:
+      type: object
+      additionalProperties: false
+      required: [type, database, table]
+      properties:
+        type:
+          const: TABLE
         database:
           type: string
+          minLength: 1
         table:
           type: string
+          minLength: 1
+    FunctionResource:
+      type: object
+      additionalProperties: false
+      required: [type, database, function]
+      properties:
+        type:
+          const: FUNCTION
+        database:
+          type: string
+          minLength: 1
         function:
           type: string
+          minLength: 1
+    ViewResource:
+      type: object
+      additionalProperties: false
+      required: [type, database, view]
+      properties:
+        type:
+          const: VIEW
+        database:
+          type: string
+          minLength: 1
         view:
           type: string
-        columns:
-          $ref: '#/components/schemas/ColumnSelection'
-        rowFilter:
-          $ref: '#/components/schemas/RowFilter'
-        columnMasking:
-          $ref: '#/components/schemas/ColumnMasking'
+          minLength: 1
+    PermissionAssignment:
+      type: object
+      additionalProperties: false
+      required: [resource, scope, access, principal]
+      properties:
+        resource:
+          $ref: '#/components/schemas/PermissionResource'
+        scope:
+          $ref: '#/components/schemas/PermissionScope'
         access:
           type: string
+          minLength: 1
         principal:
-          type: string
+          $ref: '#/components/schemas/PrincipalRef'
         expireTime:
-          $ref: '#/components/schemas/ExpireTime'
-    RevokePermissionRequest:
+          type: string
+          format: date-time
+        inheritedFrom:
+          $ref: '#/components/schemas/PermissionResource'
+    GrantPermissionRequest:
       type: object
-      required: [resourceType, access, principal]
+      additionalProperties: false
+      required: [resource, access, principal]
       properties:
-        resourceType:
-          $ref: '#/components/schemas/ResourceType'
-        catalog:
-          type: string
-        database:
-          type: string
-        table:
-          type: string
-        function:
+        resource:
+          $ref: '#/components/schemas/PermissionResource'
+        scope:
+          $ref: '#/components/schemas/PermissionScope'
+          default: SELF
+        access:
           type: string
-        view:
+          minLength: 1
+        principal:
+          $ref: '#/components/schemas/PrincipalRef'
+        expireTime:
           type: string
-        columns:
-          $ref: '#/components/schemas/ColumnSelection'
+          format: date-time
+    RevokePermissionRequest:
+      type: object
+      additionalProperties: false
+      required: [resource, access, principal]
+      properties:
+        resource:
+          $ref: '#/components/schemas/PermissionResource'
+        scope:
+          $ref: '#/components/schemas/PermissionScope'
+          default: SELF
         access:
           type: string
+          minLength: 1
         principal:
-          type: string
+          $ref: '#/components/schemas/PrincipalRef'
     ListPermissionsResponse:
       type: object
+      additionalProperties: false
       required: [permissions]
       properties:
         permissions:
           type: array
           items:
-            $ref: '#/components/schemas/Permission'
+            $ref: '#/components/schemas/PermissionAssignment'
         nextPageToken:
           type: string
-    Permission:
+
+    ColumnPolicyArgument:
       type: object
-      required: [resourceType, access, principal]
+      additionalProperties: false
+      required: [column]
       properties:
-        resourceType:
-          $ref: '#/components/schemas/ResourceType'
-        catalog:
+        column:
           type: string
-        database:
+          minLength: 1
+    ConstantPolicyArgument:
+      type: object
+      additionalProperties: false
+      required: [constant]
+      properties:
+        constant:
           type: string
-        table:
+          description: Literal string argument. The empty string is valid.
+    PolicyArgument:
+      oneOf:
+        - $ref: '#/components/schemas/ColumnPolicyArgument'
+        - $ref: '#/components/schemas/ConstantPolicyArgument'
+    RowFilter:
+      type: object
+      additionalProperties: false
+      required: [functionName, functionArguments]
+      properties:
+        functionName:
           type: string
-        function:
+          minLength: 1
+        functionArguments:
+          type: array
+          items:
+            $ref: '#/components/schemas/PolicyArgument'
+    ColumnMask:
+      type: object
+      additionalProperties: false
+      required: [functionName, onColumn, functionArguments]
+      properties:
+        functionName:
           type: string
-        view:
+          minLength: 1
+        onColumn:
+          type: string
+          minLength: 1
+        functionArguments:
+          type: array
+          items:
+            $ref: '#/components/schemas/PolicyArgument'
+    RowFilterPolicyRequest:
+      type: object
+      additionalProperties: false
+      required: [name, rowFilter, toPrincipals]
+      properties:
+        name:
           type: string
-        columns:
-          $ref: '#/components/schemas/ColumnSelection'
+          minLength: 1
         rowFilter:
           $ref: '#/components/schemas/RowFilter'
-        columnMasking:
-          $ref: '#/components/schemas/ColumnMasking'
-        access:
-          type: string
-          description: Permission access such as SELECT, INSERT, UPDATE, DELETE, ALTER, or ALL.
-        principal:
+        toPrincipals:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        exceptPrincipals:
+          type: array
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        comment:
           type: string
-          description: Principal identifier understood by the server.
-        expireTime:
-          $ref: '#/components/schemas/ExpireTime'
-    ResourceType:
-      type: string
-      enum:
-        - CATALOG
-        - CATALOG_ALL
-        - DATABASE
-        - DATABASE_ALL
-        - TABLE
-        - FUNCTION
-        - VIEW
-        - COLUMN
-        - ROW_FILTER
-        - COLUMN_MASKING
-    ColumnSelection:
+    ColumnMaskPolicyRequest:
       type: object
+      additionalProperties: false
+      required: [name, columnMask, toPrincipals]
       properties:
-        columnNames:
+        name:
+          type: string
+          minLength: 1
+        columnMask:
+          $ref: '#/components/schemas/ColumnMask'
+        toPrincipals:
           type: array
+          minItems: 1
           uniqueItems: true
           items:
-            type: string
-        excludedColumnNames:
+            $ref: '#/components/schemas/PrincipalRef'
+        exceptPrincipals:
           type: array
           uniqueItems: true
           items:
-            type: string
+            $ref: '#/components/schemas/PrincipalRef'
+        comment:
+          type: string
+    PolicyRequest:
+      description: Exactly one typed policy definition is allowed.
       oneOf:
-        - required: [columnNames]
-        - required: [excludedColumnNames]
-    RowFilter:
+        - $ref: '#/components/schemas/RowFilterPolicyRequest'
+        - $ref: '#/components/schemas/ColumnMaskPolicyRequest'
+    TablePolicyResource:
       type: object
+      additionalProperties: false
+      required: [type, database, table]
       properties:
-        expression:
+        type:
+          const: TABLE
+        database:
           type: string
-        predicate:
+          minLength: 1
+        table:
           type: string
-      description: Grant requests provide expression; list responses may also include predicate.
-    ColumnMask:
+          minLength: 1
+    RowFilterDataPolicy:
+      type: object
+      additionalProperties: false
+      required: [resource, name, rowFilter, toPrincipals, exceptPrincipals]
+      properties:
+        resource:
+          $ref: '#/components/schemas/TablePolicyResource'
+        name:
+          type: string
+          minLength: 1
+        rowFilter:
+          $ref: '#/components/schemas/RowFilter'
+        toPrincipals:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        exceptPrincipals:
+          type: array
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        comment:
+          type: string
+    ColumnMaskDataPolicy:
       type: object
+      additionalProperties: false
+      required: [resource, name, columnMask, toPrincipals, exceptPrincipals]
       properties:
-        expression:
+        resource:
+          $ref: '#/components/schemas/TablePolicyResource'
+        name:
           type: string
-        transform:
+          minLength: 1
+        columnMask:
+          $ref: '#/components/schemas/ColumnMask'
+        toPrincipals:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        exceptPrincipals:
+          type: array
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/PrincipalRef'
+        comment:
           type: string
-      description: Grant requests provide expression; list responses may also include transform.
-    ColumnMasking:
+    DataPolicy:
+      oneOf:
+        - $ref: '#/components/schemas/RowFilterDataPolicy'
+        - $ref: '#/components/schemas/ColumnMaskDataPolicy'
+    ListPoliciesResponse:
       type: object
-      additionalProperties:
-        $ref: '#/components/schemas/ColumnMask'
-    ExpireTime:
-      type: string
-      description: Expiration time in ISO-8601 UTC form, for example 2025-12-31T23:59:59Z.
-      examples:
-        - 2025-12-31T23:59:59Z
+      additionalProperties: false
+      required: [policies]
+      properties:
+        policies:
+          type: array
+          items:
+            $ref: '#/components/schemas/DataPolicy'
+        nextPageToken:
+          type: string
+    GetPolicyResponse:
+      type: object
+      additionalProperties: false
+      required: [policy]
+      properties:
+        policy:
+          $ref: '#/components/schemas/DataPolicy'
     ErrorResponse:
       type: object
+      additionalProperties: true
       required: [message, code]
       properties:
-        message:
-          type: string
         resourceType:
           type: string
         resourceName:
           type: string
+        message:
+          type: string
         code:
           type: integer
-          format: int32
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
index 6ff044970db9..51cbd9f646cb 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
@@ -18,51 +18,77 @@
 
 package org.apache.paimon.management;
 
+import org.apache.paimon.annotation.Experimental;
+
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Column-mask expression and its optional server-compiled transform. */
+/** Function, protected column, and positional arguments for a column-mask policy. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class ColumnMask {
 
-    private static final String FIELD_EXPRESSION = "expression";
-    private static final String FIELD_TRANSFORM = "transform";
+    private static final String FIELD_FUNCTION_NAME = "functionName";
+    private static final String FIELD_ON_COLUMN = "onColumn";
+    private static final String FIELD_FUNCTION_ARGUMENTS = "functionArguments";
+
+    @JsonProperty(FIELD_FUNCTION_NAME)
+    private final String functionName;
 
-    @Nullable
-    @JsonProperty(FIELD_EXPRESSION)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String expression;
+    @JsonProperty(FIELD_ON_COLUMN)
+    private final String onColumn;
 
-    @Nullable
-    @JsonProperty(FIELD_TRANSFORM)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String transform;
+    @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
+    private final List<PolicyArgument> functionArguments;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_EXPRESSION, FIELD_TRANSFORM})
+    @ConstructorProperties({FIELD_FUNCTION_NAME, FIELD_ON_COLUMN, FIELD_FUNCTION_ARGUMENTS})
     public ColumnMask(
-            @Nullable @JsonProperty(FIELD_EXPRESSION) String expression,
-            @Nullable @JsonProperty(FIELD_TRANSFORM) String transform) {
-        this.expression = expression;
-        this.transform = transform;
+            @JsonProperty(FIELD_FUNCTION_NAME) String functionName,
+            @JsonProperty(FIELD_ON_COLUMN) String onColumn,
+            @Nullable @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
+                    List<PolicyArgument> functionArguments) {
+        checkArgument(!isBlank(functionName), "functionName cannot be empty.");
+        checkArgument(!isBlank(onColumn), "onColumn cannot be empty.");
+        this.functionName = functionName;
+        this.onColumn = onColumn;
+        this.functionArguments = immutable(functionArguments);
+    }
+
+    @JsonGetter(FIELD_FUNCTION_NAME)
+    public String getFunctionName() {
+        return functionName;
+    }
+
+    @JsonGetter(FIELD_ON_COLUMN)
+    public String getOnColumn() {
+        return onColumn;
+    }
+
+    @JsonGetter(FIELD_FUNCTION_ARGUMENTS)
+    public List<PolicyArgument> getFunctionArguments() {
+        return functionArguments;
     }
 
-    @Nullable
-    @JsonGetter(FIELD_EXPRESSION)
-    public String getExpression() {
-        return expression;
+    private static List<PolicyArgument> immutable(@Nullable List<PolicyArgument> arguments) {
+        List<PolicyArgument> result =
+                arguments == null ? Collections.emptyList() : new ArrayList<>(arguments);
+        checkArgument(!result.contains(null), "functionArguments cannot contain null arguments.");
+        return Collections.unmodifiableList(result);
     }
 
-    @Nullable
-    @JsonGetter(FIELD_TRANSFORM)
-    public String getTransform() {
-        return transform;
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
new file mode 100644
index 000000000000..fb7f376ecc61
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
@@ -0,0 +1,202 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Named row-filter or column-mask policy attached to one table. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class DataPolicy {
+
+    private static final String FIELD_RESOURCE = "resource";
+    private static final String FIELD_NAME = "name";
+    private static final String FIELD_ROW_FILTER = "rowFilter";
+    private static final String FIELD_COLUMN_MASK = "columnMask";
+    private static final String FIELD_TO_PRINCIPALS = "toPrincipals";
+    private static final String FIELD_EXCEPT_PRINCIPALS = "exceptPrincipals";
+    private static final String FIELD_COMMENT = "comment";
+
+    @JsonProperty(FIELD_RESOURCE)
+    private final PermissionResource resource;
+
+    @JsonProperty(FIELD_NAME)
+    private final String name;
+
+    @Nullable
+    @JsonProperty(FIELD_ROW_FILTER)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final RowFilter rowFilter;
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMN_MASK)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final ColumnMask columnMask;
+
+    @JsonProperty(FIELD_TO_PRINCIPALS)
+    private final List<PrincipalRef> toPrincipals;
+
+    @JsonProperty(FIELD_EXCEPT_PRINCIPALS)
+    private final List<PrincipalRef> exceptPrincipals;
+
+    @Nullable
+    @JsonProperty(FIELD_COMMENT)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String comment;
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_RESOURCE,
+        FIELD_NAME,
+        FIELD_ROW_FILTER,
+        FIELD_COLUMN_MASK,
+        FIELD_TO_PRINCIPALS,
+        FIELD_EXCEPT_PRINCIPALS,
+        FIELD_COMMENT
+    })
+    public DataPolicy(
+            @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
+            @JsonProperty(FIELD_NAME) String name,
+            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
+            @Nullable @JsonProperty(FIELD_COLUMN_MASK) ColumnMask columnMask,
+            @JsonProperty(FIELD_TO_PRINCIPALS) List<PrincipalRef> toPrincipals,
+            @Nullable @JsonProperty(FIELD_EXCEPT_PRINCIPALS) List<PrincipalRef> exceptPrincipals,
+            @Nullable @JsonProperty(FIELD_COMMENT) String comment) {
+        this.resource = checkNotNull(resource, "resource cannot be null");
+        resource.validatePolicyAttachment();
+        checkArgument(!isBlank(name), "policy name cannot be empty.");
+        this.name = name;
+        checkArgument(
+                (rowFilter == null) != (columnMask == null),
+                "A policy must contain exactly one of rowFilter and columnMask.");
+        this.rowFilter = rowFilter;
+        this.columnMask = columnMask;
+        checkArgument(
+                toPrincipals != null && !toPrincipals.isEmpty(),
+                "toPrincipals must contain at least one principal.");
+        checkArgument(
+                toPrincipals.stream().noneMatch(Objects::isNull),
+                "toPrincipals cannot contain null principals.");
+        checkArgument(
+                new HashSet<>(toPrincipals).size() == toPrincipals.size(),
+                "toPrincipals cannot contain duplicate principals.");
+        this.toPrincipals = immutable(toPrincipals);
+        List<PrincipalRef> exclusions = immutable(exceptPrincipals);
+        checkArgument(
+                exclusions.stream().noneMatch(Objects::isNull),
+                "exceptPrincipals cannot contain null principals.");
+        checkArgument(
+                new HashSet<>(exclusions).size() == exclusions.size(),
+                "exceptPrincipals cannot contain duplicate principals.");
+        this.exceptPrincipals = exclusions;
+        this.comment = isBlank(comment) ? null : comment;
+    }
+
+    public static DataPolicy rowFilter(
+            PermissionResource resource,
+            String name,
+            RowFilter rowFilter,
+            List<PrincipalRef> toPrincipals,
+            @Nullable List<PrincipalRef> exceptPrincipals,
+            @Nullable String comment) {
+        return new DataPolicy(
+                resource, name, rowFilter, null, toPrincipals, exceptPrincipals, comment);
+    }
+
+    public static DataPolicy columnMask(
+            PermissionResource resource,
+            String name,
+            ColumnMask columnMask,
+            List<PrincipalRef> toPrincipals,
+            @Nullable List<PrincipalRef> exceptPrincipals,
+            @Nullable String comment) {
+        return new DataPolicy(
+                resource, name, null, columnMask, toPrincipals, exceptPrincipals, comment);
+    }
+
+    @JsonGetter(FIELD_RESOURCE)
+    public PermissionResource getResource() {
+        return resource;
+    }
+
+    @JsonGetter(FIELD_NAME)
+    public String getName() {
+        return name;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_ROW_FILTER)
+    public RowFilter getRowFilter() {
+        return rowFilter;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_MASK)
+    public ColumnMask getColumnMask() {
+        return columnMask;
+    }
+
+    public PolicyType type() {
+        return rowFilter == null ? PolicyType.COLUMN_MASKING : PolicyType.ROW_FILTER;
+    }
+
+    @JsonGetter(FIELD_TO_PRINCIPALS)
+    public List<PrincipalRef> getToPrincipals() {
+        return toPrincipals;
+    }
+
+    @JsonGetter(FIELD_EXCEPT_PRINCIPALS)
+    public List<PrincipalRef> getExceptPrincipals() {
+        return exceptPrincipals;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COMMENT)
+    public String getComment() {
+        return comment;
+    }
+
+    private static <T> List<T> immutable(@Nullable List<T> values) {
+        return values == null
+                ? Collections.emptyList()
+                : Collections.unmodifiableList(new ArrayList<>(values));
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
index 3a9f1cfb8ba2..1855cea9a63d 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -18,66 +18,101 @@
 
 package org.apache.paimon.management;
 
+import org.apache.paimon.annotation.Experimental;
+
 import javax.annotation.Nullable;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Resource filters and pagination for listing explicitly granted permissions. */
+/** Exact resource, principal, and pagination filters for listing permission assignments. */
+@Experimental
 public class ListPermissionsRequest {
 
-    private final ResourceType resourceType;
-    @Nullable private final String database;
-    @Nullable private final String table;
-    @Nullable private final String function;
-    @Nullable private final String view;
+    public static final int MAX_PAGE_SIZE = 1000;
+
+    private final PermissionResource resource;
+    @Nullable private final PermissionScope scope;
+    @Nullable private final PrincipalType principalType;
     @Nullable private final String principal;
+    @Nullable private final String access;
+    private final boolean includeInherited;
     @Nullable private final String pageToken;
     @Nullable private final Integer maxResults;
 
     public ListPermissionsRequest(
             ResourceType resourceType,
+            @Nullable PermissionScope scope,
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
+            @Nullable PrincipalType principalType,
             @Nullable String principal,
+            @Nullable String access,
+            boolean includeInherited,
             @Nullable String pageToken,
             @Nullable Integer maxResults) {
+        this.resource = exactResource(resourceType, database, table, function, view);
+        if (scope == PermissionScope.DESCENDANTS) {
+            checkArgument(
+                    resourceType == ResourceType.CATALOG || resourceType == ResourceType.DATABASE,
+                    "DESCENDANTS scope applies only to CATALOG or DATABASE assignments.");
+        }
+        checkArgument(
+                (principalType == null) == isBlank(principal),
+                "principalType and principal must be specified together.");
+        checkArgument(maxResults == null || maxResults > 0, "maxResults must be greater than 0.");
         checkArgument(
-                !isBlank(database) || (isBlank(table) && isBlank(function) && isBlank(view)),
-                "database is required when table, function, or view is specified.");
-        this.resourceType = resourceType;
-        this.database = database;
-        this.table = table;
-        this.function = function;
-        this.view = view;
-        this.principal = principal;
-        this.pageToken = pageToken;
+                maxResults == null || maxResults <= MAX_PAGE_SIZE,
+                "maxResults must be at most %s.",
+                MAX_PAGE_SIZE);
+        this.scope = scope;
+        this.principalType = principalType;
+        this.principal = isBlank(principal) ? null : principal;
+        this.access =
+                isBlank(access)
+                        ? null
+                        : scope == null
+                                ? PermissionAccess.canonicalize(resource, access)
+                                : PermissionAccess.canonicalize(resource, scope, access);
+        this.includeInherited = includeInherited;
+        this.pageToken = isBlank(pageToken) ? null : pageToken;
         this.maxResults = maxResults;
     }
 
     public ResourceType getResourceType() {
-        return resourceType;
+        return resource.getType();
+    }
+
+    @Nullable
+    public PermissionScope getScope() {
+        return scope;
     }
 
     @Nullable
     public String getDatabase() {
-        return database;
+        return resource.getDatabase();
     }
 
     @Nullable
     public String getTable() {
-        return table;
+        return resource.getTable();
     }
 
     @Nullable
     public String getFunction() {
-        return function;
+        return resource.getFunction();
     }
 
     @Nullable
     public String getView() {
-        return view;
+        return resource.getView();
+    }
+
+    @Nullable
+    public PrincipalType getPrincipalType() {
+        return principalType;
     }
 
     @Nullable
@@ -85,6 +120,15 @@ public String getPrincipal() {
         return principal;
     }
 
+    @Nullable
+    public String getAccess() {
+        return access;
+    }
+
+    public boolean includeInherited() {
+        return includeInherited;
+    }
+
     @Nullable
     public String getPageToken() {
         return pageToken;
@@ -95,6 +139,41 @@ public Integer getMaxResults() {
         return maxResults;
     }
 
+    public PermissionResource resource() {
+        return resource;
+    }
+
+    public ListPermissionsRequest withPageToken(@Nullable String newPageToken) {
+        return new ListPermissionsRequest(
+                resource.getType(),
+                scope,
+                resource.getDatabase(),
+                resource.getTable(),
+                resource.getFunction(),
+                resource.getView(),
+                principalType,
+                principal,
+                access,
+                includeInherited,
+                newPageToken,
+                maxResults);
+    }
+
+    private static PermissionResource exactResource(
+            ResourceType resourceType,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view) {
+        checkNotNull(resourceType, "resourceType cannot be null");
+        try {
+            return new PermissionResource(resourceType, database, table, function, view);
+        } catch (IllegalArgumentException e) {
+            throw new IllegalArgumentException(
+                    "Permission listing requires an exact target resource: " + e.getMessage(), e);
+        }
+    }
+
     private static boolean isBlank(@Nullable String value) {
         return value == null || value.trim().isEmpty();
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
new file mode 100644
index 000000000000..6f1667614377
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import javax.annotation.Nullable;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Filters for listing policies attached to an exact table resource. */
+@Experimental
+public class ListPoliciesRequest {
+
+    private final PermissionResource resource;
+    @Nullable private final String name;
+    @Nullable private final PolicyType type;
+    @Nullable private final PrincipalType principalType;
+    @Nullable private final String principal;
+    @Nullable private final String pageToken;
+    @Nullable private final Integer maxResults;
+
+    public ListPoliciesRequest(
+            PermissionResource resource,
+            @Nullable String name,
+            @Nullable PolicyType type,
+            @Nullable PrincipalType principalType,
+            @Nullable String principal,
+            @Nullable String pageToken,
+            @Nullable Integer maxResults) {
+        this.resource = checkNotNull(resource, "resource cannot be null");
+        resource.validatePolicyAttachment();
+        checkArgument(
+                (principalType == null) == isBlank(principal),
+                "principalType and principal must be specified together.");
+        checkArgument(maxResults == null || maxResults > 0, "maxResults must be greater than 0.");
+        checkArgument(
+                maxResults == null || maxResults <= ListPermissionsRequest.MAX_PAGE_SIZE,
+                "maxResults must be at most %s.",
+                ListPermissionsRequest.MAX_PAGE_SIZE);
+        this.name = isBlank(name) ? null : name;
+        this.type = type;
+        this.principalType = principalType;
+        this.principal = isBlank(principal) ? null : principal;
+        this.pageToken = isBlank(pageToken) ? null : pageToken;
+        this.maxResults = maxResults;
+    }
+
+    public PermissionResource getResource() {
+        return resource;
+    }
+
+    @Nullable
+    public String getName() {
+        return name;
+    }
+
+    @Nullable
+    public PolicyType getType() {
+        return type;
+    }
+
+    @Nullable
+    public PrincipalType getPrincipalType() {
+        return principalType;
+    }
+
+    @Nullable
+    public String getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    public String getPageToken() {
+        return pageToken;
+    }
+
+    @Nullable
+    public Integer getMaxResults() {
+        return maxResults;
+    }
+
+    public ListPoliciesRequest withPageToken(@Nullable String newPageToken) {
+        return new ListPoliciesRequest(
+                resource, name, type, principalType, principal, newPageToken, maxResults);
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/Permission.java b/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
deleted file mode 100644
index c8bad02e5b76..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/Permission.java
+++ /dev/null
@@ -1,241 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
-
-import javax.annotation.Nullable;
-
-import java.beans.ConstructorProperties;
-import java.util.Map;
-
-/** Permission grant on a catalog resource. */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class Permission {
-
-    private static final String FIELD_RESOURCE_TYPE = "resourceType";
-    private static final String FIELD_CATALOG = "catalog";
-    private static final String FIELD_DATABASE = "database";
-    private static final String FIELD_TABLE = "table";
-    private static final String FIELD_FUNCTION = "function";
-    private static final String FIELD_VIEW = "view";
-    private static final String FIELD_COLUMNS = "columns";
-    private static final String FIELD_ROW_FILTER = "rowFilter";
-    private static final String FIELD_COLUMN_MASKING = "columnMasking";
-    private static final String FIELD_ACCESS = "access";
-    private static final String FIELD_PRINCIPAL = "principal";
-    private static final String FIELD_EXPIRE_TIME = "expireTime";
-
-    @JsonProperty(FIELD_RESOURCE_TYPE)
-    private final ResourceType resourceType;
-
-    @Nullable
-    @JsonProperty(FIELD_CATALOG)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String catalog;
-
-    @Nullable
-    @JsonProperty(FIELD_DATABASE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String database;
-
-    @Nullable
-    @JsonProperty(FIELD_TABLE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String table;
-
-    @Nullable
-    @JsonProperty(FIELD_FUNCTION)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String function;
-
-    @Nullable
-    @JsonProperty(FIELD_VIEW)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String view;
-
-    @Nullable
-    @JsonProperty(FIELD_COLUMNS)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final ColumnSelection columns;
-
-    @Nullable
-    @JsonProperty(FIELD_ROW_FILTER)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final RowFilter rowFilter;
-
-    @Nullable
-    @JsonProperty(FIELD_COLUMN_MASKING)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final Map<String, ColumnMask> columnMasking;
-
-    @JsonProperty(FIELD_ACCESS)
-    private final String access;
-
-    @JsonProperty(FIELD_PRINCIPAL)
-    private final String principal;
-
-    @Nullable
-    @JsonProperty(FIELD_EXPIRE_TIME)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String expireTime;
-
-    @JsonCreator
-    @ConstructorProperties({
-        FIELD_RESOURCE_TYPE,
-        FIELD_CATALOG,
-        FIELD_DATABASE,
-        FIELD_TABLE,
-        FIELD_FUNCTION,
-        FIELD_VIEW,
-        FIELD_COLUMNS,
-        FIELD_ROW_FILTER,
-        FIELD_COLUMN_MASKING,
-        FIELD_ACCESS,
-        FIELD_PRINCIPAL,
-        FIELD_EXPIRE_TIME
-    })
-    public Permission(
-            @JsonProperty(FIELD_RESOURCE_TYPE) String resourceType,
-            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
-            @Nullable @JsonProperty(FIELD_DATABASE) String database,
-            @Nullable @JsonProperty(FIELD_TABLE) String table,
-            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
-            @Nullable @JsonProperty(FIELD_VIEW) String view,
-            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
-            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
-            @Nullable @JsonProperty(FIELD_COLUMN_MASKING) Map<String, ColumnMask> columnMasking,
-            @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) String principal,
-            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
-        this(
-                ResourceType.fromString(resourceType),
-                catalog,
-                database,
-                table,
-                function,
-                view,
-                columns,
-                rowFilter,
-                columnMasking,
-                access,
-                principal,
-                expireTime);
-    }
-
-    public Permission(
-            ResourceType resourceType,
-            @Nullable String catalog,
-            @Nullable String database,
-            @Nullable String table,
-            @Nullable String function,
-            @Nullable String view,
-            @Nullable ColumnSelection columns,
-            @Nullable RowFilter rowFilter,
-            @Nullable Map<String, ColumnMask> columnMasking,
-            String access,
-            String principal,
-            @Nullable String expireTime) {
-        this.resourceType = resourceType;
-        this.catalog = catalog;
-        this.database = database;
-        this.table = table;
-        this.function = function;
-        this.view = view;
-        this.columns = columns;
-        this.rowFilter = rowFilter;
-        this.columnMasking = columnMasking;
-        this.access = access;
-        this.principal = principal;
-        this.expireTime = expireTime;
-    }
-
-    @JsonGetter(FIELD_RESOURCE_TYPE)
-    public ResourceType getResourceType() {
-        return resourceType;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_CATALOG)
-    public String getCatalog() {
-        return catalog;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_DATABASE)
-    public String getDatabase() {
-        return database;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_TABLE)
-    public String getTable() {
-        return table;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_FUNCTION)
-    public String getFunction() {
-        return function;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_VIEW)
-    public String getView() {
-        return view;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMNS)
-    public ColumnSelection getColumns() {
-        return columns;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_ROW_FILTER)
-    public RowFilter getRowFilter() {
-        return rowFilter;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMN_MASKING)
-    public Map<String, ColumnMask> getColumnMasking() {
-        return columnMasking;
-    }
-
-    @JsonGetter(FIELD_ACCESS)
-    public String getAccess() {
-        return access;
-    }
-
-    @JsonGetter(FIELD_PRINCIPAL)
-    public String getPrincipal() {
-        return principal;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_EXPIRE_TIME)
-    public String getExpireTime() {
-        return expireTime;
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
new file mode 100644
index 000000000000..8bfbeb17f2bf
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
@@ -0,0 +1,152 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumMap;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/** Built-in access names and validation for permission assignments. */
+@Experimental
+public final class PermissionAccess {
+
+    public static final String USE_CATALOG = "USE_CATALOG";
+    public static final String CREATE_DATABASE = "CREATE_DATABASE";
+    public static final String USE_DATABASE = "USE_DATABASE";
+    public static final String CREATE_TABLE = "CREATE_TABLE";
+    public static final String CREATE_VIEW = "CREATE_VIEW";
+    public static final String CREATE_FUNCTION = "CREATE_FUNCTION";
+    public static final String SELECT = "SELECT";
+    public static final String INSERT = "INSERT";
+    public static final String UPDATE = "UPDATE";
+    public static final String DELETE = "DELETE";
+    public static final String ALTER = "ALTER";
+    public static final String DROP = "DROP";
+    public static final String EXECUTE = "EXECUTE";
+    public static final String MANAGE_PERMISSIONS = "MANAGE_PERMISSIONS";
+
+    private static final Pattern EXTENSION_ACCESS =
+            Pattern.compile("[A-Z0-9][A-Z0-9._-]*/[A-Z0-9][A-Z0-9._-]*");
+    private static final Map<ResourceType, Set<String>> BUILT_INS = builtIns();
+
+    private PermissionAccess() {}
+
+    public static String canonicalize(String access) {
+        checkArgument(access != null && !access.trim().isEmpty(), "access cannot be empty.");
+        String canonical = access.toUpperCase(Locale.ROOT);
+        if (EXTENSION_ACCESS.matcher(canonical).matches()
+                || BUILT_INS.values().stream().anyMatch(values -> values.contains(canonical))) {
+            return canonical;
+        }
+        throw new IllegalArgumentException(
+                String.format(
+                        "Unknown access '%s'. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
+                        canonical));
+    }
+
+    public static String canonicalize(
+            PermissionResource resource, PermissionScope scope, String access) {
+        String canonical = canonicalize(access);
+        if (EXTENSION_ACCESS.matcher(canonical).matches()) {
+            return canonical;
+        }
+
+        checkArgument(
+                appliesTo(resource.getType(), scope, canonical),
+                "Access '%s' is not valid for %s with %s scope. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
+                canonical,
+                resource.getType(),
+                scope);
+        return canonical;
+    }
+
+    /** Validates an access filter when the query may return either scope. */
+    public static String canonicalize(PermissionResource resource, String access) {
+        String canonical = canonicalize(access);
+        if (EXTENSION_ACCESS.matcher(canonical).matches()) {
+            return canonical;
+        }
+        boolean applicable = appliesTo(resource.getType(), PermissionScope.SELF, canonical);
+        if (!applicable
+                && (resource.getType() == ResourceType.CATALOG
+                        || resource.getType() == ResourceType.DATABASE)) {
+            applicable = appliesTo(resource.getType(), PermissionScope.DESCENDANTS, canonical);
+        }
+        checkArgument(
+                applicable,
+                "Access '%s' is not valid for assignments on %s.",
+                canonical,
+                resource.getType());
+        return canonical;
+    }
+
+    public static Set<String> builtIns(ResourceType type) {
+        return BUILT_INS.get(type);
+    }
+
+    private static boolean appliesTo(ResourceType type, PermissionScope scope, String access) {
+        if (scope == PermissionScope.SELF) {
+            return BUILT_INS.get(type).contains(access);
+        }
+        checkArgument(
+                type == ResourceType.CATALOG || type == ResourceType.DATABASE,
+                "DESCENDANTS scope is supported only for CATALOG and DATABASE resources.");
+        if (type == ResourceType.CATALOG && BUILT_INS.get(ResourceType.DATABASE).contains(access)) {
+            return true;
+        }
+        return BUILT_INS.get(ResourceType.TABLE).contains(access)
+                || BUILT_INS.get(ResourceType.VIEW).contains(access)
+                || BUILT_INS.get(ResourceType.FUNCTION).contains(access);
+    }
+
+    private static Map<ResourceType, Set<String>> builtIns() {
+        Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
+        accesses.put(
+                ResourceType.CATALOG, values(USE_CATALOG, CREATE_DATABASE, MANAGE_PERMISSIONS));
+        accesses.put(
+                ResourceType.DATABASE,
+                values(
+                        USE_DATABASE,
+                        CREATE_TABLE,
+                        CREATE_VIEW,
+                        CREATE_FUNCTION,
+                        ALTER,
+                        DROP,
+                        MANAGE_PERMISSIONS));
+        accesses.put(
+                ResourceType.TABLE,
+                values(SELECT, INSERT, UPDATE, DELETE, ALTER, DROP, MANAGE_PERMISSIONS));
+        accesses.put(ResourceType.VIEW, values(SELECT, ALTER, DROP, MANAGE_PERMISSIONS));
+        accesses.put(ResourceType.FUNCTION, values(EXECUTE, ALTER, DROP, MANAGE_PERMISSIONS));
+        return Collections.unmodifiableMap(accesses);
+    }
+
+    private static Set<String> values(String... accesses) {
+        return Collections.unmodifiableSet(new HashSet<>(Arrays.asList(accesses)));
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
new file mode 100644
index 000000000000..553c0f84e8ab
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
@@ -0,0 +1,154 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.time.Instant;
+import java.time.format.DateTimeParseException;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Direct permission assignment or a resource-inherited view of one. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PermissionAssignment {
+
+    private static final String FIELD_RESOURCE = "resource";
+    private static final String FIELD_SCOPE = "scope";
+    private static final String FIELD_ACCESS = "access";
+    private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_EXPIRE_TIME = "expireTime";
+    private static final String FIELD_INHERITED_FROM = "inheritedFrom";
+
+    @JsonProperty(FIELD_RESOURCE)
+    private final PermissionResource resource;
+
+    @JsonProperty(FIELD_SCOPE)
+    private final PermissionScope scope;
+
+    @JsonProperty(FIELD_ACCESS)
+    private final String access;
+
+    @JsonProperty(FIELD_PRINCIPAL)
+    private final PrincipalRef principal;
+
+    @Nullable
+    @JsonProperty(FIELD_EXPIRE_TIME)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String expireTime;
+
+    @Nullable
+    @JsonProperty(FIELD_INHERITED_FROM)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final PermissionResource inheritedFrom;
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_RESOURCE,
+        FIELD_SCOPE,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL,
+        FIELD_EXPIRE_TIME,
+        FIELD_INHERITED_FROM
+    })
+    public PermissionAssignment(
+            @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
+            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
+            @JsonProperty(FIELD_ACCESS) String access,
+            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal,
+            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime,
+            @Nullable @JsonProperty(FIELD_INHERITED_FROM) PermissionResource inheritedFrom) {
+        this(
+                resource,
+                scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
+                access,
+                principal,
+                expireTime,
+                inheritedFrom);
+    }
+
+    public PermissionAssignment(
+            PermissionResource resource,
+            PermissionScope scope,
+            String access,
+            PrincipalRef principal,
+            @Nullable String expireTime,
+            @Nullable PermissionResource inheritedFrom) {
+        this.resource = checkNotNull(resource, "resource cannot be null");
+        this.scope = checkNotNull(scope, "scope cannot be null");
+        this.access = PermissionAccess.canonicalize(resource, scope, access);
+        this.principal = checkNotNull(principal, "principal cannot be null");
+        if (expireTime != null) {
+            try {
+                Instant.parse(expireTime);
+            } catch (DateTimeParseException e) {
+                throw new IllegalArgumentException(
+                        "expireTime must be an ISO-8601 UTC instant.", e);
+            }
+        }
+        checkArgument(
+                inheritedFrom == null || scope == PermissionScope.SELF,
+                "An inherited assignment view must use SELF scope.");
+        this.expireTime = expireTime;
+        this.inheritedFrom = inheritedFrom;
+    }
+
+    @JsonGetter(FIELD_RESOURCE)
+    public PermissionResource getResource() {
+        return resource;
+    }
+
+    @JsonGetter(FIELD_SCOPE)
+    public PermissionScope getScope() {
+        return scope;
+    }
+
+    @JsonGetter(FIELD_ACCESS)
+    public String getAccess() {
+        return access;
+    }
+
+    @JsonGetter(FIELD_PRINCIPAL)
+    public PrincipalRef getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXPIRE_TIME)
+    public String getExpireTime() {
+        return expireTime;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_INHERITED_FROM)
+    public PermissionResource getInheritedFrom() {
+        return inheritedFrom;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
new file mode 100644
index 000000000000..3481724eeadb
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import java.util.Objects;
+
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Fields that uniquely identify a permission assignment for revocation. */
+@Experimental
+public class PermissionIdentity {
+
+    private final PermissionResource resource;
+    private final PermissionScope scope;
+    private final String access;
+    private final PrincipalRef principal;
+
+    public PermissionIdentity(
+            PermissionResource resource,
+            PermissionScope scope,
+            String access,
+            PrincipalRef principal) {
+        this.resource = checkNotNull(resource, "resource cannot be null");
+        this.scope = checkNotNull(scope, "scope cannot be null");
+        this.access = PermissionAccess.canonicalize(resource, scope, access);
+        this.principal = checkNotNull(principal, "principal cannot be null");
+    }
+
+    public static PermissionIdentity fromAssignment(PermissionAssignment assignment) {
+        return new PermissionIdentity(
+                assignment.getResource(),
+                assignment.getScope(),
+                assignment.getAccess(),
+                assignment.getPrincipal());
+    }
+
+    public PermissionResource getResource() {
+        return resource;
+    }
+
+    public PermissionScope getScope() {
+        return scope;
+    }
+
+    public String getAccess() {
+        return access;
+    }
+
+    public PrincipalRef getPrincipal() {
+        return principal;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof PermissionIdentity)) {
+            return false;
+        }
+        PermissionIdentity that = (PermissionIdentity) o;
+        return resource.equals(that.resource)
+                && scope == that.scope
+                && access.equals(that.access)
+                && principal.equals(that.principal);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(resource, scope, access, principal);
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
index 9764cf9fda2d..49c77d91d058 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
@@ -19,13 +19,15 @@
 package org.apache.paimon.management;
 
 import org.apache.paimon.PagedList;
+import org.apache.paimon.annotation.Experimental;
 
 /** Control-plane contract for managing permissions on catalog resources. */
+@Experimental
 public interface PermissionManagement {
 
-    PagedList<Permission> listPermissions(ListPermissionsRequest request);
+    PagedList<PermissionAssignment> listPermissions(ListPermissionsRequest request);
 
-    void grantPermission(Permission permission);
+    void grantPermission(PermissionAssignment assignment);
 
-    void revokePermission(Permission permission);
+    void revokePermission(PermissionIdentity identity);
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
new file mode 100644
index 000000000000..e2cb630f82f5
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
@@ -0,0 +1,205 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.Objects;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Structured reference to a resource inside the REST catalog prefix. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PermissionResource {
+
+    private static final String FIELD_TYPE = "type";
+    private static final String FIELD_DATABASE = "database";
+    private static final String FIELD_TABLE = "table";
+    private static final String FIELD_FUNCTION = "function";
+    private static final String FIELD_VIEW = "view";
+
+    @JsonProperty(FIELD_TYPE)
+    private final ResourceType type;
+
+    @Nullable
+    @JsonProperty(FIELD_DATABASE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String database;
+
+    @Nullable
+    @JsonProperty(FIELD_TABLE)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String table;
+
+    @Nullable
+    @JsonProperty(FIELD_FUNCTION)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String function;
+
+    @Nullable
+    @JsonProperty(FIELD_VIEW)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String view;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_TYPE, FIELD_DATABASE, FIELD_TABLE, FIELD_FUNCTION, FIELD_VIEW})
+    public PermissionResource(
+            @JsonProperty(FIELD_TYPE) String type,
+            @Nullable @JsonProperty(FIELD_DATABASE) String database,
+            @Nullable @JsonProperty(FIELD_TABLE) String table,
+            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
+            @Nullable @JsonProperty(FIELD_VIEW) String view) {
+        this(ResourceType.fromString(type), database, table, function, view);
+    }
+
+    public PermissionResource(
+            ResourceType type,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view) {
+        this.type = checkNotNull(type, "resource type cannot be null");
+        validate(type, database, table, function, view);
+        this.database = blankToNull(database);
+        this.table = blankToNull(table);
+        this.function = blankToNull(function);
+        this.view = blankToNull(view);
+    }
+
+    @JsonGetter(FIELD_TYPE)
+    public ResourceType getType() {
+        return type;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_DATABASE)
+    public String getDatabase() {
+        return database;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_TABLE)
+    public String getTable() {
+        return table;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_FUNCTION)
+    public String getFunction() {
+        return function;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_VIEW)
+    public String getView() {
+        return view;
+    }
+
+    /** Validates that this resource can carry a data policy in the current contract. */
+    public void validatePolicyAttachment() {
+        checkArgument(
+                type == ResourceType.TABLE,
+                "Policies can currently be attached only to TABLE resources.");
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof PermissionResource)) {
+            return false;
+        }
+        PermissionResource that = (PermissionResource) o;
+        return type == that.type
+                && Objects.equals(database, that.database)
+                && Objects.equals(table, that.table)
+                && Objects.equals(function, that.function)
+                && Objects.equals(view, that.view);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(type, database, table, function, view);
+    }
+
+    private static void validate(
+            ResourceType type,
+            @Nullable String database,
+            @Nullable String table,
+            @Nullable String function,
+            @Nullable String view) {
+        switch (type) {
+            case CATALOG:
+                checkArgument(
+                        isBlank(database) && isBlank(table) && isBlank(function) && isBlank(view),
+                        "CATALOG resource cannot contain object identifiers.");
+                break;
+            case DATABASE:
+                checkArgument(!isBlank(database), "database is required for DATABASE resource.");
+                checkArgument(
+                        isBlank(table) && isBlank(function) && isBlank(view),
+                        "DATABASE resource cannot contain table, function, or view.");
+                break;
+            case TABLE:
+                checkArgument(!isBlank(database), "database is required for TABLE resource.");
+                checkArgument(!isBlank(table), "table is required for TABLE resource.");
+                checkArgument(
+                        isBlank(function) && isBlank(view),
+                        "TABLE resource cannot contain function or view.");
+                break;
+            case FUNCTION:
+                checkArgument(!isBlank(database), "database is required for FUNCTION resource.");
+                checkArgument(!isBlank(function), "function is required for FUNCTION resource.");
+                checkArgument(
+                        isBlank(table) && isBlank(view),
+                        "FUNCTION resource cannot contain table or view.");
+                break;
+            case VIEW:
+                checkArgument(!isBlank(database), "database is required for VIEW resource.");
+                checkArgument(!isBlank(view), "view is required for VIEW resource.");
+                checkArgument(
+                        isBlank(table) && isBlank(function),
+                        "VIEW resource cannot contain table or function.");
+                break;
+            default:
+                throw new IllegalArgumentException("Unsupported resource type " + type);
+        }
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
+
+    @Nullable
+    private static String blankToNull(@Nullable String value) {
+        return isBlank(value) ? null : value;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
new file mode 100644
index 000000000000..71931ce3ef9d
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import javax.annotation.Nullable;
+
+import java.util.Locale;
+
+/** Scope of a permission assignment. */
+@Experimental
+public enum PermissionScope {
+    SELF,
+    DESCENDANTS;
+
+    @Nullable
+    public static PermissionScope fromString(@Nullable String value) {
+        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
new file mode 100644
index 000000000000..872dfb894852
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/** Positional column or constant argument passed to a data policy function. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PolicyArgument {
+
+    private static final String FIELD_COLUMN = "column";
+    private static final String FIELD_CONSTANT = "constant";
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMN)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String column;
+
+    @Nullable
+    @JsonProperty(FIELD_CONSTANT)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final String constant;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_COLUMN, FIELD_CONSTANT})
+    public PolicyArgument(
+            @Nullable @JsonProperty(FIELD_COLUMN) String column,
+            @Nullable @JsonProperty(FIELD_CONSTANT) String constant) {
+        boolean hasColumn = !isBlank(column);
+        boolean hasConstant = constant != null;
+        checkArgument(
+                hasColumn != hasConstant,
+                "A policy argument must contain exactly one of column and constant.");
+        this.column = hasColumn ? column : null;
+        this.constant = hasConstant ? constant : null;
+    }
+
+    public static PolicyArgument column(String column) {
+        return new PolicyArgument(column, null);
+    }
+
+    public static PolicyArgument constant(String constant) {
+        return new PolicyArgument(null, constant);
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN)
+    public String getColumn() {
+        return column;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_CONSTANT)
+    public String getConstant() {
+        return constant;
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
new file mode 100644
index 000000000000..628bdd2eef2d
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Resource-scoped identity of a named data policy. */
+@Experimental
+public class PolicyIdentity {
+
+    private final PermissionResource resource;
+    private final String name;
+
+    public PolicyIdentity(PermissionResource resource, String name) {
+        this.resource = checkNotNull(resource, "resource cannot be null");
+        resource.validatePolicyAttachment();
+        checkArgument(name != null && !name.trim().isEmpty(), "policy name cannot be empty.");
+        this.name = name;
+    }
+
+    public static PolicyIdentity fromPolicy(DataPolicy policy) {
+        return new PolicyIdentity(policy.getResource(), policy.getName());
+    }
+
+    public PermissionResource getResource() {
+        return resource;
+    }
+
+    public String getName() {
+        return name;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
new file mode 100644
index 000000000000..1320277028ed
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.annotation.Experimental;
+
+/** Control-plane contract for row-filter and column-masking policies. */
+@Experimental
+public interface PolicyManagement {
+
+    PagedList<DataPolicy> listPolicies(ListPoliciesRequest request);
+
+    DataPolicy getPolicy(PolicyIdentity identity);
+
+    void createPolicy(DataPolicy policy);
+
+    void createOrReplacePolicy(DataPolicy policy);
+
+    void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists);
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyType.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyType.java
new file mode 100644
index 000000000000..1312a2632fed
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyType.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import javax.annotation.Nullable;
+
+import java.util.Locale;
+
+/** Fine-grained data policy types. */
+@Experimental
+public enum PolicyType {
+    ROW_FILTER,
+    COLUMN_MASKING;
+
+    @Nullable
+    public static PolicyType fromString(@Nullable String value) {
+        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
new file mode 100644
index 000000000000..9a0bace674c1
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.beans.ConstructorProperties;
+import java.util.Objects;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
+/** Stable reference to a permission principal. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PrincipalRef {
+
+    private static final String FIELD_TYPE = "type";
+    private static final String FIELD_ID = "id";
+
+    @JsonProperty(FIELD_TYPE)
+    private final PrincipalType type;
+
+    @JsonProperty(FIELD_ID)
+    private final String id;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_TYPE, FIELD_ID})
+    public PrincipalRef(@JsonProperty(FIELD_TYPE) String type, @JsonProperty(FIELD_ID) String id) {
+        this(PrincipalType.fromString(type), id);
+    }
+
+    public PrincipalRef(PrincipalType type, String id) {
+        this.type = checkNotNull(type, "principal type cannot be null");
+        checkArgument(!isBlank(id), "principal id cannot be empty.");
+        this.id = id;
+    }
+
+    @JsonGetter(FIELD_TYPE)
+    public PrincipalType getType() {
+        return type;
+    }
+
+    @JsonGetter(FIELD_ID)
+    public String getId() {
+        return id;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof PrincipalRef)) {
+            return false;
+        }
+        PrincipalRef that = (PrincipalRef) o;
+        return type == that.type && id.equals(that.id);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(type, id);
+    }
+
+    private static boolean isBlank(String value) {
+        return value == null || value.trim().isEmpty();
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
new file mode 100644
index 000000000000..0461e5ebd3b2
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import javax.annotation.Nullable;
+
+import java.util.Locale;
+
+/** Principal types supported by permission management. */
+@Experimental
+public enum PrincipalType {
+    USER,
+    GROUP,
+    ROLE,
+    SERVICE;
+
+    @Nullable
+    public static PrincipalType fromString(@Nullable String value) {
+        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
index d2f1c30e4666..869a4b971207 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
@@ -18,22 +18,20 @@
 
 package org.apache.paimon.management;
 
+import org.apache.paimon.annotation.Experimental;
+
 import javax.annotation.Nullable;
 
 import java.util.Locale;
 
 /** Resource types supported by permission management. */
+@Experimental
 public enum ResourceType {
     CATALOG,
-    CATALOG_ALL,
     DATABASE,
-    DATABASE_ALL,
     TABLE,
     VIEW,
-    FUNCTION,
-    COLUMN,
-    ROW_FILTER,
-    COLUMN_MASKING;
+    FUNCTION;
 
     @Nullable
     public static ResourceType fromString(@Nullable String value) {
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
index 9787960050b8..79a1009449e9 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
@@ -18,51 +18,65 @@
 
 package org.apache.paimon.management;
 
+import org.apache.paimon.annotation.Experimental;
+
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Row-filter expression and its optional server-compiled predicate. */
+/** Function and positional arguments for a row-filter policy. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class RowFilter {
 
-    private static final String FIELD_EXPRESSION = "expression";
-    private static final String FIELD_PREDICATE = "predicate";
+    private static final String FIELD_FUNCTION_NAME = "functionName";
+    private static final String FIELD_FUNCTION_ARGUMENTS = "functionArguments";
 
-    @Nullable
-    @JsonProperty(FIELD_EXPRESSION)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String expression;
+    @JsonProperty(FIELD_FUNCTION_NAME)
+    private final String functionName;
 
-    @Nullable
-    @JsonProperty(FIELD_PREDICATE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String predicate;
+    @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
+    private final List<PolicyArgument> functionArguments;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_EXPRESSION, FIELD_PREDICATE})
+    @ConstructorProperties({FIELD_FUNCTION_NAME, FIELD_FUNCTION_ARGUMENTS})
     public RowFilter(
-            @Nullable @JsonProperty(FIELD_EXPRESSION) String expression,
-            @Nullable @JsonProperty(FIELD_PREDICATE) String predicate) {
-        this.expression = expression;
-        this.predicate = predicate;
+            @JsonProperty(FIELD_FUNCTION_NAME) String functionName,
+            @Nullable @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
+                    List<PolicyArgument> functionArguments) {
+        checkArgument(!isBlank(functionName), "functionName cannot be empty.");
+        this.functionName = functionName;
+        this.functionArguments = immutable(functionArguments);
+    }
+
+    @JsonGetter(FIELD_FUNCTION_NAME)
+    public String getFunctionName() {
+        return functionName;
+    }
+
+    @JsonGetter(FIELD_FUNCTION_ARGUMENTS)
+    public List<PolicyArgument> getFunctionArguments() {
+        return functionArguments;
     }
 
-    @Nullable
-    @JsonGetter(FIELD_EXPRESSION)
-    public String getExpression() {
-        return expression;
+    private static List<PolicyArgument> immutable(@Nullable List<PolicyArgument> arguments) {
+        List<PolicyArgument> result =
+                arguments == null ? Collections.emptyList() : new ArrayList<>(arguments);
+        checkArgument(!result.contains(null), "functionArguments cannot contain null arguments.");
+        return Collections.unmodifiableList(result);
     }
 
-    @Nullable
-    @JsonGetter(FIELD_PREDICATE)
-    public String getPredicate() {
-        return predicate;
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
index 8205dfe21295..d13866203af5 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
@@ -32,6 +32,7 @@
 import org.apache.hc.client5.http.classic.methods.HttpDelete;
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.classic.methods.HttpPut;
 import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
 import org.apache.hc.core5.http.ClassicHttpResponse;
 import org.apache.hc.core5.http.ContentType;
@@ -113,6 +114,19 @@ public <T extends RESTResponse> T post(
                         : null);
     }
 
+    @Override
+    public <T extends RESTResponse> T put(
+            String path, RESTRequest body, RESTAuthFunction restAuthFunction) {
+        HttpPut httpPut = HttpClientUtils.newHttpPut(getRequestUrl(path, null));
+        String encodedBody = RESTUtil.encodedBody(body);
+        if (encodedBody != null) {
+            httpPut.setEntity(new StringEntity(encodedBody, ContentType.APPLICATION_JSON));
+        }
+        Header[] authHeaders = getHeaders(path, "PUT", encodedBody, restAuthFunction);
+        httpPut.setHeaders(authHeaders);
+        return exec(httpPut, null);
+    }
+
     @Override
     public <T extends RESTResponse> T delete(String path, RESTAuthFunction restAuthFunction) {
         return delete(path, null, restAuthFunction);
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
index 1444c8118d14..94d0ba80f723 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
@@ -26,6 +26,7 @@
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.classic.methods.HttpHead;
 import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.classic.methods.HttpPut;
 import org.apache.hc.client5.http.config.RequestConfig;
 import org.apache.hc.client5.http.entity.DecompressingEntity;
 import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
@@ -238,6 +239,10 @@ public static HttpPost newHttpPost(String uri) {
         return newRequest(uri, HttpPost::new);
     }
 
+    public static HttpPut newHttpPut(String uri) {
+        return newRequest(uri, HttpPut::new);
+    }
+
     public static HttpDelete newHttpDelete(String uri) {
         return newRequest(uri, HttpDelete::new);
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index f6314736f554..136119d7a35e 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -20,13 +20,18 @@
 
 import org.apache.paimon.PagedList;
 import org.apache.paimon.Snapshot;
+import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.annotation.Public;
 import org.apache.paimon.annotation.VisibleForTesting;
 import org.apache.paimon.catalog.Identifier;
 import org.apache.paimon.consumer.ConsumerInfo;
 import org.apache.paimon.function.FunctionChange;
+import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.ListPermissionsRequest;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ListPoliciesRequest;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
@@ -54,6 +59,7 @@
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByNamesRequest;
 import org.apache.paimon.rest.requests.MarkDonePartitionsRequest;
+import org.apache.paimon.rest.requests.PolicyRequest;
 import org.apache.paimon.rest.requests.RegisterTableRequest;
 import org.apache.paimon.rest.requests.RenameTableRequest;
 import org.apache.paimon.rest.requests.ReplaceTableRequest;
@@ -70,6 +76,7 @@
 import org.apache.paimon.rest.responses.ErrorResponse;
 import org.apache.paimon.rest.responses.GetDatabaseResponse;
 import org.apache.paimon.rest.responses.GetFunctionResponse;
+import org.apache.paimon.rest.responses.GetPolicyResponse;
 import org.apache.paimon.rest.responses.GetTableResponse;
 import org.apache.paimon.rest.responses.GetTableSnapshotResponse;
 import org.apache.paimon.rest.responses.GetTableTokenResponse;
@@ -84,6 +91,7 @@
 import org.apache.paimon.rest.responses.ListFunctionsResponse;
 import org.apache.paimon.rest.responses.ListPartitionsResponse;
 import org.apache.paimon.rest.responses.ListPermissionsResponse;
+import org.apache.paimon.rest.responses.ListPoliciesResponse;
 import org.apache.paimon.rest.responses.ListSnapshotsResponse;
 import org.apache.paimon.rest.responses.ListTableDetailsResponse;
 import org.apache.paimon.rest.responses.ListTablesGloballyResponse;
@@ -838,42 +846,121 @@ public AuthTableQueryResponse authTableQuery(
                 restAuthFunction);
     }
 
-    /** Lists explicitly granted permissions for a catalog. */
-    public ListPermissionsResponse listPermissions(String catalog, ListPermissionsRequest request) {
+    /** Lists permissions on an exact resource in the configured REST catalog. */
+    @Experimental
+    public ListPermissionsResponse listPermissions(ListPermissionsRequest request) {
         Map<String, String> queryParams = Maps.newHashMap();
         putQueryParameter(queryParams, "resourceType", request.getResourceType().name());
+        if (request.getScope() != null) {
+            putQueryParameter(queryParams, "scope", request.getScope().name());
+        }
         putQueryParameter(queryParams, "database", request.getDatabase());
         putQueryParameter(queryParams, "table", request.getTable());
         putQueryParameter(queryParams, "function", request.getFunction());
         putQueryParameter(queryParams, "view", request.getView());
+        if (request.getPrincipalType() != null) {
+            putQueryParameter(queryParams, "principalType", request.getPrincipalType().name());
+        }
         putQueryParameter(queryParams, "principal", request.getPrincipal());
-        if (request.getMaxResults() != null && request.getMaxResults() > 0) {
+        putQueryParameter(queryParams, "access", request.getAccess());
+        if (request.includeInherited()) {
+            queryParams.put("includeInherited", "true");
+        }
+        if (request.getMaxResults() != null) {
             queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
         }
         putQueryParameter(queryParams, PAGE_TOKEN, request.getPageToken());
         return client.get(
-                ResourcePaths.permissions(catalog),
+                resourcePaths.permissions(),
                 queryParams,
                 ListPermissionsResponse.class,
                 restAuthFunction);
     }
 
-    /** Grants a permission for a catalog. */
-    public void grantPermission(String catalog, Permission permission) {
+    /** Grants a permission for the configured REST catalog. */
+    @Experimental
+    public void grantPermission(PermissionAssignment assignment) {
+        client.post(
+                resourcePaths.grantPermission(),
+                new GrantPermissionRequest(assignment),
+                restAuthFunction);
+    }
+
+    /** Revokes a permission for the configured REST catalog. */
+    @Experimental
+    public void revokePermission(PermissionIdentity identity) {
         client.post(
-                ResourcePaths.grantPermission(catalog),
-                new GrantPermissionRequest(permission),
+                resourcePaths.revokePermission(),
+                new RevokePermissionRequest(identity),
+                restAuthFunction);
+    }
+
+    /** Lists policies attached to an exact table resource. */
+    @Experimental
+    public ListPoliciesResponse listPolicies(ListPoliciesRequest request) {
+        Map<String, String> queryParams = Maps.newHashMap();
+        putQueryParameter(queryParams, "name", request.getName());
+        if (request.getType() != null) {
+            putQueryParameter(queryParams, "type", request.getType().name());
+        }
+        if (request.getPrincipalType() != null) {
+            putQueryParameter(queryParams, "principalType", request.getPrincipalType().name());
+        }
+        putQueryParameter(queryParams, "principal", request.getPrincipal());
+        if (request.getMaxResults() != null) {
+            queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
+        }
+        putQueryParameter(queryParams, PAGE_TOKEN, request.getPageToken());
+        return client.get(
+                resourcePaths.policies(request.getResource()),
+                queryParams,
+                ListPoliciesResponse.class,
+                restAuthFunction);
+    }
+
+    /** Gets a named policy from its exact attachment resource. */
+    @Experimental
+    public GetPolicyResponse getPolicy(PolicyIdentity identity) {
+        return client.get(
+                resourcePaths.policy(identity.getResource(), identity.getName()),
+                GetPolicyResponse.class,
                 restAuthFunction);
     }
 
-    /** Revokes a permission for a catalog. */
-    public void revokePermission(String catalog, Permission permission) {
+    /** Creates a named policy on its attachment resource. */
+    @Experimental
+    public void createPolicy(DataPolicy policy) {
         client.post(
-                ResourcePaths.revokePermission(catalog),
-                new RevokePermissionRequest(permission),
+                resourcePaths.policies(policy.getResource()),
+                new PolicyRequest(policy),
                 restAuthFunction);
     }
 
+    /** Creates or fully replaces a named policy without changing its identity. */
+    @Experimental
+    public void createOrReplacePolicy(DataPolicy policy) {
+        client.put(
+                resourcePaths.policy(policy.getResource(), policy.getName()),
+                new PolicyRequest(policy),
+                restAuthFunction);
+    }
+
+    /** Drops a named policy from its exact attachment resource. */
+    @Experimental
+    public void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists) {
+        try {
+            client.delete(
+                    resourcePaths.policy(identity.getResource(), identity.getName()),
+                    restAuthFunction);
+        } catch (NoSuchResourceException e) {
+            if (!ignoreIfNotExists
+                    || !ErrorResponse.RESOURCE_TYPE_POLICY.equals(e.resourceType())
+                    || !identity.getName().equals(e.resourceName())) {
+                throw e;
+            }
+        }
+    }
+
     /**
      * Drop table.
      *
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
index 95a918614da3..e7da1f6827dc 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
@@ -42,13 +42,6 @@ public class RESTCatalogOptions {
                     .noDefaultValue()
                     .withDescription("REST Catalog auth token provider.");
 
-    public static final ConfigOption<String> MANAGEMENT_CATALOG =
-            ConfigOptions.key("management.catalog")
-                    .stringType()
-                    .noDefaultValue()
-                    .withDescription(
-                            "Remote catalog identifier used by optional REST management APIs.");
-
     public static final ConfigOption<String> DLF_REGION =
             ConfigOptions.key("dlf.region")
                     .stringType()
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
index b2058ec8061d..718a959823f7 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
@@ -43,6 +43,9 @@ <T extends RESTResponse> T post(
             Class<T> responseType,
             RESTAuthFunction restAuthFunction);
 
+    <T extends RESTResponse> T put(
+            String path, RESTRequest body, RESTAuthFunction restAuthFunction);
+
     <T extends RESTResponse> T delete(String path, RESTAuthFunction restAuthFunction);
 
     <T extends RESTResponse> T delete(
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
index 6b838d100267..e99aacdf8f21 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
@@ -19,39 +19,36 @@
 package org.apache.paimon.rest;
 
 import org.apache.paimon.PagedList;
+import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.ListPermissionsRequest;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.rest.responses.ListPermissionsResponse;
 
-import static org.apache.paimon.utils.Preconditions.checkArgument;
-
-/** REST implementation of permission management, bound to one remote catalog identifier. */
+/** REST implementation of permission management, bound to the configured REST catalog prefix. */
+@Experimental
 public class RESTPermissionManagement implements PermissionManagement {
 
     private final RESTApi api;
-    private final String catalog;
 
-    public RESTPermissionManagement(RESTApi api, String catalog) {
-        checkArgument(
-                catalog != null && !catalog.isEmpty(), "Management catalog is not configured");
+    public RESTPermissionManagement(RESTApi api) {
         this.api = api;
-        this.catalog = catalog;
     }
 
     @Override
-    public PagedList<Permission> listPermissions(ListPermissionsRequest request) {
-        ListPermissionsResponse response = api.listPermissions(catalog, request);
+    public PagedList<PermissionAssignment> listPermissions(ListPermissionsRequest request) {
+        ListPermissionsResponse response = api.listPermissions(request);
         return new PagedList<>(response.getPermissions(), response.getNextPageToken());
     }
 
     @Override
-    public void grantPermission(Permission permission) {
-        api.grantPermission(catalog, permission);
+    public void grantPermission(PermissionAssignment assignment) {
+        api.grantPermission(assignment);
     }
 
     @Override
-    public void revokePermission(Permission permission) {
-        api.revokePermission(catalog, permission);
+    public void revokePermission(PermissionIdentity identity) {
+        api.revokePermission(identity);
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
new file mode 100644
index 000000000000..5c93756f1bda
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.ListPoliciesRequest;
+import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.rest.responses.ListPoliciesResponse;
+
+/** REST implementation of data policy management for a configured catalog prefix. */
+@Experimental
+public class RESTPolicyManagement implements PolicyManagement {
+
+    private final RESTApi api;
+
+    public RESTPolicyManagement(RESTApi api) {
+        this.api = api;
+    }
+
+    @Override
+    public PagedList<DataPolicy> listPolicies(ListPoliciesRequest request) {
+        ListPoliciesResponse response = api.listPolicies(request);
+        return new PagedList<>(response.getPolicies(), response.getNextPageToken());
+    }
+
+    @Override
+    public DataPolicy getPolicy(PolicyIdentity identity) {
+        return api.getPolicy(identity).getPolicy();
+    }
+
+    @Override
+    public void createPolicy(DataPolicy policy) {
+        api.createPolicy(policy);
+    }
+
+    @Override
+    public void createOrReplacePolicy(DataPolicy policy) {
+        api.createOrReplacePolicy(policy);
+    }
+
+    @Override
+    public void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists) {
+        api.dropPolicy(identity, ignoreIfNotExists);
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
index ff3a31ca3ecc..e312675ed679 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
@@ -18,6 +18,8 @@
 
 package org.apache.paimon.rest;
 
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.options.Options;
 
 import org.apache.paimon.shade.guava30.com.google.common.base.Joiner;
@@ -42,8 +44,8 @@ public class ResourcePaths {
     protected static final String REGISTER = "register";
     protected static final String FUNCTIONS = "functions";
     protected static final String FUNCTION_DETAILS = "function-details";
-    protected static final String CATALOGS = "catalogs";
     protected static final String PERMISSIONS = "permissions";
+    protected static final String POLICIES = "policies";
     protected static final String ID = "id";
 
     private static final Joiner SLASH = Joiner.on("/").skipNulls();
@@ -52,26 +54,42 @@ public static String config() {
         return String.format("%s/config", V1);
     }
 
-    public static String permissions(String catalog) {
-        return SLASH.join(V1, CATALOGS, encodeString(catalog), PERMISSIONS);
+    public static ResourcePaths forCatalogProperties(Options options) {
+        return new ResourcePaths(options.get(RESTCatalogInternalOptions.PREFIX));
     }
 
-    public static String grantPermission(String catalog) {
-        return SLASH.join(permissions(catalog), "grant");
+    private final String prefix;
+
+    public ResourcePaths(String prefix) {
+        this.prefix = encodeString(prefix);
     }
 
-    public static String revokePermission(String catalog) {
-        return SLASH.join(permissions(catalog), "revoke");
+    @Experimental
+    public String permissions() {
+        return SLASH.join(V1, prefix, PERMISSIONS);
     }
 
-    public static ResourcePaths forCatalogProperties(Options options) {
-        return new ResourcePaths(options.get(RESTCatalogInternalOptions.PREFIX));
+    @Experimental
+    public String grantPermission() {
+        return SLASH.join(permissions(), "grant");
     }
 
-    private final String prefix;
+    @Experimental
+    public String revokePermission() {
+        return SLASH.join(permissions(), "revoke");
+    }
 
-    public ResourcePaths(String prefix) {
-        this.prefix = encodeString(prefix);
+    /** Policy collection nested below its attachment resource. */
+    @Experimental
+    public String policies(PermissionResource resource) {
+        resource.validatePolicyAttachment();
+        return SLASH.join(table(resource.getDatabase(), resource.getTable()), POLICIES);
+    }
+
+    /** Named policy nested below its attachment resource. */
+    @Experimental
+    public String policy(PermissionResource resource, String policyName) {
+        return SLASH.join(policies(resource), encodeString(policyName));
     }
 
     public String databases() {
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
index 7b761360ac31..ba701862927f 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
@@ -18,11 +18,11 @@
 
 package org.apache.paimon.rest.requests;
 
-import org.apache.paimon.management.ColumnMask;
-import org.apache.paimon.management.ColumnSelection;
-import org.apache.paimon.management.Permission;
-import org.apache.paimon.management.ResourceType;
-import org.apache.paimon.management.RowFilter;
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PrincipalRef;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
@@ -34,154 +34,81 @@
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
-import java.util.Map;
 
-/** Flat request for granting a permission. */
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/** Request for granting or replacing a permission assignment. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class GrantPermissionRequest implements RESTRequest {
 
-    private static final String FIELD_RESOURCE_TYPE = "resourceType";
-    private static final String FIELD_CATALOG = "catalog";
-    private static final String FIELD_DATABASE = "database";
-    private static final String FIELD_TABLE = "table";
-    private static final String FIELD_FUNCTION = "function";
-    private static final String FIELD_VIEW = "view";
-    private static final String FIELD_COLUMNS = "columns";
-    private static final String FIELD_ROW_FILTER = "rowFilter";
-    private static final String FIELD_COLUMN_MASKING = "columnMasking";
+    private static final String FIELD_RESOURCE = "resource";
+    private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
     private static final String FIELD_EXPIRE_TIME = "expireTime";
 
-    private final Permission permission;
+    private final PermissionAssignment assignment;
 
-    public GrantPermissionRequest(Permission permission) {
-        this.permission = permission;
+    public GrantPermissionRequest(PermissionAssignment assignment) {
+        checkArgument(
+                assignment.getInheritedFrom() == null,
+                "An inherited permission view cannot be granted directly.");
+        this.assignment = assignment;
     }
 
     @JsonCreator
     @ConstructorProperties({
-        FIELD_RESOURCE_TYPE,
-        FIELD_CATALOG,
-        FIELD_DATABASE,
-        FIELD_TABLE,
-        FIELD_FUNCTION,
-        FIELD_VIEW,
-        FIELD_COLUMNS,
-        FIELD_ROW_FILTER,
-        FIELD_COLUMN_MASKING,
+        FIELD_RESOURCE,
+        FIELD_SCOPE,
         FIELD_ACCESS,
         FIELD_PRINCIPAL,
         FIELD_EXPIRE_TIME
     })
     public GrantPermissionRequest(
-            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
-            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
-            @Nullable @JsonProperty(FIELD_DATABASE) String database,
-            @Nullable @JsonProperty(FIELD_TABLE) String table,
-            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
-            @Nullable @JsonProperty(FIELD_VIEW) String view,
-            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
-            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
-            @Nullable @JsonProperty(FIELD_COLUMN_MASKING) Map<String, ColumnMask> columnMasking,
+            @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
+            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
-        this.permission =
-                new Permission(
-                        resourceType,
-                        catalog,
-                        database,
-                        table,
-                        function,
-                        view,
-                        columns,
-                        rowFilter,
-                        columnMasking,
+        this.assignment =
+                new PermissionAssignment(
+                        resource,
+                        scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
                         access,
                         principal,
-                        expireTime);
-    }
-
-    public Permission permission() {
-        return permission;
-    }
-
-    @JsonGetter(FIELD_RESOURCE_TYPE)
-    public ResourceType getResourceType() {
-        return permission.getResourceType();
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_CATALOG)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getCatalog() {
-        return permission.getCatalog();
+                        expireTime,
+                        null);
     }
 
-    @Nullable
-    @JsonGetter(FIELD_DATABASE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getDatabase() {
-        return permission.getDatabase();
+    public PermissionAssignment assignment() {
+        return assignment;
     }
 
-    @Nullable
-    @JsonGetter(FIELD_TABLE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getTable() {
-        return permission.getTable();
+    @JsonGetter(FIELD_RESOURCE)
+    public PermissionResource getResource() {
+        return assignment.getResource();
     }
 
-    @Nullable
-    @JsonGetter(FIELD_FUNCTION)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getFunction() {
-        return permission.getFunction();
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_VIEW)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getView() {
-        return permission.getView();
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMNS)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public ColumnSelection getColumns() {
-        return permission.getColumns();
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_ROW_FILTER)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public RowFilter getRowFilter() {
-        return permission.getRowFilter();
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMN_MASKING)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public Map<String, ColumnMask> getColumnMasking() {
-        return permission.getColumnMasking();
+    @JsonGetter(FIELD_SCOPE)
+    public PermissionScope getScope() {
+        return assignment.getScope();
     }
 
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
-        return permission.getAccess();
+        return assignment.getAccess();
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
-    public String getPrincipal() {
-        return permission.getPrincipal();
+    public PrincipalRef getPrincipal() {
+        return assignment.getPrincipal();
     }
 
     @Nullable
     @JsonGetter(FIELD_EXPIRE_TIME)
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public String getExpireTime() {
-        return permission.getExpireTime();
+        return assignment.getExpireTime();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
new file mode 100644
index 000000000000..2426972661cd
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.requests;
+
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.RowFilter;
+import org.apache.paimon.rest.RESTRequest;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnore;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.List;
+
+/** Create or replace payload for a policy whose table is identified by the request path. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PolicyRequest implements RESTRequest {
+
+    private static final String FIELD_NAME = "name";
+    private static final String FIELD_ROW_FILTER = "rowFilter";
+    private static final String FIELD_COLUMN_MASK = "columnMask";
+    private static final String FIELD_TO_PRINCIPALS = "toPrincipals";
+    private static final String FIELD_EXCEPT_PRINCIPALS = "exceptPrincipals";
+    private static final String FIELD_COMMENT = "comment";
+
+    private final String name;
+    @Nullable private final RowFilter rowFilter;
+    @Nullable private final ColumnMask columnMask;
+    private final List<PrincipalRef> toPrincipals;
+    private final List<PrincipalRef> exceptPrincipals;
+    @Nullable private final String comment;
+
+    public PolicyRequest(DataPolicy policy) {
+        this(
+                policy.getName(),
+                policy.getRowFilter(),
+                policy.getColumnMask(),
+                policy.getToPrincipals(),
+                policy.getExceptPrincipals(),
+                policy.getComment());
+    }
+
+    @JsonCreator
+    @ConstructorProperties({
+        FIELD_NAME,
+        FIELD_ROW_FILTER,
+        FIELD_COLUMN_MASK,
+        FIELD_TO_PRINCIPALS,
+        FIELD_EXCEPT_PRINCIPALS,
+        FIELD_COMMENT
+    })
+    public PolicyRequest(
+            @JsonProperty(FIELD_NAME) String name,
+            @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
+            @Nullable @JsonProperty(FIELD_COLUMN_MASK) ColumnMask columnMask,
+            @JsonProperty(FIELD_TO_PRINCIPALS) List<PrincipalRef> toPrincipals,
+            @Nullable @JsonProperty(FIELD_EXCEPT_PRINCIPALS) List<PrincipalRef> exceptPrincipals,
+            @Nullable @JsonProperty(FIELD_COMMENT) String comment) {
+        this.name = name;
+        this.rowFilter = rowFilter;
+        this.columnMask = columnMask;
+        this.toPrincipals = toPrincipals;
+        this.exceptPrincipals = exceptPrincipals;
+        this.comment = comment;
+    }
+
+    public DataPolicy policy(PermissionResource resource) {
+        return new DataPolicy(
+                resource, name, rowFilter, columnMask, toPrincipals, exceptPrincipals, comment);
+    }
+
+    /** Creating a named resource cannot be replayed after an ambiguous server response. */
+    @JsonIgnore
+    @Override
+    public boolean isRetrySafe() {
+        return false;
+    }
+
+    @JsonGetter(FIELD_NAME)
+    public String getName() {
+        return name;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_ROW_FILTER)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public RowFilter getRowFilter() {
+        return rowFilter;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_MASK)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public ColumnMask getColumnMask() {
+        return columnMask;
+    }
+
+    @JsonGetter(FIELD_TO_PRINCIPALS)
+    public List<PrincipalRef> getToPrincipals() {
+        return toPrincipals;
+    }
+
+    @JsonGetter(FIELD_EXCEPT_PRINCIPALS)
+    public List<PrincipalRef> getExceptPrincipals() {
+        return exceptPrincipals;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COMMENT)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getComment() {
+        return comment;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
index 15441c7b520e..245d0bc6129f 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
@@ -18,145 +18,74 @@
 
 package org.apache.paimon.rest.requests;
 
-import org.apache.paimon.management.ColumnSelection;
-import org.apache.paimon.management.Permission;
-import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PrincipalRef;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
 
-/** Flat request for revoking a permission by its resource identity. */
+/** Idempotent request for revoking a permission assignment by identity. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class RevokePermissionRequest implements RESTRequest {
 
-    private static final String FIELD_RESOURCE_TYPE = "resourceType";
-    private static final String FIELD_CATALOG = "catalog";
-    private static final String FIELD_DATABASE = "database";
-    private static final String FIELD_TABLE = "table";
-    private static final String FIELD_FUNCTION = "function";
-    private static final String FIELD_VIEW = "view";
-    private static final String FIELD_COLUMNS = "columns";
+    private static final String FIELD_RESOURCE = "resource";
+    private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
 
-    private final ResourceType resourceType;
-    @Nullable private final String catalog;
-    @Nullable private final String database;
-    @Nullable private final String table;
-    @Nullable private final String function;
-    @Nullable private final String view;
-    @Nullable private final ColumnSelection columns;
-    private final String access;
-    private final String principal;
+    private final PermissionIdentity identity;
 
-    public RevokePermissionRequest(Permission permission) {
-        this(
-                permission.getResourceType(),
-                permission.getCatalog(),
-                permission.getDatabase(),
-                permission.getTable(),
-                permission.getFunction(),
-                permission.getView(),
-                permission.getColumns(),
-                permission.getAccess(),
-                permission.getPrincipal());
+    public RevokePermissionRequest(PermissionIdentity identity) {
+        this.identity = identity;
     }
 
     @JsonCreator
-    @ConstructorProperties({
-        FIELD_RESOURCE_TYPE,
-        FIELD_CATALOG,
-        FIELD_DATABASE,
-        FIELD_TABLE,
-        FIELD_FUNCTION,
-        FIELD_VIEW,
-        FIELD_COLUMNS,
-        FIELD_ACCESS,
-        FIELD_PRINCIPAL
-    })
+    @ConstructorProperties({FIELD_RESOURCE, FIELD_SCOPE, FIELD_ACCESS, FIELD_PRINCIPAL})
     public RevokePermissionRequest(
-            @JsonProperty(FIELD_RESOURCE_TYPE) ResourceType resourceType,
-            @Nullable @JsonProperty(FIELD_CATALOG) String catalog,
-            @Nullable @JsonProperty(FIELD_DATABASE) String database,
-            @Nullable @JsonProperty(FIELD_TABLE) String table,
-            @Nullable @JsonProperty(FIELD_FUNCTION) String function,
-            @Nullable @JsonProperty(FIELD_VIEW) String view,
-            @Nullable @JsonProperty(FIELD_COLUMNS) ColumnSelection columns,
+            @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
+            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) String principal) {
-        this.resourceType = resourceType;
-        this.catalog = catalog;
-        this.database = database;
-        this.table = table;
-        this.function = function;
-        this.view = view;
-        this.columns = columns;
-        this.access = access;
-        this.principal = principal;
+            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal) {
+        this.identity =
+                new PermissionIdentity(
+                        resource,
+                        scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
+                        access,
+                        principal);
     }
 
-    @JsonGetter(FIELD_RESOURCE_TYPE)
-    public ResourceType getResourceType() {
-        return resourceType;
+    @JsonGetter(FIELD_RESOURCE)
+    public PermissionResource getResource() {
+        return identity.getResource();
     }
 
-    @Nullable
-    @JsonGetter(FIELD_CATALOG)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getCatalog() {
-        return catalog;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_DATABASE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getDatabase() {
-        return database;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_TABLE)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getTable() {
-        return table;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_FUNCTION)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getFunction() {
-        return function;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_VIEW)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getView() {
-        return view;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMNS)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public ColumnSelection getColumns() {
-        return columns;
+    @JsonGetter(FIELD_SCOPE)
+    public PermissionScope getScope() {
+        return identity.getScope();
     }
 
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
-        return access;
+        return identity.getAccess();
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
-    public String getPrincipal() {
-        return principal;
+    public PrincipalRef getPrincipal() {
+        return identity.getPrincipal();
+    }
+
+    public PermissionIdentity identity() {
+        return identity;
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/responses/ErrorResponse.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ErrorResponse.java
index 4eb52308dd0c..4fe52b1d0b22 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/responses/ErrorResponse.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ErrorResponse.java
@@ -51,6 +51,8 @@ public class ErrorResponse implements RESTResponse {
 
     public static final String RESOURCE_TYPE_FUNCTION = "FUNCTION";
 
+    public static final String RESOURCE_TYPE_POLICY = "POLICY";
+
     public static final String RESOURCE_TYPE_DEFINITION = "DEFINITION";
 
     private static final String FIELD_MESSAGE = "message";
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
new file mode 100644
index 000000000000..17c6c40cc361
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.responses;
+
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.rest.RESTResponse;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+/** Response containing one data policy. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class GetPolicyResponse implements RESTResponse {
+
+    private static final String FIELD_POLICY = "policy";
+
+    private final DataPolicy policy;
+
+    @JsonCreator
+    public GetPolicyResponse(@JsonProperty(FIELD_POLICY) DataPolicy policy) {
+        this.policy = policy;
+    }
+
+    @JsonGetter(FIELD_POLICY)
+    public DataPolicy getPolicy() {
+        return policy;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
index af3e13a6568c..ee4d86d1ed9c 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPermissionsResponse.java
@@ -18,7 +18,8 @@
 
 package org.apache.paimon.rest.responses;
 
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.PermissionAssignment;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
@@ -32,14 +33,15 @@
 import java.util.List;
 
 /** Response for listing permissions. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
-public class ListPermissionsResponse implements PagedResponse<Permission> {
+public class ListPermissionsResponse implements PagedResponse<PermissionAssignment> {
 
     private static final String FIELD_PERMISSIONS = "permissions";
     private static final String FIELD_NEXT_PAGE_TOKEN = "nextPageToken";
 
     @JsonProperty(FIELD_PERMISSIONS)
-    private final List<Permission> permissions;
+    private final List<PermissionAssignment> permissions;
 
     @Nullable
     @JsonProperty(FIELD_NEXT_PAGE_TOKEN)
@@ -49,14 +51,14 @@ public class ListPermissionsResponse implements PagedResponse<Permission> {
     @JsonCreator
     @ConstructorProperties({FIELD_PERMISSIONS, FIELD_NEXT_PAGE_TOKEN})
     public ListPermissionsResponse(
-            @JsonProperty(FIELD_PERMISSIONS) List<Permission> permissions,
+            @JsonProperty(FIELD_PERMISSIONS) List<PermissionAssignment> permissions,
             @Nullable @JsonProperty(FIELD_NEXT_PAGE_TOKEN) String nextPageToken) {
         this.permissions = permissions;
         this.nextPageToken = nextPageToken;
     }
 
     @JsonGetter(FIELD_PERMISSIONS)
-    public List<Permission> getPermissions() {
+    public List<PermissionAssignment> getPermissions() {
         return permissions;
     }
 
@@ -68,7 +70,7 @@ public String getNextPageToken() {
     }
 
     @Override
-    public List<Permission> data() {
+    public List<PermissionAssignment> data() {
         return permissions;
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPoliciesResponse.java
similarity index 55%
rename from paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java
rename to paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPoliciesResponse.java
index 652f70bcc6b5..95595f066d59 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ColumnSelection.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/responses/ListPoliciesResponse.java
@@ -16,7 +16,10 @@
  * limitations under the License.
  */
 
-package org.apache.paimon.management;
+package org.apache.paimon.rest.responses;
+
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.DataPolicy;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
@@ -29,41 +32,41 @@
 import java.beans.ConstructorProperties;
 import java.util.List;
 
-/** Included or excluded columns attached to a column permission. */
+/** Response for listing data policies. */
+@Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
-public class ColumnSelection {
+public class ListPoliciesResponse implements PagedResponse<DataPolicy> {
 
-    private static final String FIELD_COLUMN_NAMES = "columnNames";
-    private static final String FIELD_EXCLUDED_COLUMN_NAMES = "excludedColumnNames";
+    private static final String FIELD_POLICIES = "policies";
+    private static final String FIELD_NEXT_PAGE_TOKEN = "nextPageToken";
 
-    @Nullable
-    @JsonProperty(FIELD_COLUMN_NAMES)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final List<String> columnNames;
-
-    @Nullable
-    @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final List<String> excludedColumnNames;
+    private final List<DataPolicy> policies;
+    @Nullable private final String nextPageToken;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_COLUMN_NAMES, FIELD_EXCLUDED_COLUMN_NAMES})
-    public ColumnSelection(
-            @Nullable @JsonProperty(FIELD_COLUMN_NAMES) List<String> columnNames,
-            @Nullable @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES) List<String> excludedColumnNames) {
-        this.columnNames = columnNames;
-        this.excludedColumnNames = excludedColumnNames;
+    @ConstructorProperties({FIELD_POLICIES, FIELD_NEXT_PAGE_TOKEN})
+    public ListPoliciesResponse(
+            @JsonProperty(FIELD_POLICIES) List<DataPolicy> policies,
+            @Nullable @JsonProperty(FIELD_NEXT_PAGE_TOKEN) String nextPageToken) {
+        this.policies = policies;
+        this.nextPageToken = nextPageToken;
     }
 
-    @Nullable
-    @JsonGetter(FIELD_COLUMN_NAMES)
-    public List<String> getColumnNames() {
-        return columnNames;
+    @JsonGetter(FIELD_POLICIES)
+    public List<DataPolicy> getPolicies() {
+        return policies;
     }
 
+    @Override
     @Nullable
-    @JsonGetter(FIELD_EXCLUDED_COLUMN_NAMES)
-    public List<String> getExcludedColumnNames() {
-        return excludedColumnNames;
+    @JsonGetter(FIELD_NEXT_PAGE_TOKEN)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getNextPageToken() {
+        return nextPageToken;
+    }
+
+    @Override
+    public List<DataPolicy> data() {
+        return policies;
     }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index 2dcc787c0801..b0accec6aad7 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -20,147 +20,384 @@
 
 import org.apache.paimon.rest.RESTApi;
 import org.apache.paimon.rest.requests.GrantPermissionRequest;
+import org.apache.paimon.rest.requests.PolicyRequest;
 import org.apache.paimon.rest.requests.RevokePermissionRequest;
 
 import org.junit.jupiter.api.Test;
 
+import java.util.AbstractList;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
-/** JSON compatibility tests for the permission management contract. */
+/** JSON and validation tests for permission and data-policy management contracts. */
 public class PermissionManagementJsonTest {
 
-    private static final String PERMISSION_JSON =
-            "{\"resourceType\":\"COLUMN\",\"catalog\":\"catalog-name\","
-                    + "\"database\":\"sales\",\"table\":\"orders\","
-                    + "\"columns\":{\"columnNames\":[\"id\",\"amount\"]},"
-                    + "\"access\":\"SELECT\",\"principal\":\"role:analyst\","
+    private static final String ASSIGNMENT_JSON =
+            "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
+                    + "\"table\":\"orders\"},\"scope\":\"SELF\",\"access\":\"select\","
+                    + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"},"
                     + "\"expireTime\":\"2027-01-01T00:00:00Z\"}";
 
     @Test
-    void testPermissionDeserializesWithShadedAndExternalJackson() throws Exception {
-        Permission shaded = RESTApi.fromJson(PERMISSION_JSON, Permission.class);
-        Permission external =
+    void testAssignmentDeserializesWithShadedAndExternalJackson() throws Exception {
+        assertAssignment(RESTApi.fromJson(ASSIGNMENT_JSON, PermissionAssignment.class));
+        assertAssignment(
                 new com.fasterxml.jackson.databind.ObjectMapper()
-                        .readValue(PERMISSION_JSON, Permission.class);
+                        .readValue(ASSIGNMENT_JSON, PermissionAssignment.class));
+    }
+
+    @Test
+    void testAssignmentDeserializesLowerCaseDiscriminators() throws Exception {
+        String lowerCaseJson =
+                ASSIGNMENT_JSON
+                        .replace("\"TABLE\"", "\"table\"")
+                        .replace("\"SELF\"", "\"self\"")
+                        .replace("\"ROLE\"", "\"role\"");
+
+        assertAssignment(RESTApi.fromJson(lowerCaseJson, PermissionAssignment.class));
+        assertAssignment(
+                new com.fasterxml.jackson.databind.ObjectMapper()
+                        .readValue(lowerCaseJson, PermissionAssignment.class));
+    }
+
+    @Test
+    void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
+        PermissionAssignment assignment =
+                RESTApi.fromJson(ASSIGNMENT_JSON, PermissionAssignment.class);
+        Map<?, ?> grant =
+                RESTApi.fromJson(RESTApi.toJson(new GrantPermissionRequest(assignment)), Map.class);
+
+        assertThat(grant.get("scope")).isEqualTo("SELF");
+        assertThat(grant.get("access")).isEqualTo("SELECT");
+        assertThat(grant.containsKey("columns")).isFalse();
+        assertThat(grant.containsKey("policy")).isFalse();
+        assertThat(grant.containsKey("grantOption")).isFalse();
+        assertThat(grant.containsKey("inheritedFrom")).isFalse();
 
-        assertPermission(shaded);
-        assertPermission(external);
+        Map<?, ?> revoke =
+                RESTApi.fromJson(
+                        RESTApi.toJson(
+                                new RevokePermissionRequest(
+                                        PermissionIdentity.fromAssignment(assignment))),
+                        Map.class);
+        assertThat(revoke.get("scope")).isEqualTo("SELF");
+        assertThat(revoke.get("access")).isEqualTo("SELECT");
+        assertThat(revoke.containsKey("columns")).isFalse();
+        assertThat(revoke.containsKey("policy")).isFalse();
+        assertThat(revoke.containsKey("policyType")).isFalse();
+        assertThat(revoke.containsKey("grantOption")).isFalse();
+        assertThat(revoke.containsKey("expireTime")).isFalse();
     }
 
     @Test
-    void testPermissionDeserializesLowerCaseResourceType() throws Exception {
-        String lowerCaseJson = PERMISSION_JSON.replace("\"COLUMN\"", "\"column\"");
+    void testOptionalRequestFieldsUseDocumentedDefaults() throws Exception {
+        String permissionJson =
+                "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
+                        + "\"table\":\"orders\"},\"access\":\"select\","
+                        + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"}}";
+
+        assertThat(RESTApi.fromJson(permissionJson, GrantPermissionRequest.class).getScope())
+                .isEqualTo(PermissionScope.SELF);
+        assertThat(RESTApi.fromJson(permissionJson, RevokePermissionRequest.class).getScope())
+                .isEqualTo(PermissionScope.SELF);
+
+        String policyJson =
+                "{\"name\":\"filter\",\"rowFilter\":{\"functionName\":"
+                        + "\"security.filter\"},\"toPrincipals\":[{\"type\":\"ROLE\","
+                        + "\"id\":\"analyst\"}]}";
+        DataPolicy policy =
+                RESTApi.fromJson(policyJson, PolicyRequest.class).policy(tableResource());
+        assertThat(policy.getExceptPrincipals()).isEmpty();
+    }
+
+    @Test
+    void testPoliciesAreNamedFunctionBasedResources() throws Exception {
+        String json =
+                "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
+                        + "\"table\":\"orders\"},\"name\":\"mask_email\","
+                        + "\"columnMask\":{\"functionName\":\"security.mask_email\","
+                        + "\"onColumn\":\"email\",\"functionArguments\":[{\"column\":\"region\"},"
+                        + "{\"constant\":\"CN\"}]},\"toPrincipals\":[{\"type\":\"GROUP\","
+                        + "\"id\":\"analysts\"}],\"exceptPrincipals\":[{\"type\":\"USER\","
+                        + "\"id\":\"admin\"}]}";
+
+        DataPolicy policy = RESTApi.fromJson(json, DataPolicy.class);
+        DataPolicy externalPolicy =
+                new com.fasterxml.jackson.databind.ObjectMapper().readValue(json, DataPolicy.class);
+        assertThat(policy.type()).isEqualTo(PolicyType.COLUMN_MASKING);
+        assertThat(policy.getRowFilter()).isNull();
+        assertThat(policy.getColumnMask().getFunctionName()).isEqualTo("security.mask_email");
+        assertThat(policy.getColumnMask().getOnColumn()).isEqualTo("email");
+        assertThat(policy.getColumnMask().getFunctionArguments().get(0).getColumn())
+                .isEqualTo("region");
+        assertThat(policy.getColumnMask().getFunctionArguments().get(1).getConstant())
+                .isEqualTo("CN");
+        assertThat(policy.getToPrincipals())
+                .containsExactly(new PrincipalRef(PrincipalType.GROUP, "analysts"));
+        assertThat(externalPolicy.getColumnMask().getFunctionName())
+                .isEqualTo("security.mask_email");
+        assertThat(externalPolicy.getColumnMask().getFunctionArguments().get(1).getConstant())
+                .isEqualTo("CN");
 
-        Permission shaded = RESTApi.fromJson(lowerCaseJson, Permission.class);
-        Permission external =
+        PolicyRequest policyRequest = new PolicyRequest(policy);
+        assertThat(policyRequest.isRetrySafe()).isFalse();
+        Map<?, ?> request = RESTApi.fromJson(RESTApi.toJson(policyRequest), Map.class);
+        assertThat(request.containsKey("resource")).isFalse();
+        assertThat(request.get("name")).isEqualTo("mask_email");
+        assertThat(request.containsKey("type")).isFalse();
+        assertThat(request.containsKey("scope")).isFalse();
+        assertThat(request.get("columnMask")).isInstanceOf(Map.class);
+        Map<?, ?> external =
                 new com.fasterxml.jackson.databind.ObjectMapper()
-                        .readValue(lowerCaseJson, Permission.class);
+                        .readValue(
+                                new com.fasterxml.jackson.databind.ObjectMapper()
+                                        .writeValueAsString(policy),
+                                Map.class);
+        assertThat(external.containsKey("type")).isFalse();
+    }
 
-        assertPermission(shaded);
-        assertPermission(external);
+    @Test
+    void testAccessAndPolicyValidation() {
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.DESCENDANTS,
+                                        "SELECT",
+                                        role("analyst"),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("DESCENDANTS");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        catalogResource(),
+                                        PermissionScope.SELF,
+                                        "SELECT",
+                                        role("analyst"),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        catalogResource(),
+                                        PermissionScope.SELF,
+                                        "ALL",
+                                        role("analyst"),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("Unknown access");
+        assertThat(
+                        new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.SELF,
+                                        "vendor.example/read_sensitive",
+                                        role("analyst"),
+                                        null,
+                                        null)
+                                .getAccess())
+                .isEqualTo("VENDOR.EXAMPLE/READ_SENSITIVE");
+        assertThatThrownBy(() -> new PolicyArgument("region", "CN"))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("exactly one");
+        assertThat(PolicyArgument.constant("").getConstant()).isEmpty();
+        assertThatThrownBy(
+                        () ->
+                                new DataPolicy(
+                                        tableResource(),
+                                        "filter",
+                                        new RowFilter("security.filter", null),
+                                        new ColumnMask("security.mask", "region", null),
+                                        Collections.singletonList(role("analyst")),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("exactly one");
+        assertThatThrownBy(
+                        () ->
+                                new DataPolicy(
+                                        catalogResource(),
+                                        "mask",
+                                        null,
+                                        new ColumnMask("security.mask", "email", null),
+                                        Collections.singletonList(role("analyst")),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("TABLE");
     }
 
     @Test
-    void testListObjectFiltersRequireDatabase() {
+    void testPermissionListRequiresExactResourceAndBoundsPageSize() {
         assertThatThrownBy(
                         () ->
                                 new ListPermissionsRequest(
                                         ResourceType.TABLE,
                                         null,
-                                        "orders",
+                                        "sales",
                                         null,
                                         null,
                                         null,
                                         null,
-                                        null))
+                                        null,
+                                        null,
+                                        false,
+                                        null,
+                                        25))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("database is required");
+                .hasMessageContaining("exact target");
         assertThatThrownBy(
                         () ->
                                 new ListPermissionsRequest(
-                                        ResourceType.FUNCTION,
+                                        ResourceType.CATALOG,
                                         null,
                                         null,
-                                        "calculate_tax",
                                         null,
                                         null,
                                         null,
-                                        null))
+                                        null,
+                                        null,
+                                        null,
+                                        false,
+                                        null,
+                                        1001))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("database is required");
+                .hasMessageContaining("at most 1000");
+
+        ListPermissionsRequest descendantsAccess =
+                new ListPermissionsRequest(
+                        ResourceType.CATALOG,
+                        null,
+                        null,
+                        null,
+                        null,
+                        null,
+                        null,
+                        null,
+                        "select",
+                        false,
+                        null,
+                        25);
+        assertThat(descendantsAccess.getAccess()).isEqualTo("SELECT");
         assertThatThrownBy(
                         () ->
                                 new ListPermissionsRequest(
-                                        ResourceType.VIEW,
+                                        ResourceType.DATABASE,
                                         null,
+                                        "sales",
                                         null,
                                         null,
-                                        "daily_orders",
                                         null,
                                         null,
-                                        null))
+                                        null,
+                                        "USE_CATALOG",
+                                        false,
+                                        null,
+                                        25))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("database is required");
+                .hasMessageContaining("not valid for assignments on DATABASE");
     }
 
     @Test
-    void testGrantAndRevokeUseFlatWireShapes() throws Exception {
-        Permission permission = RESTApi.fromJson(PERMISSION_JSON, Permission.class);
-        Map<?, ?> grant =
-                RESTApi.fromJson(RESTApi.toJson(new GrantPermissionRequest(permission)), Map.class);
-        assertThat(grant.get("resourceType")).isEqualTo("COLUMN");
-        assertThat(grant.get("catalog")).isEqualTo("catalog-name");
-        assertThat(grant.get("database")).isEqualTo("sales");
-        assertThat(grant.get("table")).isEqualTo("orders");
-        assertThat(grant.get("access")).isEqualTo("SELECT");
-        assertThat(grant.get("principal")).isEqualTo("role:analyst");
-        assertThat(grant.get("expireTime")).isEqualTo("2027-01-01T00:00:00Z");
-        assertThat(grant.containsKey("permission")).isFalse();
+    void testPolicyDefensivelyCopiesCollections() {
+        ArrayList<PrincipalRef> principals =
+                new ArrayList<>(Collections.singletonList(role("analyst")));
+        ArrayList<PolicyArgument> arguments =
+                new ArrayList<>(Arrays.asList(PolicyArgument.column("region")));
+        DataPolicy policy =
+                DataPolicy.rowFilter(
+                        tableResource(),
+                        "filter",
+                        new RowFilter("security.filter", arguments),
+                        principals,
+                        null,
+                        null);
 
-        Map<?, ?> revoke =
-                RESTApi.fromJson(
-                        RESTApi.toJson(new RevokePermissionRequest(permission)), Map.class);
-        assertThat(revoke.get("resourceType")).isEqualTo("COLUMN");
-        assertThat(revoke.get("catalog")).isEqualTo("catalog-name");
-        assertThat(revoke.get("database")).isEqualTo("sales");
-        assertThat(revoke.get("table")).isEqualTo("orders");
-        assertThat(revoke.get("access")).isEqualTo("SELECT");
-        assertThat(revoke.get("principal")).isEqualTo("role:analyst");
-        assertThat(revoke.containsKey("expireTime")).isFalse();
-        assertThat(revoke.containsKey("rowFilter")).isFalse();
-        assertThat(revoke.containsKey("columnMasking")).isFalse();
+        principals.add(role("admin"));
+        arguments.add(PolicyArgument.constant("CN"));
+
+        assertThat(policy.getToPrincipals()).containsExactly(role("analyst"));
+        assertThat(policy.getRowFilter().getFunctionArguments()).hasSize(1);
     }
 
     @Test
-    void testRowFilterAndColumnMaskUseExpressionPayloads() throws Exception {
-        String json =
-                "{\"resourceType\":\"ROW_FILTER\",\"database\":\"sales\","
-                        + "\"table\":\"orders\",\"rowFilter\":{\"expression\":\"region = 'cn'\","
-                        + "\"predicate\":\"predicate-json\"},\"columnMasking\":{\"email\":{"
-                        + "\"expression\":\"UPPER(email)\",\"transform\":\"transform-json\"}},"
-                        + "\"access\":\"ROW_FILTER\",\"principal\":\"role:analyst\"}";
-
-        Permission permission = RESTApi.fromJson(json, Permission.class);
-        assertThat(permission.getRowFilter().getExpression()).isEqualTo("region = 'cn'");
-        assertThat(permission.getRowFilter().getPredicate()).isEqualTo("predicate-json");
-        assertThat(permission.getColumnMasking().get("email").getExpression())
-                .isEqualTo("UPPER(email)");
-        assertThat(permission.getColumnMasking().get("email").getTransform())
-                .isEqualTo("transform-json");
+    void testPolicyAcceptsListsThatRejectNullLookups() {
+        PrincipalRef principal = role("analyst");
+        List<PrincipalRef> principals =
+                new AbstractList<PrincipalRef>() {
+                    @Override
+                    public PrincipalRef get(int index) {
+                        if (index != 0) {
+                            throw new IndexOutOfBoundsException();
+                        }
+                        return principal;
+                    }
+
+                    @Override
+                    public int size() {
+                        return 1;
+                    }
+
+                    @Override
+                    public boolean contains(Object value) {
+                        if (value == null) {
+                            throw new NullPointerException("null lookups are not supported");
+                        }
+                        return super.contains(value);
+                    }
+                };
+
+        DataPolicy policy =
+                DataPolicy.rowFilter(
+                        tableResource(),
+                        "filter",
+                        new RowFilter("security.filter", Collections.emptyList()),
+                        principals,
+                        null,
+                        null);
+
+        assertThat(policy.getToPrincipals()).containsExactly(principal);
+    }
+
+    @Test
+    void testResourceCanonicalizesBlankIrrelevantLocators() throws Exception {
+        PermissionResource catalog =
+                new PermissionResource(ResourceType.CATALOG, "", " ", null, null);
+
+        assertThat(catalog).isEqualTo(catalogResource());
+        assertThat(RESTApi.toJson(catalog)).isEqualTo("{\"type\":\"CATALOG\"}");
+    }
+
+    private static PermissionResource catalogResource() {
+        return new PermissionResource(ResourceType.CATALOG, null, null, null, null);
+    }
+
+    private static PermissionResource tableResource() {
+        return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
+    }
+
+    private static PrincipalRef role(String id) {
+        return new PrincipalRef(PrincipalType.ROLE, id);
     }
 
-    private static void assertPermission(Permission permission) {
-        assertThat(permission.getResourceType()).isEqualTo(ResourceType.COLUMN);
-        assertThat(permission.getCatalog()).isEqualTo("catalog-name");
-        assertThat(permission.getDatabase()).isEqualTo("sales");
-        assertThat(permission.getTable()).isEqualTo("orders");
-        assertThat(permission.getColumns().getColumnNames()).containsExactly("id", "amount");
-        assertThat(permission.getColumns().getExcludedColumnNames()).isNull();
-        assertThat(permission.getAccess()).isEqualTo("SELECT");
-        assertThat(permission.getPrincipal()).isEqualTo("role:analyst");
-        assertThat(permission.getExpireTime()).isEqualTo("2027-01-01T00:00:00Z");
+    private static void assertAssignment(PermissionAssignment assignment) {
+        assertThat(assignment.getResource().getType()).isEqualTo(ResourceType.TABLE);
+        assertThat(assignment.getResource().getDatabase()).isEqualTo("sales");
+        assertThat(assignment.getResource().getTable()).isEqualTo("orders");
+        assertThat(assignment.getScope()).isEqualTo(PermissionScope.SELF);
+        assertThat(assignment.getAccess()).isEqualTo("SELECT");
+        assertThat(assignment.getPrincipal()).isEqualTo(role("analyst"));
+        assertThat(assignment.getExpireTime()).isEqualTo("2027-01-01T00:00:00Z");
+        assertThat(assignment.getInheritedFrom()).isNull();
     }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
index 5d64b087ef0b..b1a77e026674 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
@@ -20,12 +20,16 @@
 
 import org.apache.paimon.PagedList;
 import org.apache.paimon.management.ListPermissionsRequest;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.rest.exceptions.ForbiddenException;
-import org.apache.paimon.rest.exceptions.NoSuchResourceException;
 
 import com.sun.net.httpserver.HttpExchange;
 import com.sun.net.httpserver.HttpServer;
@@ -40,6 +44,7 @@
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
 
 import static org.apache.paimon.rest.RESTCatalogInternalOptions.PREFIX;
@@ -52,7 +57,7 @@
 /** Behavioral tests for REST permission management. */
 public class RESTPermissionManagementTest {
 
-    private static final String BASE_PATH = "/v1/catalogs/catalog+name/permissions";
+    private static final String BASE_PATH = "/v1/catalog+id/permissions";
 
     private HttpServer server;
     private PermissionManagement management;
@@ -60,12 +65,13 @@ public class RESTPermissionManagementTest {
     private final AtomicReference<String> revokeBody = new AtomicReference<>();
     private final AtomicReference<String> authorization = new AtomicReference<>();
     private final AtomicReference<String> listQuery = new AtomicReference<>();
+    private final AtomicInteger revokeCalls = new AtomicInteger();
 
     @BeforeEach
     void setUp() throws Exception {
         server = HttpServer.create(new InetSocketAddress(0), 0);
         server.createContext(
-                "/v1/catalogs/",
+                "/v1/",
                 exchange -> {
                     authorization.set(exchange.getRequestHeaders().getFirst("Authorization"));
                     String path = exchange.getRequestURI().getRawPath();
@@ -74,10 +80,10 @@ void setUp() throws Exception {
                         respond(
                                 exchange,
                                 200,
-                                "{\"permissions\":[{\"resourceType\":\"TABLE\","
-                                        + "\"database\":\"sales\",\"table\":\"orders\","
-                                        + "\"access\":\"SELECT\","
-                                        + "\"principal\":\"role:analyst\"}],"
+                                "{\"permissions\":[{\"resource\":{\"type\":\"TABLE\","
+                                        + "\"database\":\"sales\",\"table\":\"orders\"},"
+                                        + "\"scope\":\"SELF\",\"access\":\"SELECT\","
+                                        + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"}}],"
                                         + "\"nextPageToken\":\"next\"}");
                     } else if ((BASE_PATH + "/grant").equals(path)) {
                         String body = readBody(exchange);
@@ -88,18 +94,9 @@ void setUp() throws Exception {
                             respond(exchange, 200, null);
                         }
                     } else if ((BASE_PATH + "/revoke").equals(path)) {
-                        String body = readBody(exchange);
-                        revokeBody.set(body);
-                        if (body.contains("missing")) {
-                            respond(
-                                    exchange,
-                                    404,
-                                    "{\"message\":\"permission does not exist\","
-                                            + "\"resourceType\":\"PERMISSION\","
-                                            + "\"resourceName\":\"missing\",\"code\":404}");
-                        } else {
-                            respond(exchange, 200, null);
-                        }
+                        revokeBody.set(readBody(exchange));
+                        revokeCalls.incrementAndGet();
+                        respond(exchange, 200, null);
                     } else {
                         respond(exchange, 404, "{\"message\":\"missing\",\"code\":404}");
                     }
@@ -110,8 +107,8 @@ void setUp() throws Exception {
         options.set(URI, "http://127.0.0.1:" + server.getAddress().getPort());
         options.set(TOKEN_PROVIDER, "bear");
         options.set(TOKEN, "secret");
-        options.set(PREFIX, "unused");
-        management = new RESTPermissionManagement(new RESTApi(options, false), "catalog name");
+        options.set(PREFIX, "catalog id");
+        management = new RESTPermissionManagement(new RESTApi(options, false));
     }
 
     @AfterEach
@@ -122,82 +119,96 @@ void tearDown() {
     }
 
     @Test
-    void testListUsesEncodedCatalogAndCompleteFilters() throws Exception {
-        PagedList<Permission> page =
+    void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
+        PagedList<PermissionAssignment> page =
                 management.listPermissions(
                         new ListPermissionsRequest(
                                 ResourceType.TABLE,
+                                PermissionScope.SELF,
                                 "sales",
                                 "orders",
                                 null,
                                 null,
-                                "role:analyst",
+                                PrincipalType.ROLE,
+                                "analyst",
+                                null,
+                                true,
                                 "start",
                                 25));
 
         assertThat(page.getElements()).hasSize(1);
-        assertThat(page.getElements().get(0).getPrincipal()).isEqualTo("role:analyst");
+        assertThat(page.getElements().get(0).getPrincipal().getId()).isEqualTo("analyst");
         assertThat(page.getNextPageToken()).isEqualTo("next");
         assertThat(queryParameters(listQuery.get()))
-                .containsEntry("principal", "role:analyst")
+                .containsEntry("principalType", "ROLE")
+                .containsEntry("principal", "analyst")
                 .containsEntry("resourceType", "TABLE")
+                .containsEntry("scope", "SELF")
                 .containsEntry("database", "sales")
                 .containsEntry("table", "orders")
+                .containsEntry("includeInherited", "true")
                 .containsEntry("maxResults", "25")
                 .containsEntry("pageToken", "start");
         assertThat(authorization.get()).isEqualTo("Bearer secret");
     }
 
     @Test
-    void testGrantAndRevokeUseFlatWireShapes() throws Exception {
-        Permission permission = permission("role:analyst");
-        management.grantPermission(permission);
-        management.revokePermission(permission);
+    void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
+        PermissionAssignment assignment = assignment("analyst");
+        management.grantPermission(assignment);
+        management.revokePermission(PermissionIdentity.fromAssignment(assignment));
 
         Map<?, ?> grant = RESTApi.fromJson(grantBody.get(), Map.class);
-        assertThat(grant.get("resourceType")).isEqualTo("TABLE");
-        assertThat(grant.get("database")).isEqualTo("sales");
-        assertThat(grant.get("table")).isEqualTo("orders");
-        assertThat(grant.get("access")).isEqualTo("SELECT");
-        assertThat(grant.get("principal")).isEqualTo("role:analyst");
-        assertThat(grant.containsKey("permission")).isFalse();
+        Map<?, ?> grantResource = (Map<?, ?>) grant.get("resource");
+        assertThat(grantResource.get("type")).isEqualTo("TABLE");
+        assertThat(grantResource.get("database")).isEqualTo("sales");
+        assertThat(grantResource.get("table")).isEqualTo("orders");
+        Map<?, ?> grantPrincipal = (Map<?, ?>) grant.get("principal");
+        assertThat(grantPrincipal.get("type")).isEqualTo("ROLE");
+        assertThat(grantPrincipal.get("id")).isEqualTo("analyst");
+        assertThat(grant.get("scope")).isEqualTo("SELF");
+        assertThat(grant.containsKey("columns")).isFalse();
+        assertThat(grant.containsKey("policy")).isFalse();
+        assertThat(grant.containsKey("grantOption")).isFalse();
+        assertThat(grant.containsKey("catalog")).isFalse();
 
         Map<?, ?> revoke = RESTApi.fromJson(revokeBody.get(), Map.class);
-        assertThat(revoke.get("resourceType")).isEqualTo("TABLE");
-        assertThat(revoke.get("database")).isEqualTo("sales");
-        assertThat(revoke.get("table")).isEqualTo("orders");
-        assertThat(revoke.get("access")).isEqualTo("SELECT");
-        assertThat(revoke.get("principal")).isEqualTo("role:analyst");
+        Map<?, ?> revokeResource = (Map<?, ?>) revoke.get("resource");
+        assertThat(revokeResource.get("type")).isEqualTo("TABLE");
+        assertThat(revokeResource.get("database")).isEqualTo("sales");
+        assertThat(revokeResource.get("table")).isEqualTo("orders");
+        Map<?, ?> revokePrincipal = (Map<?, ?>) revoke.get("principal");
+        assertThat(revokePrincipal.get("type")).isEqualTo("ROLE");
+        assertThat(revokePrincipal.get("id")).isEqualTo("analyst");
+        assertThat(revoke.get("scope")).isEqualTo("SELF");
         assertThat(revoke.containsKey("expireTime")).isFalse();
+        assertThat(revoke.containsKey("grantOption")).isFalse();
     }
 
     @Test
     void testForbiddenGrantPreservesRESTErrorTranslation() {
-        assertThatThrownBy(() -> management.grantPermission(permission("denied")))
+        assertThatThrownBy(() -> management.grantPermission(assignment("denied")))
                 .isInstanceOf(ForbiddenException.class)
                 .hasMessageContaining("forbidden");
     }
 
     @Test
-    void testMissingRevokeIsNotSilentlyIdempotent() {
-        assertThatThrownBy(() -> management.revokePermission(permission("missing")))
-                .isInstanceOf(NoSuchResourceException.class)
-                .hasMessageContaining("permission does not exist");
+    void testRepeatedRevokeIsIdempotent() {
+        PermissionAssignment assignment = assignment("missing");
+        PermissionIdentity identity = PermissionIdentity.fromAssignment(assignment);
+        management.revokePermission(identity);
+        management.revokePermission(identity);
+
+        assertThat(revokeCalls).hasValue(2);
     }
 
-    private static Permission permission(String principal) {
-        return new Permission(
-                ResourceType.TABLE,
-                null,
-                "sales",
-                "orders",
-                null,
-                null,
-                null,
-                null,
-                null,
+    private static PermissionAssignment assignment(String principal) {
+        return new PermissionAssignment(
+                new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null),
+                PermissionScope.SELF,
                 "SELECT",
-                principal,
+                new PrincipalRef(PrincipalType.ROLE, principal),
+                null,
                 null);
     }
 
@@ -226,7 +237,7 @@ private static void respond(HttpExchange exchange, int code, String body) throws
             try (OutputStream output = exchange.getResponseBody()) {
                 output.write(bytes);
             }
+            exchange.close();
         }
-        exchange.close();
     }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
new file mode 100644
index 000000000000..66e48d05f927
--- /dev/null
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
@@ -0,0 +1,223 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.ListPoliciesRequest;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PolicyArgument;
+import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.management.PolicyType;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.options.Options;
+import org.apache.paimon.rest.exceptions.NoSuchResourceException;
+import org.apache.paimon.utils.JsonSerdeUtil;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.apache.paimon.rest.RESTCatalogInternalOptions.PREFIX;
+import static org.apache.paimon.rest.RESTCatalogOptions.TOKEN;
+import static org.apache.paimon.rest.RESTCatalogOptions.TOKEN_PROVIDER;
+import static org.apache.paimon.rest.RESTCatalogOptions.URI;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/** Behavioral tests for REST data-policy management. */
+public class RESTPolicyManagementTest {
+
+    private static final String COLLECTION_PATH =
+            "/v1/catalog+id/databases/sales/tables/orders/policies";
+    private static final String POLICY_PATH = COLLECTION_PATH + "/mask+email";
+
+    private HttpServer server;
+    private PolicyManagement management;
+    private final AtomicReference<String> listQuery = new AtomicReference<>();
+    private final AtomicReference<String> createBody = new AtomicReference<>();
+    private final AtomicReference<String> updateBody = new AtomicReference<>();
+    private final AtomicReference<String> deleteError = new AtomicReference<>();
+    private final AtomicInteger deleteCalls = new AtomicInteger();
+
+    @BeforeEach
+    void setUp() throws Exception {
+        server = HttpServer.create(new InetSocketAddress(0), 0);
+        server.createContext(
+                "/v1/",
+                exchange -> {
+                    String path = exchange.getRequestURI().getRawPath();
+                    String method = exchange.getRequestMethod();
+                    if (COLLECTION_PATH.equals(path) && "GET".equals(method)) {
+                        listQuery.set(exchange.getRequestURI().getRawQuery());
+                        respond(exchange, 200, listResponse());
+                    } else if (COLLECTION_PATH.equals(path) && "POST".equals(method)) {
+                        createBody.set(readBody(exchange));
+                        respond(exchange, 200, null);
+                    } else if (POLICY_PATH.equals(path) && "GET".equals(method)) {
+                        respond(exchange, 200, "{\"policy\":" + policyJson() + "}");
+                    } else if (POLICY_PATH.equals(path) && "PUT".equals(method)) {
+                        updateBody.set(readBody(exchange));
+                        respond(exchange, 200, null);
+                    } else if (POLICY_PATH.equals(path) && "DELETE".equals(method)) {
+                        deleteCalls.incrementAndGet();
+                        if (deleteError.get() == null) {
+                            respond(exchange, 200, null);
+                        } else {
+                            respond(exchange, 404, deleteError.get());
+                        }
+                    } else {
+                        respond(exchange, 404, "{\"message\":\"missing\",\"code\":404}");
+                    }
+                });
+        server.start();
+
+        Options options = new Options();
+        options.set(URI, "http://127.0.0.1:" + server.getAddress().getPort());
+        options.set(TOKEN_PROVIDER, "bear");
+        options.set(TOKEN, "secret");
+        options.set(PREFIX, "catalog id");
+        management = new RESTPolicyManagement(new RESTApi(options, false));
+    }
+
+    @AfterEach
+    void tearDown() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    @Test
+    void testListAndGetUseResourceNestedPaths() {
+        PagedList<DataPolicy> policies =
+                management.listPolicies(
+                        new ListPoliciesRequest(
+                                tableResource(),
+                                "mask email",
+                                PolicyType.COLUMN_MASKING,
+                                PrincipalType.ROLE,
+                                "analyst",
+                                "start",
+                                25));
+
+        assertThat(policies.getElements()).hasSize(1);
+        assertThat(policies.getNextPageToken()).isEqualTo("next");
+        assertThat(listQuery.get())
+                .contains("name=mask%20email")
+                .contains("type=COLUMN_MASKING")
+                .contains("principalType=ROLE")
+                .contains("principal=analyst")
+                .contains("maxResults=25")
+                .contains("pageToken=start");
+
+        DataPolicy policy = management.getPolicy(new PolicyIdentity(tableResource(), "mask email"));
+        assertThat(policy.getName()).isEqualTo("mask email");
+        assertThat(policy.getColumnMask().getOnColumn()).isEqualTo("email");
+    }
+
+    @Test
+    void testCreateUpdateAndDropUseCrudMethods() {
+        DataPolicy policy = policy();
+        management.createPolicy(policy);
+        management.createOrReplacePolicy(policy);
+        management.dropPolicy(PolicyIdentity.fromPolicy(policy), false);
+
+        assertThat(createBody.get()).contains("\"name\":\"mask email\"");
+        assertThat(createBody.get()).doesNotContain("\"resource\"");
+        assertThat(updateBody.get()).contains("\"columnMask\"");
+        assertThat(updateBody.get()).doesNotContain("\"scope\"");
+        assertThat(deleteCalls).hasValue(1);
+    }
+
+    @Test
+    void testDropIfExistsOnlyIgnoresMissingPolicy() {
+        PolicyIdentity identity = PolicyIdentity.fromPolicy(policy());
+        deleteError.set(
+                "{\"resourceType\":\"POLICY\",\"resourceName\":\"mask email\","
+                        + "\"message\":\"missing\",\"code\":404}");
+
+        management.dropPolicy(identity, true);
+
+        deleteError.set(
+                "{\"resourceType\":\"TABLE\",\"resourceName\":\"orders\","
+                        + "\"message\":\"missing table\",\"code\":404}");
+        assertThatThrownBy(() -> management.dropPolicy(identity, true))
+                .isInstanceOf(NoSuchResourceException.class)
+                .hasMessageContaining("missing table");
+    }
+
+    private static DataPolicy policy() {
+        return DataPolicy.columnMask(
+                tableResource(),
+                "mask email",
+                new ColumnMask(
+                        "security.mask_email",
+                        "email",
+                        Collections.singletonList(PolicyArgument.column("region"))),
+                Collections.singletonList(new PrincipalRef(PrincipalType.ROLE, "analyst")),
+                Collections.emptyList(),
+                "Mask customer email");
+    }
+
+    private static PermissionResource tableResource() {
+        return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
+    }
+
+    private static String listResponse() {
+        return "{\"policies\":[" + policyJson() + "],\"nextPageToken\":\"next\"}";
+    }
+
+    private static String policyJson() {
+        return JsonSerdeUtil.toFlatJson(policy());
+    }
+
+    private static String readBody(HttpExchange exchange) throws IOException {
+        byte[] data = new byte[8192];
+        int read = exchange.getRequestBody().read(data);
+        return read < 0 ? "" : new String(data, 0, read, StandardCharsets.UTF_8);
+    }
+
+    private static void respond(HttpExchange exchange, int code, String body) throws IOException {
+        if (body == null) {
+            exchange.sendResponseHeaders(code, 0);
+            exchange.getResponseBody().close();
+        } else {
+            byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(code, bytes.length);
+            try (OutputStream output = exchange.getResponseBody()) {
+                output.write(bytes);
+            }
+            exchange.close();
+        }
+    }
+}
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
index 30ebab546325..1751c6ecc9ef 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
@@ -170,6 +170,7 @@ public class RequestJacksonCompatibilityTest {
                             CreateTableRequest.class,
                             CreateViewRequest.class,
                             GrantPermissionRequest.class,
+                            PolicyRequest.class,
                             RegisterTableRequest.class,
                             RenameTableRequest.class,
                             ReplaceTableRequest.class,
diff --git a/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java b/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
index 75a92f0fdc01..9a21f3fa41e2 100644
--- a/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
+++ b/paimon-core/src/main/java/org/apache/paimon/rest/RESTCatalog.java
@@ -22,6 +22,7 @@
 import org.apache.paimon.PagedList;
 import org.apache.paimon.Snapshot;
 import org.apache.paimon.TableType;
+import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.annotation.VisibleForTesting;
 import org.apache.paimon.catalog.Catalog;
 import org.apache.paimon.catalog.CatalogContext;
@@ -40,6 +41,7 @@
 import org.apache.paimon.function.Function;
 import org.apache.paimon.function.FunctionChange;
 import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.PolicyManagement;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
@@ -138,9 +140,14 @@ public RESTCatalogLoader catalogLoader() {
         return new RESTCatalogLoader(context);
     }
 
+    @Experimental
     public PermissionManagement permissionManagement() {
-        return new RESTPermissionManagement(
-                api, context.options().get(RESTCatalogOptions.MANAGEMENT_CATALOG));
+        return new RESTPermissionManagement(api);
+    }
+
+    @Experimental
+    public PolicyManagement policyManagement() {
+        return new RESTPolicyManagement(api);
     }
 
     @Override
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
new file mode 100644
index 000000000000..f5a6277a173c
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import java.util.Objects;
+
+/** Stable identity of a policy stored by the REST catalog test server. */
+final class PolicyKey {
+
+    final String tableUuid;
+    final String name;
+
+    PolicyKey(String tableUuid, String name) {
+        this.tableUuid = tableUuid;
+        this.name = name;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof PolicyKey)) {
+            return false;
+        }
+        PolicyKey that = (PolicyKey) o;
+        return tableUuid.equals(that.tableUuid) && name.equals(that.name);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(tableUuid, name);
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 988af82f848e..3b0711668be5 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -40,8 +40,15 @@
 import org.apache.paimon.function.FunctionChange;
 import org.apache.paimon.function.FunctionDefinition;
 import org.apache.paimon.function.FunctionImpl;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.ListPermissionsRequest;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.operation.Lock;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
@@ -69,6 +76,7 @@
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByNamesRequest;
 import org.apache.paimon.rest.requests.MarkDonePartitionsRequest;
+import org.apache.paimon.rest.requests.PolicyRequest;
 import org.apache.paimon.rest.requests.RenameTableRequest;
 import org.apache.paimon.rest.requests.ReplaceTableRequest;
 import org.apache.paimon.rest.requests.ResetConsumerRequest;
@@ -84,6 +92,7 @@
 import org.apache.paimon.rest.responses.ErrorResponse;
 import org.apache.paimon.rest.responses.GetDatabaseResponse;
 import org.apache.paimon.rest.responses.GetFunctionResponse;
+import org.apache.paimon.rest.responses.GetPolicyResponse;
 import org.apache.paimon.rest.responses.GetTableResponse;
 import org.apache.paimon.rest.responses.GetTableSnapshotResponse;
 import org.apache.paimon.rest.responses.GetTableTokenResponse;
@@ -98,6 +107,7 @@
 import org.apache.paimon.rest.responses.ListFunctionsResponse;
 import org.apache.paimon.rest.responses.ListPartitionsResponse;
 import org.apache.paimon.rest.responses.ListPermissionsResponse;
+import org.apache.paimon.rest.responses.ListPoliciesResponse;
 import org.apache.paimon.rest.responses.ListSnapshotsResponse;
 import org.apache.paimon.rest.responses.ListTableDetailsResponse;
 import org.apache.paimon.rest.responses.ListTablesGloballyResponse;
@@ -166,7 +176,9 @@
 import java.util.Queue;
 import java.util.Set;
 import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.function.BiFunction;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
@@ -190,6 +202,7 @@
 import static org.apache.paimon.rest.ResourcePaths.TABLE_DETAILS;
 import static org.apache.paimon.rest.ResourcePaths.VIEWS;
 import static org.apache.paimon.rest.ResourcePaths.VIEW_DETAILS;
+import static org.apache.paimon.utils.Preconditions.checkArgument;
 
 /** Mock REST server for testing. */
 public class RESTCatalogServer {
@@ -200,16 +213,26 @@ public class RESTCatalogServer {
     public static final String AUTHORIZATION_HEADER_KEY = "Authorization";
 
     private final String databaseUri;
-    private final @Nullable String permissionUri;
+    private final String permissionUri;
 
     private final CatalogContext catalogContext;
     private final RESTFileSystemCatalog catalog;
     private final MockWebServer server;
 
     private final Map<String, Database> databaseStore = new HashMap<>();
-    private final Map<String, TableMetadata> tableMetadataStore = new HashMap<>();
-    private final List<Permission> permissionStore =
-            new java.util.concurrent.CopyOnWriteArrayList<>();
+    private final Map<String, TableMetadata> tableMetadataStore = new ConcurrentHashMap<>();
+    private final RESTPermissionStore permissionStore = new RESTPermissionStore();
+    private final Map<PolicyKey, DataPolicy> policyStore = new ConcurrentHashMap<>();
+    private final Map<String, Object> tablePolicyLocks = new ConcurrentHashMap<>();
+    private final TableLifecycleLocks tableLifecycleLocks = new TableLifecycleLocks();
+    private final Set<PrincipalRef> managementPrincipals = new HashSet<>();
+    private final Set<PrincipalRef> queryPrincipals = new HashSet<>();
+    private final Map<String, BiFunction<TableSchema, RowFilter, Predicate>>
+            rowFilterPolicyFunctions = new HashMap<>();
+    private final Map<String, BiFunction<TableSchema, ColumnMask, Transform>>
+            columnMaskPolicyFunctions = new HashMap<>();
+    private final Set<PermissionResource> noManagementPermissionResources =
+            ConcurrentHashMap.newKeySet();
 
     private final List<ListPartitionsByFilterRequest> receivedListPartitionsByFilterRequests =
             new java.util.concurrent.CopyOnWriteArrayList<>();
@@ -246,10 +269,7 @@ public RESTCatalogServer(
                 this.configResponse.getDefaults().get(RESTCatalogInternalOptions.PREFIX.key());
         this.resourcePaths = new ResourcePaths(prefix);
         this.databaseUri = resourcePaths.databases();
-        String managementCatalog =
-                this.configResponse.getDefaults().get(RESTCatalogOptions.MANAGEMENT_CATALOG.key());
-        this.permissionUri =
-                managementCatalog == null ? null : ResourcePaths.permissions(managementCatalog);
+        this.permissionUri = resourcePaths.permissions();
         Options conf = new Options();
         this.configResponse.getDefaults().forEach(conf::setString);
         conf.setString(WAREHOUSE.key(), dataPath);
@@ -344,11 +364,54 @@ public void addTableColumnAuth(Identifier identifier, List<String> select) {
     }
 
     public void setRowFilterAuth(Identifier identifier, List<Predicate> rowFilters) {
-        rowFilterAuthHandler.put(identifier.getFullName(), rowFilters);
+        if (rowFilters == null) {
+            rowFilterAuthHandler.remove(identifier.getFullName());
+        } else {
+            rowFilterAuthHandler.put(identifier.getFullName(), rowFilters);
+        }
     }
 
     public void setColumnMaskingAuth(Identifier identifier, Map<String, Transform> columnMasking) {
-        columnMaskingAuthHandler.put(identifier.getFullName(), columnMasking);
+        if (columnMasking == null) {
+            columnMaskingAuthHandler.remove(identifier.getFullName());
+        } else {
+            columnMaskingAuthHandler.put(identifier.getFullName(), columnMasking);
+        }
+    }
+
+    public void registerManagementPrincipal(PrincipalRef principal) {
+        managementPrincipals.add(principal);
+    }
+
+    public void setQueryPrincipals(Set<PrincipalRef> principals) {
+        queryPrincipals.clear();
+        queryPrincipals.addAll(principals);
+    }
+
+    public void registerRowFilterPolicyFunction(String name, Predicate predicate) {
+        rowFilterPolicyFunctions.put(name, (schema, rowFilter) -> predicate);
+    }
+
+    public void registerColumnMaskPolicyFunction(String name, Transform transform) {
+        columnMaskPolicyFunctions.put(name, (schema, columnMask) -> transform);
+    }
+
+    public void registerRowFilterPolicyCompiler(
+            String name, BiFunction<TableSchema, RowFilter, Predicate> compiler) {
+        rowFilterPolicyFunctions.put(name, compiler);
+    }
+
+    public void registerColumnMaskPolicyCompiler(
+            String name, BiFunction<TableSchema, ColumnMask, Transform> compiler) {
+        columnMaskPolicyFunctions.put(name, compiler);
+    }
+
+    public void denyManagementPermission(PermissionResource resource) {
+        noManagementPermissionResources.add(resource);
+    }
+
+    public void allowManagementPermission(PermissionResource resource) {
+        noManagementPermissionResources.remove(resource);
     }
 
     public RESTToken getDataToken(Identifier identifier) {
@@ -396,11 +459,13 @@ public MockResponse dispatch(RecordedRequest request) {
                                     .queryParameter(WAREHOUSE.key())
                                     .equals(warehouse)) {
                         return mockResponse(configResponse, 200);
-                    } else if (permissionUri != null
-                            && (permissionUri.equals(resourcePath)
-                                    || request.getPath().startsWith(permissionUri + "/"))) {
+                    } else if (permissionUri.equals(resourcePath)
+                            || request.getPath().startsWith(permissionUri + "/")) {
                         return permissionsApiHandler(
                                 request.getMethod(), resourcePath, data, parameters);
+                    } else if (isPolicyPath(resourcePath)) {
+                        return policiesApiHandler(
+                                request.getMethod(), resourcePath, data, parameters);
                     } else if (databaseUri.equals(request.getPath())
                             || request.getPath().contains(databaseUri + "?")) {
                         return databasesApiHandler(restAuthParameter.method(), data, parameters);
@@ -1026,20 +1091,57 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
                         }
                     });
         }
-        List<Predicate> rowFilters = rowFilterAuthHandler.get(identifier.getFullName());
+        List<Predicate> rowFilters =
+                new ArrayList<>(
+                        rowFilterAuthHandler.getOrDefault(
+                                identifier.getFullName(), Collections.emptyList()));
         Map<String, Transform> columnMasking =
-                columnMaskingAuthHandler.get(identifier.getFullName());
+                new HashMap<>(
+                        columnMaskingAuthHandler.getOrDefault(
+                                identifier.getFullName(), Collections.emptyMap()));
+        for (Map.Entry<PolicyKey, DataPolicy> entry : policyStore.entrySet()) {
+            if (!entry.getKey().tableUuid.equals(metadata.uuid())
+                    || !appliesToQueryPrincipal(entry.getValue())) {
+                continue;
+            }
+            DataPolicy policy = entry.getValue();
+            RowFilter rowFilter = policy.getRowFilter();
+            if (rowFilter != null) {
+                Predicate predicate;
+                try {
+                    predicate = compileRowFilter(metadata.schema(), rowFilter);
+                } catch (RuntimeException e) {
+                    throw new Catalog.TableNoPermissionException(identifier);
+                }
+                if (predicate == null) {
+                    throw new Catalog.TableNoPermissionException(identifier);
+                }
+                rowFilters.add(predicate);
+                continue;
+            }
+            ColumnMask columnMask = policy.getColumnMask();
+            Transform transform;
+            try {
+                transform = compileColumnMask(metadata.schema(), columnMask);
+            } catch (RuntimeException e) {
+                throw new Catalog.TableNoPermissionException(identifier);
+            }
+            if (transform == null || columnMasking.containsKey(columnMask.getOnColumn())) {
+                throw new Catalog.TableNoPermissionException(identifier);
+            }
+            columnMasking.put(columnMask.getOnColumn(), transform);
+        }
 
         // Convert Predicate list to JSON string list
         List<String> filterJsonList = null;
-        if (rowFilters != null) {
+        if (!rowFilters.isEmpty()) {
             filterJsonList =
                     rowFilters.stream().map(JsonSerdeUtil::toFlatJson).collect(Collectors.toList());
         }
 
         // Convert Transform map to JSON string map
         Map<String, String> columnMaskingJsonMap = null;
-        if (columnMasking != null) {
+        if (!columnMasking.isEmpty()) {
             columnMaskingJsonMap =
                     columnMasking.entrySet().stream()
                             .collect(
@@ -1056,6 +1158,13 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
         return mockResponse(response, 200);
     }
 
+    private boolean appliesToQueryPrincipal(DataPolicy policy) {
+        boolean selected = policy.getToPrincipals().stream().anyMatch(queryPrincipals::contains);
+        boolean excluded =
+                policy.getExceptPrincipals().stream().anyMatch(queryPrincipals::contains);
+        return selected && !excluded;
+    }
+
     private MockResponse commitTableHandle(Identifier identifier, String data) throws Exception {
         CommitTableRequest requestBody = RESTApi.fromJson(data, CommitTableRequest.class);
         if (noPermissionTables.contains(identifier.getFullName())) {
@@ -1569,25 +1678,29 @@ private MockResponse tablesHandle(
                     CreateTableRequest requestBody =
                             RESTApi.fromJson(data, CreateTableRequest.class);
                     Identifier identifier = requestBody.getIdentifier();
-                    Schema schema = requestBody.getSchema();
-                    TableMetadata tableMetadata;
-                    if (isObjectTable(schema)) {
-                        tableMetadata = createObjectTable(identifier, schema);
-                    } else {
-                        catalog.createTable(identifier, schema, false);
-                        boolean isExternal =
-                                schema.options() != null
-                                        && schema.options().containsKey(PATH.key());
-                        tableMetadata =
-                                createTableMetadata(
-                                        requestBody.getIdentifier(),
-                                        0L,
-                                        requestBody.getSchema(),
-                                        UUID.randomUUID().toString(),
-                                        isExternal);
+                    synchronized (tableLifecycleLocks.lock(identifier.getFullName())) {
+                        if (tableMetadataStore.containsKey(identifier.getFullName())) {
+                            throw new Catalog.TableAlreadyExistException(identifier);
+                        }
+                        Schema schema = requestBody.getSchema();
+                        TableMetadata tableMetadata;
+                        if (isObjectTable(schema)) {
+                            tableMetadata = createObjectTable(identifier, schema);
+                        } else {
+                            catalog.createTable(identifier, schema, false);
+                            boolean isExternal =
+                                    schema.options() != null
+                                            && schema.options().containsKey(PATH.key());
+                            tableMetadata =
+                                    createTableMetadata(
+                                            requestBody.getIdentifier(),
+                                            0L,
+                                            requestBody.getSchema(),
+                                            UUID.randomUUID().toString(),
+                                            isExternal);
+                        }
+                        tableMetadataStore.put(identifier.getFullName(), tableMetadata);
                     }
-                    tableMetadataStore.put(
-                            requestBody.getIdentifier().getFullName(), tableMetadata);
                     return new MockResponse().setResponseCode(200);
                 default:
                     return new MockResponse().setResponseCode(404);
@@ -1832,20 +1945,29 @@ private MockResponse tableHandle(String method, String data, Identifier identifi
                 alterTableImpl(identifier, requestBody.getChanges());
                 return new MockResponse().setResponseCode(200);
             case "DELETE":
-                if (!tableMetadataStore.containsKey(identifier.getFullName())) {
-                    return new MockResponse().setResponseCode(404);
-                }
-                tableMetadata = tableMetadataStore.get(identifier.getFullName());
-                if (!tableMetadata.isExternal()) {
-                    try {
-                        catalog.dropTable(identifier, false);
-                    } catch (Exception e) {
-                        System.out.println(e.getMessage());
+                synchronized (tableLifecycleLocks.lock(identifier.getFullName())) {
+                    tableMetadata = tableMetadataStore.get(identifier.getFullName());
+                    if (tableMetadata == null) {
+                        return new MockResponse().setResponseCode(404);
+                    }
+                    synchronized (policyLock(tableMetadata.uuid())) {
+                        TableMetadata current = tableMetadataStore.get(identifier.getFullName());
+                        if (current == null || !current.uuid().equals(tableMetadata.uuid())) {
+                            return new MockResponse().setResponseCode(404);
+                        }
+                        if (!current.isExternal()) {
+                            try {
+                                catalog.dropTable(identifier, false);
+                            } catch (Exception e) {
+                                System.out.println(e.getMessage());
+                            }
+                        }
+                        removePolicies(current.uuid());
+                        tableMetadataStore.remove(identifier.getFullName(), current);
+                        tableLatestSnapshotStore.remove(identifier.getFullName());
+                        tablePartitionsStore.remove(identifier.getFullName());
                     }
                 }
-                tableMetadataStore.remove(identifier.getFullName());
-                tableLatestSnapshotStore.remove(identifier.getFullName());
-                tablePartitionsStore.remove(identifier.getFullName());
                 return new MockResponse().setResponseCode(200);
             default:
                 return new MockResponse().setResponseCode(404);
@@ -1855,32 +1977,49 @@ private MockResponse tableHandle(String method, String data, Identifier identifi
     private MockResponse replaceTableHandle(Identifier identifier, String data) throws Exception {
         ReplaceTableRequest requestBody = RESTApi.fromJson(data, ReplaceTableRequest.class);
         Schema newSchema = requestBody.getSchema();
-        if (!tableMetadataStore.containsKey(identifier.getFullName())) {
-            throw new Catalog.TableNotExistException(identifier);
-        }
         TableMetadata tableMetadata = tableMetadataStore.get(identifier.getFullName());
-        if (isFormatTable(tableMetadata.schema().toSchema()) || isFormatTable(newSchema)) {
-            throw new UnsupportedOperationException("replaceTable does not support format tables.");
+        if (tableMetadata == null) {
+            throw new Catalog.TableNotExistException(identifier);
         }
-        catalog.replaceTable(identifier, newSchema, false);
-        TableSchema replacedSchema = catalog.loadTableSchema(identifier);
-        TableMetadata newTableMetadata =
-                createTableMetadata(
-                        identifier,
-                        replacedSchema.id(),
-                        replacedSchema.toSchema(),
-                        tableMetadata.uuid(),
-                        tableMetadata.isExternal());
-        tableMetadataStore.put(identifier.getFullName(), newTableMetadata);
-        FileStoreTable table = (FileStoreTable) catalog.getTable(identifier);
-        Snapshot truncateSnapshot = table.snapshotManager().latestSnapshot();
-        if (truncateSnapshot != null) {
-            tableLatestSnapshotStore.put(
-                    identifier.getFullName(), new TableSnapshot(truncateSnapshot, 0L, 0L, 0L, 0L));
-        } else {
-            tableLatestSnapshotStore.remove(identifier.getFullName());
+        synchronized (policyLock(tableMetadata.uuid())) {
+            TableMetadata current = tableMetadataStore.get(identifier.getFullName());
+            if (current == null || !current.uuid().equals(tableMetadata.uuid())) {
+                throw new Catalog.TableNotExistException(identifier);
+            }
+            TableSchema replacementSchema =
+                    createTableMetadata(
+                                    identifier,
+                                    current.schema().id() + 1,
+                                    newSchema,
+                                    current.uuid(),
+                                    current.isExternal())
+                            .schema();
+            validatePoliciesForSchema(identifier, current.uuid(), replacementSchema);
+            if (isFormatTable(current.schema().toSchema()) || isFormatTable(newSchema)) {
+                throw new UnsupportedOperationException(
+                        "replaceTable does not support format tables.");
+            }
+            catalog.replaceTable(identifier, newSchema, false);
+            TableSchema replacedSchema = catalog.loadTableSchema(identifier);
+            TableMetadata newTableMetadata =
+                    createTableMetadata(
+                            identifier,
+                            replacedSchema.id(),
+                            replacedSchema.toSchema(),
+                            current.uuid(),
+                            current.isExternal());
+            tableMetadataStore.put(identifier.getFullName(), newTableMetadata);
+            FileStoreTable table = (FileStoreTable) catalog.getTable(identifier);
+            Snapshot truncateSnapshot = table.snapshotManager().latestSnapshot();
+            if (truncateSnapshot != null) {
+                tableLatestSnapshotStore.put(
+                        identifier.getFullName(),
+                        new TableSnapshot(truncateSnapshot, 0L, 0L, 0L, 0L));
+            } else {
+                tableLatestSnapshotStore.remove(identifier.getFullName());
+            }
+            tablePartitionsStore.remove(identifier.getFullName());
         }
-        tablePartitionsStore.remove(identifier.getFullName());
         return new MockResponse().setResponseCode(200);
     }
 
@@ -1890,18 +2029,37 @@ private MockResponse renameTableHandle(String data) throws Exception {
         Identifier toTable = requestBody.getDestination();
         if (noPermissionTables.contains(fromTable.getFullName())) {
             throw new Catalog.TableNoPermissionException(fromTable);
-        } else if (tableMetadataStore.containsKey(fromTable.getFullName())) {
-            TableMetadata tableMetadata = tableMetadataStore.get(fromTable.getFullName());
-            if (!isFormatTable(tableMetadata.schema().toSchema()) && !tableMetadata.isExternal()) {
-                catalog.renameTable(requestBody.getSource(), requestBody.getDestination(), false);
-            }
-            if (tableMetadataStore.containsKey(toTable.getFullName())) {
-                throw new Catalog.TableAlreadyExistException(toTable);
+        }
+        Object[] locks =
+                tableLifecycleLocks.ordered(fromTable.getFullName(), toTable.getFullName());
+        synchronized (locks[0]) {
+            synchronized (locks[1]) {
+                TableMetadata observed = tableMetadataStore.get(fromTable.getFullName());
+                if (observed == null) {
+                    throw new Catalog.TableNotExistException(fromTable);
+                }
+                synchronized (policyLock(observed.uuid())) {
+                    TableMetadata current = tableMetadataStore.get(fromTable.getFullName());
+                    if (current == null || !current.uuid().equals(observed.uuid())) {
+                        throw new Catalog.TableNotExistException(fromTable);
+                    }
+                    if (tableMetadataStore.containsKey(toTable.getFullName())) {
+                        throw new Catalog.TableAlreadyExistException(toTable);
+                    }
+                    if (!isFormatTable(current.schema().toSchema()) && !current.isExternal()) {
+                        catalog.renameTable(fromTable, toTable, false);
+                    }
+                    TableMetadata renamedMetadata =
+                            createTableMetadata(
+                                    toTable,
+                                    current.schema().id(),
+                                    current.schema().toSchema(),
+                                    current.uuid(),
+                                    current.isExternal());
+                    tableMetadataStore.remove(fromTable.getFullName(), current);
+                    tableMetadataStore.put(toTable.getFullName(), renamedMetadata);
+                }
             }
-            tableMetadataStore.remove(fromTable.getFullName());
-            tableMetadataStore.put(toTable.getFullName(), tableMetadata);
-        } else {
-            throw new Catalog.TableNotExistException(fromTable);
         }
         return new MockResponse().setResponseCode(200);
     }
@@ -2821,45 +2979,52 @@ private MockResponse renameViewHandle(String data) throws Exception {
     protected void alterTableImpl(Identifier identifier, List<SchemaChange> changes)
             throws Catalog.TableNotExistException, Catalog.ColumnAlreadyExistException,
                     Catalog.ColumnNotExistException {
-        if (tableMetadataStore.containsKey(identifier.getFullName())) {
-            TableMetadata tableMetadata = tableMetadataStore.get(identifier.getFullName());
-            try {
-                TableSchema schema = tableMetadata.schema();
-                if (isFormatTable(schema.toSchema())) {
-                    TableSchema newSchema =
+        TableMetadata tableMetadata = tableMetadataStore.get(identifier.getFullName());
+        if (tableMetadata != null) {
+            synchronized (policyLock(tableMetadata.uuid())) {
+                TableMetadata current = tableMetadataStore.get(identifier.getFullName());
+                if (current == null || !current.uuid().equals(tableMetadata.uuid())) {
+                    throw new Catalog.TableNotExistException(identifier);
+                }
+                try {
+                    TableSchema schema = current.schema();
+                    TableSchema candidateSchema =
                             SchemaManager.generateTableSchema(
                                     schema,
                                     changes,
                                     new LazyField<>(() -> false),
                                     new LazyField<>(() -> identifier));
+                    validatePoliciesForSchema(identifier, current.uuid(), candidateSchema);
+                    if (isFormatTable(schema.toSchema())) {
+                        TableMetadata newTableMetadata =
+                                createTableMetadata(
+                                        identifier,
+                                        candidateSchema.id(),
+                                        candidateSchema.toSchema(),
+                                        current.uuid(),
+                                        current.isExternal());
+                        tableMetadataStore.put(identifier.getFullName(), newTableMetadata);
+                        return;
+                    }
+                    catalog.alterTable(identifier, changes, false);
+                    FileStoreTable table = (FileStoreTable) catalog.getTable(identifier);
+                    TableSchema newSchema = table.schema();
                     TableMetadata newTableMetadata =
                             createTableMetadata(
                                     identifier,
                                     newSchema.id(),
                                     newSchema.toSchema(),
-                                    tableMetadata.uuid(),
-                                    tableMetadata.isExternal());
+                                    current.uuid(),
+                                    current.isExternal());
                     tableMetadataStore.put(identifier.getFullName(), newTableMetadata);
-                    return;
+                } catch (Catalog.TableNotExistException
+                        | Catalog.ColumnAlreadyExistException
+                        | Catalog.ColumnNotExistException
+                        | RuntimeException e) {
+                    throw e;
+                } catch (Exception e) {
+                    throw new RuntimeException(e);
                 }
-                catalog.alterTable(identifier, changes, false);
-                FileStoreTable table = (FileStoreTable) catalog.getTable(identifier);
-                TableSchema newSchema = table.schema();
-                TableMetadata newTableMetadata =
-                        createTableMetadata(
-                                identifier,
-                                newSchema.id(),
-                                newSchema.toSchema(),
-                                tableMetadata.uuid(),
-                                tableMetadata.isExternal());
-                tableMetadataStore.put(identifier.getFullName(), newTableMetadata);
-            } catch (Catalog.TableNotExistException
-                    | Catalog.ColumnAlreadyExistException
-                    | Catalog.ColumnNotExistException
-                    | RuntimeException e) {
-                throw e;
-            } catch (Exception e) {
-                throw new RuntimeException(e);
             }
         }
     }
@@ -3134,70 +3299,177 @@ private MockResponse permissionsApiHandler(
             String method, String resourcePath, String data, Map<String, String> parameters)
             throws JsonProcessingException {
         if ("GET".equals(method) && permissionUri.equals(resourcePath)) {
-            List<Permission> filtered =
-                    permissionStore.stream()
-                            .filter(permission -> matchesPermission(permission, parameters))
-                            .collect(Collectors.toList());
+            boolean includeInherited = Boolean.parseBoolean(parameters.get("includeInherited"));
+            PermissionResource target = permissionResource(parameters);
+            MockResponse authorization = validateManagementPermission(target);
+            if (authorization != null) {
+                return authorization;
+            }
+            MockResponse validation = validateResourceAndPrincipal(target, parameters);
+            if (validation != null) {
+                return validation;
+            }
+            List<PermissionAssignment> filtered =
+                    permissionStore.list(target, parameters, includeInherited);
             int start =
                     parameters.containsKey(PAGE_TOKEN)
                             ? Integer.parseInt(parameters.get(PAGE_TOKEN))
                             : 0;
-            int end = Math.min(start + getMaxResults(parameters), filtered.size());
-            List<Permission> page = new ArrayList<>(filtered.subList(start, end));
+            int end = Math.min(start + getPermissionMaxResults(parameters), filtered.size());
+            List<PermissionAssignment> page = new ArrayList<>(filtered.subList(start, end));
             String nextPageToken = end < filtered.size() ? String.valueOf(end) : null;
             return mockResponse(new ListPermissionsResponse(page, nextPageToken), 200);
         }
 
         if ("POST".equals(method) && (permissionUri + "/grant").equals(resourcePath)) {
-            Permission permission =
-                    RESTApi.fromJson(data, GrantPermissionRequest.class).permission();
-            permissionStore.removeIf(existing -> sameIdentity(existing, permission));
-            permissionStore.add(permission);
+            PermissionAssignment assignment =
+                    RESTApi.fromJson(data, GrantPermissionRequest.class).assignment();
+            MockResponse authorization = validateManagementPermission(assignment.getResource());
+            if (authorization != null) {
+                return authorization;
+            }
+            MockResponse validation =
+                    validateResourceAndPrincipal(
+                            assignment.getResource(), assignment.getPrincipal());
+            if (validation != null) {
+                return validation;
+            }
+            permissionStore.put(assignment);
             return new MockResponse().setResponseCode(200);
         }
 
         if ("POST".equals(method) && (permissionUri + "/revoke").equals(resourcePath)) {
             RevokePermissionRequest request = RESTApi.fromJson(data, RevokePermissionRequest.class);
-            boolean removed =
-                    permissionStore.removeIf(
-                            permission ->
-                                    sameIdentity(
-                                            permission,
-                                            new Permission(
-                                                    request.getResourceType(),
-                                                    request.getCatalog(),
-                                                    request.getDatabase(),
-                                                    request.getTable(),
-                                                    request.getFunction(),
-                                                    request.getView(),
-                                                    request.getColumns(),
-                                                    null,
-                                                    null,
-                                                    request.getAccess(),
-                                                    request.getPrincipal(),
-                                                    null)));
-            return removed
-                    ? new MockResponse().setResponseCode(200)
-                    : mockResponse(
-                            new ErrorResponse(
-                                    "PERMISSION",
-                                    request.getPrincipal(),
-                                    "Permission does not exist.",
-                                    404),
-                            404);
+            MockResponse authorization =
+                    validateManagementPermission(request.identity().getResource());
+            if (authorization != null) {
+                return authorization;
+            }
+            MockResponse validation =
+                    validateResourceAndPrincipal(
+                            request.identity().getResource(), request.identity().getPrincipal());
+            if (validation != null) {
+                return validation;
+            }
+            permissionStore.remove(request.identity());
+            return new MockResponse().setResponseCode(200);
         }
 
         return new MockResponse().setResponseCode(404);
     }
 
-    private static boolean matchesPermission(
-            Permission permission, Map<String, String> parameters) {
-        return matches(parameters, "principal", permission.getPrincipal())
-                && matchesResourceType(parameters, permission.getResourceType())
-                && matches(parameters, "database", permission.getDatabase())
-                && matches(parameters, "table", permission.getTable())
-                && matches(parameters, "function", permission.getFunction())
-                && matches(parameters, "view", permission.getView());
+    @Nullable
+    private MockResponse validateResourceAndPrincipal(
+            PermissionResource resource, Map<String, String> parameters) {
+        MockResponse resourceError = validateResource(resource);
+        if (resourceError != null || !parameters.containsKey("principal")) {
+            return resourceError;
+        }
+        return validatePrincipal(
+                new PrincipalRef(
+                        PrincipalType.fromString(parameters.get("principalType")),
+                        parameters.get("principal")));
+    }
+
+    @Nullable
+    private MockResponse validateResourceAndPrincipal(
+            PermissionResource resource, PrincipalRef principal) {
+        MockResponse resourceError = validateResource(resource);
+        return resourceError == null ? validatePrincipal(principal) : resourceError;
+    }
+
+    @Nullable
+    private MockResponse validateResource(PermissionResource resource) {
+        boolean exists;
+        switch (resource.getType()) {
+            case CATALOG:
+                exists = true;
+                break;
+            case DATABASE:
+                exists = databaseStore.containsKey(resource.getDatabase());
+                break;
+            case TABLE:
+                exists =
+                        tableMetadataStore.containsKey(
+                                Identifier.create(resource.getDatabase(), resource.getTable())
+                                        .getFullName());
+                break;
+            case FUNCTION:
+                exists =
+                        functionStore.containsKey(
+                                Identifier.create(resource.getDatabase(), resource.getFunction())
+                                        .getFullName());
+                break;
+            case VIEW:
+                exists =
+                        viewStore.containsKey(
+                                Identifier.create(resource.getDatabase(), resource.getView())
+                                        .getFullName());
+                break;
+            default:
+                exists = false;
+        }
+        return exists
+                ? null
+                : mockResponse(
+                        new ErrorResponse(
+                                resource.getType().name(),
+                                resourceName(resource),
+                                "Permission resource does not exist.",
+                                404),
+                        404);
+    }
+
+    @Nullable
+    private MockResponse validateManagementPermission(PermissionResource resource) {
+        return noManagementPermissionResources.contains(resource)
+                ? mockResponse(
+                        new ErrorResponse(
+                                resource.getType().name(),
+                                resourceName(resource),
+                                "The caller cannot manage permissions on this resource.",
+                                403),
+                        403)
+                : null;
+    }
+
+    @Nullable
+    private MockResponse validatePrincipal(PrincipalRef principal) {
+        return managementPrincipals.contains(principal)
+                ? null
+                : mockResponse(
+                        new ErrorResponse(
+                                "PRINCIPAL",
+                                principal.getId(),
+                                "Permission principal does not exist.",
+                                404),
+                        404);
+    }
+
+    private static String resourceName(PermissionResource resource) {
+        switch (resource.getType()) {
+            case CATALOG:
+                return "catalog";
+            case DATABASE:
+                return resource.getDatabase();
+            case TABLE:
+                return resource.getDatabase() + "." + resource.getTable();
+            case FUNCTION:
+                return resource.getDatabase() + "." + resource.getFunction();
+            case VIEW:
+                return resource.getDatabase() + "." + resource.getView();
+            default:
+                return resource.getType().name();
+        }
+    }
+
+    private static int getPermissionMaxResults(Map<String, String> parameters) {
+        String strMaxResults = parameters.get(MAX_RESULTS);
+        if (strMaxResults == null) {
+            return DEFAULT_MAX_RESULTS;
+        }
+        int maxResults = Integer.parseInt(strMaxResults);
+        return Math.max(1, Math.min(maxResults, ListPermissionsRequest.MAX_PAGE_SIZE));
     }
 
     private static boolean matches(
@@ -3205,32 +3477,399 @@ private static boolean matches(
         return !parameters.containsKey(key) || Objects.equals(parameters.get(key), value);
     }
 
-    private static boolean matchesResourceType(
-            Map<String, String> parameters, ResourceType resourceType) {
-        String filter = parameters.get("resourceType");
-        if (filter == null || filter.equals(resourceType.name())) {
+    private static PermissionResource permissionResource(Map<String, String> parameters) {
+        return new PermissionResource(
+                ResourceType.fromString(parameters.get("resourceType")),
+                parameters.get("database"),
+                parameters.get("table"),
+                parameters.get("function"),
+                parameters.get("view"));
+    }
+
+    private boolean isPolicyPath(String resourcePath) {
+        try {
+            policyPath(resourcePath);
             return true;
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    private MockResponse policiesApiHandler(
+            String method, String resourcePath, String data, Map<String, String> parameters)
+            throws JsonProcessingException {
+        PolicyPath path = policyPath(resourcePath);
+        MockResponse authorization = validateManagementPermission(path.resource);
+        if (authorization != null) {
+            return authorization;
+        }
+        MockResponse resourceError = validateResource(path.resource);
+        if (resourceError != null) {
+            return resourceError;
+        }
+        String tableUuid = tableUuid(path.resource);
+        if ("GET".equals(method) && path.name == null) {
+            if (parameters.containsKey("principal")) {
+                MockResponse principalError =
+                        validatePrincipal(
+                                new PrincipalRef(
+                                        PrincipalType.fromString(parameters.get("principalType")),
+                                        parameters.get("principal")));
+                if (principalError != null) {
+                    return principalError;
+                }
+            }
+            List<DataPolicy> filtered =
+                    policyStore.entrySet().stream()
+                            .filter(entry -> entry.getKey().tableUuid.equals(tableUuid))
+                            .map(entry -> withResource(entry.getValue(), path.resource))
+                            .filter(policy -> matchesPolicy(policy, parameters))
+                            .sorted(Comparator.comparing(DataPolicy::getName))
+                            .collect(Collectors.toList());
+            int start =
+                    parameters.containsKey(PAGE_TOKEN)
+                            ? Integer.parseInt(parameters.get(PAGE_TOKEN))
+                            : 0;
+            int end = Math.min(start + getPermissionMaxResults(parameters), filtered.size());
+            String nextPageToken = end < filtered.size() ? String.valueOf(end) : null;
+            return mockResponse(
+                    new ListPoliciesResponse(
+                            new ArrayList<>(filtered.subList(start, end)), nextPageToken),
+                    200);
+        }
+
+        if ("GET".equals(method) && path.name != null) {
+            DataPolicy policy = findPolicy(path.resource, path.name);
+            return policy == null
+                    ? mockResponse(
+                            new ErrorResponse(
+                                    ErrorResponse.RESOURCE_TYPE_POLICY,
+                                    path.name,
+                                    "Policy does not exist.",
+                                    404),
+                            404)
+                    : mockResponse(new GetPolicyResponse(policy), 200);
+        }
+
+        if ("POST".equals(method) && path.name == null) {
+            DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
+            synchronized (policyLock(tableUuid)) {
+                MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
+                if (targetError != null) {
+                    return targetError;
+                }
+                MockResponse validation = validatePolicy(policy);
+                if (validation != null) {
+                    return validation;
+                }
+                PolicyKey key = new PolicyKey(tableUuid, policy.getName());
+                if (policyStore.putIfAbsent(key, policy) != null) {
+                    return mockResponse(
+                            new ErrorResponse(
+                                    ErrorResponse.RESOURCE_TYPE_POLICY,
+                                    policy.getName(),
+                                    "Policy already exists.",
+                                    409),
+                            409);
+                }
+            }
+            return new MockResponse().setResponseCode(200);
         }
-        if (ResourceType.CATALOG.name().equals(filter)) {
-            return resourceType == ResourceType.CATALOG_ALL;
+
+        if ("PUT".equals(method) && path.name != null) {
+            DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
+            checkArgument(
+                    path.name.equals(policy.getName()),
+                    "Policy name in the path and request body must match.");
+            synchronized (policyLock(tableUuid)) {
+                MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
+                if (targetError != null) {
+                    return targetError;
+                }
+                MockResponse validation = validatePolicy(policy);
+                if (validation != null) {
+                    return validation;
+                }
+                policyStore.put(new PolicyKey(tableUuid, path.name), policy);
+            }
+            return new MockResponse().setResponseCode(200);
         }
-        if (ResourceType.DATABASE.name().equals(filter)) {
-            return resourceType == ResourceType.DATABASE_ALL;
+
+        if ("DELETE".equals(method) && path.name != null) {
+            DataPolicy existing;
+            synchronized (policyLock(tableUuid)) {
+                MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
+                if (targetError != null) {
+                    return targetError;
+                }
+                existing = policyStore.remove(new PolicyKey(tableUuid, path.name));
+            }
+            if (existing == null) {
+                return mockResponse(
+                        new ErrorResponse(
+                                ErrorResponse.RESOURCE_TYPE_POLICY,
+                                path.name,
+                                "Policy does not exist.",
+                                404),
+                        404);
+            }
+            return new MockResponse().setResponseCode(200);
         }
-        return ResourceType.TABLE.name().equals(filter)
-                && (resourceType == ResourceType.COLUMN
-                        || resourceType == ResourceType.ROW_FILTER
-                        || resourceType == ResourceType.COLUMN_MASKING);
+
+        return new MockResponse().setResponseCode(404);
     }
 
-    private static boolean sameIdentity(Permission left, Permission right) {
-        return left.getResourceType() == right.getResourceType()
-                && Objects.equals(left.getDatabase(), right.getDatabase())
-                && Objects.equals(left.getTable(), right.getTable())
-                && Objects.equals(left.getFunction(), right.getFunction())
-                && Objects.equals(left.getView(), right.getView())
-                && left.getAccess().equalsIgnoreCase(right.getAccess())
-                && left.getPrincipal().equals(right.getPrincipal());
+    @Nullable
+    private MockResponse validatePolicy(DataPolicy policy) {
+        Identifier identifier =
+                Identifier.create(
+                        policy.getResource().getDatabase(), policy.getResource().getTable());
+        TableMetadata metadata = tableMetadataStore.get(identifier.getFullName());
+        if (!CoreOptions.fromMap(metadata.schema().options()).queryAuthEnabled()) {
+            return mockResponse(
+                    new ErrorResponse(
+                            ErrorResponse.RESOURCE_TYPE_TABLE,
+                            identifier.getFullName(),
+                            "Data policies require the target table option query-auth.enabled=true.",
+                            409),
+                    409);
+        }
+        for (PrincipalRef principal : policy.getToPrincipals()) {
+            MockResponse principalError = validatePrincipal(principal);
+            if (principalError != null) {
+                return principalError;
+            }
+        }
+        for (PrincipalRef principal : policy.getExceptPrincipals()) {
+            MockResponse principalError = validatePrincipal(principal);
+            if (principalError != null) {
+                return principalError;
+            }
+        }
+
+        RowFilter rowFilter = policy.getRowFilter();
+        String functionName =
+                rowFilter == null
+                        ? policy.getColumnMask().getFunctionName()
+                        : rowFilter.getFunctionName();
+        boolean functionExists =
+                rowFilter == null
+                        ? columnMaskPolicyFunctions.containsKey(functionName)
+                        : rowFilterPolicyFunctions.containsKey(functionName);
+        if (!functionExists) {
+            return mockResponse(
+                    new ErrorResponse(
+                            ErrorResponse.RESOURCE_TYPE_FUNCTION,
+                            functionName,
+                            "Policy function does not exist.",
+                            404),
+                    404);
+        }
+
+        Set<String> columns = new HashSet<>(metadata.schema().fieldNames());
+        ColumnMask columnMask = policy.getColumnMask();
+        if (columnMask != null) {
+            checkArgument(
+                    columns.contains(columnMask.getOnColumn()),
+                    "Policy column %s does not exist in table %s.",
+                    columnMask.getOnColumn(),
+                    identifier.getFullName());
+        }
+        (rowFilter == null ? columnMask.getFunctionArguments() : rowFilter.getFunctionArguments())
+                .stream()
+                        .filter(argument -> argument.getColumn() != null)
+                        .forEach(
+                                argument ->
+                                        checkArgument(
+                                                columns.contains(argument.getColumn()),
+                                                "Policy argument column %s does not exist in table %s.",
+                                                argument.getColumn(),
+                                                identifier.getFullName()));
+        if (rowFilter == null) {
+            checkArgument(
+                    compileColumnMask(metadata.schema(), columnMask) != null,
+                    "Policy function %s returned no column transform.",
+                    functionName);
+        } else {
+            checkArgument(
+                    compileRowFilter(metadata.schema(), rowFilter) != null,
+                    "Policy function %s returned no row predicate.",
+                    functionName);
+        }
+        return null;
+    }
+
+    @Nullable
+    private DataPolicy findPolicy(PermissionResource resource, String name) {
+        DataPolicy policy = policyStore.get(new PolicyKey(tableUuid(resource), name));
+        return policy == null ? null : withResource(policy, resource);
+    }
+
+    private String tableUuid(PermissionResource resource) {
+        return tableMetadataStore
+                .get(Identifier.create(resource.getDatabase(), resource.getTable()).getFullName())
+                .uuid();
+    }
+
+    private Object policyLock(String tableUuid) {
+        return tablePolicyLocks.computeIfAbsent(tableUuid, ignored -> new Object());
+    }
+
+    @Nullable
+    private MockResponse validatePolicyTableVersion(
+            PermissionResource resource, String expectedTableUuid) {
+        MockResponse resourceError = validateResource(resource);
+        if (resourceError != null) {
+            return resourceError;
+        }
+        String currentTableUuid = tableUuid(resource);
+        return expectedTableUuid.equals(currentTableUuid)
+                ? null
+                : mockResponse(
+                        new ErrorResponse(
+                                ErrorResponse.RESOURCE_TYPE_TABLE,
+                                resourceName(resource),
+                                "Table changed while managing its policies.",
+                                409),
+                        409);
+    }
+
+    private static DataPolicy withResource(DataPolicy policy, PermissionResource resource) {
+        return policy.getRowFilter() == null
+                ? DataPolicy.columnMask(
+                        resource,
+                        policy.getName(),
+                        policy.getColumnMask(),
+                        policy.getToPrincipals(),
+                        policy.getExceptPrincipals(),
+                        policy.getComment())
+                : DataPolicy.rowFilter(
+                        resource,
+                        policy.getName(),
+                        policy.getRowFilter(),
+                        policy.getToPrincipals(),
+                        policy.getExceptPrincipals(),
+                        policy.getComment());
+    }
+
+    private Predicate compileRowFilter(TableSchema schema, RowFilter rowFilter) {
+        BiFunction<TableSchema, RowFilter, Predicate> compiler =
+                rowFilterPolicyFunctions.get(rowFilter.getFunctionName());
+        return compiler == null ? null : compiler.apply(schema, rowFilter);
+    }
+
+    private Transform compileColumnMask(TableSchema schema, ColumnMask columnMask) {
+        BiFunction<TableSchema, ColumnMask, Transform> compiler =
+                columnMaskPolicyFunctions.get(columnMask.getFunctionName());
+        return compiler == null ? null : compiler.apply(schema, columnMask);
+    }
+
+    private void removePolicies(@Nullable String tableUuid) {
+        if (tableUuid != null) {
+            policyStore.keySet().removeIf(key -> key.tableUuid.equals(tableUuid));
+        }
+    }
+
+    private void validatePoliciesForSchema(
+            Identifier identifier, @Nullable String tableUuid, TableSchema schema) {
+        if (tableUuid == null) {
+            return;
+        }
+        List<DataPolicy> policies =
+                policyStore.entrySet().stream()
+                        .filter(entry -> entry.getKey().tableUuid.equals(tableUuid))
+                        .map(Map.Entry::getValue)
+                        .collect(Collectors.toList());
+        if (policies.isEmpty()) {
+            return;
+        }
+        checkArgument(
+                CoreOptions.fromMap(schema.options()).queryAuthEnabled(),
+                "Cannot disable query-auth.enabled while table %s has data policies.",
+                identifier.getFullName());
+
+        Set<String> columns = new HashSet<>(schema.fieldNames());
+        for (DataPolicy policy : policies) {
+            ColumnMask columnMask = policy.getColumnMask();
+            if (columnMask != null) {
+                checkArgument(
+                        columns.contains(columnMask.getOnColumn()),
+                        "Cannot remove or rename policy column %s from table %s.",
+                        columnMask.getOnColumn(),
+                        identifier.getFullName());
+            }
+            (policy.getRowFilter() == null
+                            ? columnMask.getFunctionArguments()
+                            : policy.getRowFilter().getFunctionArguments())
+                    .stream()
+                            .filter(argument -> argument.getColumn() != null)
+                            .forEach(
+                                    argument ->
+                                            checkArgument(
+                                                    columns.contains(argument.getColumn()),
+                                                    "Cannot remove or rename policy argument column %s from table %s.",
+                                                    argument.getColumn(),
+                                                    identifier.getFullName()));
+            if (policy.getRowFilter() == null) {
+                checkArgument(
+                        compileColumnMask(schema, columnMask) != null,
+                        "Column mask function %s is invalid for the changed schema.",
+                        columnMask.getFunctionName());
+            } else {
+                checkArgument(
+                        compileRowFilter(schema, policy.getRowFilter()) != null,
+                        "Row filter function %s is invalid for the changed schema.",
+                        policy.getRowFilter().getFunctionName());
+            }
+        }
+    }
+
+    private static boolean matchesPolicy(DataPolicy policy, Map<String, String> parameters) {
+        if (!matches(parameters, "name", policy.getName())
+                || !matches(parameters, "type", policy.type().name())) {
+            return false;
+        }
+        if (!parameters.containsKey("principal")) {
+            return true;
+        }
+        PrincipalRef principal =
+                new PrincipalRef(
+                        PrincipalType.fromString(parameters.get("principalType")),
+                        parameters.get("principal"));
+        return policy.getToPrincipals().contains(principal)
+                && !policy.getExceptPrincipals().contains(principal);
+    }
+
+    private PolicyPath policyPath(String resourcePath) {
+        String catalogBase = StringUtils.substringBeforeLast(permissionUri, "/");
+        checkArgument(resourcePath.startsWith(catalogBase + "/"), "Not a catalog policy path.");
+        String[] parts = resourcePath.substring(catalogBase.length() + 1).split("/");
+        if (parts.length >= 5
+                && "databases".equals(parts[0])
+                && "tables".equals(parts[2])
+                && "policies".equals(parts[4])) {
+            checkArgument(parts.length <= 6, "Invalid table policy path.");
+            return new PolicyPath(
+                    new PermissionResource(
+                            ResourceType.TABLE,
+                            RESTUtil.decodeString(parts[1]),
+                            RESTUtil.decodeString(parts[3]),
+                            null,
+                            null),
+                    parts.length == 6 ? RESTUtil.decodeString(parts[5]) : null);
+        }
+        throw new IllegalArgumentException("Not a policy path.");
+    }
+
+    private static class PolicyPath {
+
+        private final PermissionResource resource;
+        @Nullable private final String name;
+
+        private PolicyPath(PermissionResource resource, @Nullable String name) {
+            this.resource = resource;
+            this.name = name;
+        }
     }
 
     private <T> String getNextPageTokenForEntities(List<T> entities, Integer maxResults) {
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
new file mode 100644
index 000000000000..5978f860facb
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
@@ -0,0 +1,155 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.management.PermissionAccess;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.ResourceType;
+
+import java.util.Comparator;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.stream.Collectors;
+
+/** Atomic permission assignment store for the REST catalog test server. */
+final class RESTPermissionStore {
+
+    private final Map<PermissionIdentity, PermissionAssignment> assignments =
+            new ConcurrentHashMap<>();
+
+    void put(PermissionAssignment assignment) {
+        assignments.put(PermissionIdentity.fromAssignment(assignment), assignment);
+    }
+
+    void remove(PermissionIdentity identity) {
+        assignments.remove(identity);
+    }
+
+    List<PermissionAssignment> list(
+            PermissionResource target, Map<String, String> parameters, boolean includeInherited) {
+        return assignments.values().stream()
+                .filter(assignment -> matchesSource(assignment, parameters, includeInherited))
+                .filter(assignment -> !includeInherited || isEffectiveOn(assignment, target))
+                .map(
+                        assignment ->
+                                includeInherited
+                                        ? effectiveAssignment(assignment, target)
+                                        : assignment)
+                .filter(assignment -> matches(parameters, "scope", assignment.getScope().name()))
+                .sorted(Comparator.comparing(RESTPermissionStore::sortKey))
+                .collect(Collectors.toList());
+    }
+
+    private static boolean matchesSource(
+            PermissionAssignment assignment,
+            Map<String, String> parameters,
+            boolean includeInherited) {
+        PermissionResource resource = assignment.getResource();
+        return matches(parameters, "principal", assignment.getPrincipal().getId())
+                && matches(parameters, "principalType", assignment.getPrincipal().getType().name())
+                && matches(parameters, "access", assignment.getAccess())
+                && (includeInherited
+                        || (matches(parameters, "resourceType", resource.getType().name())
+                                && matches(parameters, "database", resource.getDatabase())
+                                && matches(parameters, "table", resource.getTable())
+                                && matches(parameters, "function", resource.getFunction())
+                                && matches(parameters, "view", resource.getView())));
+    }
+
+    private static boolean isEffectiveOn(
+            PermissionAssignment assignment, PermissionResource target) {
+        PermissionResource source = assignment.getResource();
+        if (source.equals(target)) {
+            return true;
+        }
+        if (!isAccessApplicableToTarget(assignment.getAccess(), target)) {
+            return false;
+        }
+        if (assignment.getScope() == PermissionScope.SELF) {
+            return false;
+        }
+        if (source.getType() == ResourceType.CATALOG) {
+            return target.getType() != ResourceType.CATALOG;
+        }
+        return source.getType() == ResourceType.DATABASE
+                && target.getType() != ResourceType.CATALOG
+                && target.getType() != ResourceType.DATABASE
+                && Objects.equals(source.getDatabase(), target.getDatabase());
+    }
+
+    private static boolean isAccessApplicableToTarget(String access, PermissionResource target) {
+        try {
+            PermissionAccess.canonicalize(target, PermissionScope.SELF, access);
+            return true;
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    private static PermissionAssignment effectiveAssignment(
+            PermissionAssignment assignment, PermissionResource target) {
+        if (assignment.getResource().equals(target)) {
+            return assignment;
+        }
+        return new PermissionAssignment(
+                target,
+                PermissionScope.SELF,
+                assignment.getAccess(),
+                assignment.getPrincipal(),
+                assignment.getExpireTime(),
+                assignment.getResource());
+    }
+
+    private static boolean matches(Map<String, String> parameters, String key, String value) {
+        return !parameters.containsKey(key) || Objects.equals(parameters.get(key), value);
+    }
+
+    private static String sortKey(PermissionAssignment assignment) {
+        PermissionResource source =
+                assignment.getInheritedFrom() == null
+                        ? assignment.getResource()
+                        : assignment.getInheritedFrom();
+        return source.getType().name()
+                + '\0'
+                + value(source.getDatabase())
+                + '\0'
+                + value(source.getTable())
+                + '\0'
+                + value(source.getFunction())
+                + '\0'
+                + value(source.getView())
+                + '\0'
+                + assignment.getScope().name()
+                + '\0'
+                + assignment.getAccess()
+                + '\0'
+                + assignment.getPrincipal().getType().name()
+                + '\0'
+                + assignment.getPrincipal().getId();
+    }
+
+    private static String value(String value) {
+        return value == null ? "" : value;
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
new file mode 100644
index 000000000000..16b9fd4c14f4
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
+import org.apache.paimon.management.ResourceType;
+
+import org.junit.jupiter.api.Test;
+
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.IntStream;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/** Tests atomic replacement and effective-view filtering in {@link RESTPermissionStore}. */
+class RESTPermissionStoreTest {
+
+    private static final PrincipalRef ANALYST = new PrincipalRef(PrincipalType.ROLE, "analyst");
+
+    @Test
+    void testConcurrentGrantReplacesTheSameIdentity() {
+        RESTPermissionStore store = new RESTPermissionStore();
+        PermissionResource table = tableResource();
+
+        IntStream.range(0, 1000)
+                .parallel()
+                .forEach(
+                        i ->
+                                store.put(
+                                        new PermissionAssignment(
+                                                table,
+                                                PermissionScope.SELF,
+                                                "SELECT",
+                                                ANALYST,
+                                                Instant.ofEpochSecond(i).toString(),
+                                                null)));
+
+        assertThat(store.list(table, tableParameters(), false)).hasSize(1);
+    }
+
+    @Test
+    void testScopeFilterAppliesToInheritedEffectiveView() {
+        RESTPermissionStore store = new RESTPermissionStore();
+        PermissionResource catalog =
+                new PermissionResource(ResourceType.CATALOG, null, null, null, null);
+        store.put(
+                new PermissionAssignment(
+                        catalog, PermissionScope.DESCENDANTS, "SELECT", ANALYST, null, null));
+        Map<String, String> parameters = tableParameters();
+        parameters.put("scope", "SELF");
+
+        List<PermissionAssignment> assignments = store.list(tableResource(), parameters, true);
+
+        assertThat(assignments).hasSize(1);
+        assertThat(assignments.get(0).getScope()).isEqualTo(PermissionScope.SELF);
+        assertThat(assignments.get(0).getInheritedFrom()).isEqualTo(catalog);
+    }
+
+    @Test
+    void testIncludingInheritedAlsoKeepsDirectDescendantsAssignment() {
+        RESTPermissionStore store = new RESTPermissionStore();
+        PermissionResource catalog =
+                new PermissionResource(ResourceType.CATALOG, null, null, null, null);
+        store.put(
+                new PermissionAssignment(
+                        catalog, PermissionScope.DESCENDANTS, "SELECT", ANALYST, null, null));
+        Map<String, String> parameters = new HashMap<>();
+        parameters.put("resourceType", "CATALOG");
+
+        List<PermissionAssignment> assignments = store.list(catalog, parameters, true);
+
+        assertThat(assignments).hasSize(1);
+        assertThat(assignments.get(0).getScope()).isEqualTo(PermissionScope.DESCENDANTS);
+        assertThat(assignments.get(0).getInheritedFrom()).isNull();
+    }
+
+    private static PermissionResource tableResource() {
+        return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
+    }
+
+    private static Map<String, String> tableParameters() {
+        Map<String, String> parameters = new HashMap<>();
+        parameters.put("resourceType", "TABLE");
+        parameters.put("database", "sales");
+        parameters.put("table", "orders");
+        return parameters;
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
index e3979c437a35..8f97380f17f0 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
@@ -18,9 +18,13 @@
 
 package org.apache.paimon.rest;
 
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.ResourceType;
+
 import org.junit.Test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 /** Test for {@link ResourcePaths}. */
 public class ResourcePathsTest {
@@ -39,4 +43,29 @@ public void testUrlEncode() {
                 "/v1/paimon%2Faaaa/databases/test_db/tables/test_table%24snapshot",
                 resourcePaths.table(database, objectName));
     }
+
+    @Test
+    public void testPermissionManagementUsesPrefix() {
+        ResourcePaths resourcePaths = new ResourcePaths("catalog/id");
+        assertEquals("/v1/catalog%2Fid/permissions", resourcePaths.permissions());
+        assertEquals("/v1/catalog%2Fid/permissions/grant", resourcePaths.grantPermission());
+        assertEquals("/v1/catalog%2Fid/permissions/revoke", resourcePaths.revokePermission());
+    }
+
+    @Test
+    public void testPoliciesAreNestedUnderAttachmentResource() {
+        ResourcePaths paths = new ResourcePaths("catalog/id");
+        PermissionResource catalog =
+                new PermissionResource(ResourceType.CATALOG, null, null, null, null);
+        PermissionResource database =
+                new PermissionResource(ResourceType.DATABASE, "sales db", null, null, null);
+        PermissionResource table =
+                new PermissionResource(ResourceType.TABLE, "sales db", "orders/all", null, null);
+
+        assertThrows(IllegalArgumentException.class, () -> paths.policies(catalog));
+        assertThrows(IllegalArgumentException.class, () -> paths.policies(database));
+        assertEquals(
+                "/v1/catalog%2Fid/databases/sales+db/tables/orders%2Fall/policies/mask+email",
+                paths.policy(table, "mask email"));
+    }
 }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/TableLifecycleLocks.java b/paimon-core/src/test/java/org/apache/paimon/rest/TableLifecycleLocks.java
new file mode 100644
index 000000000000..450e9883ff3b
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/TableLifecycleLocks.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/** Stable, deadlock-ordered locks for table-name lifecycle operations in the test server. */
+final class TableLifecycleLocks {
+
+    private final Map<String, Object> locks = new ConcurrentHashMap<>();
+
+    Object lock(String tableName) {
+        return locks.computeIfAbsent(tableName, ignored -> new Object());
+    }
+
+    Object[] ordered(String left, String right) {
+        return left.compareTo(right) <= 0
+                ? new Object[] {lock(left), lock(right)}
+                : new Object[] {lock(right), lock(left)};
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
index 02c3a90a94bc..93b8376e6ed3 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
@@ -29,18 +29,22 @@
 import org.apache.paimon.spark.procedure.CreateBranchProcedure;
 import org.apache.paimon.spark.procedure.CreateFunctionProcedure;
 import org.apache.paimon.spark.procedure.CreateGlobalIndexProcedure;
+import org.apache.paimon.spark.procedure.CreateOrReplacePolicyProcedure;
+import org.apache.paimon.spark.procedure.CreatePolicyProcedure;
 import org.apache.paimon.spark.procedure.CreateTagFromTimestampProcedure;
 import org.apache.paimon.spark.procedure.CreateTagProcedure;
 import org.apache.paimon.spark.procedure.DeleteBranchProcedure;
 import org.apache.paimon.spark.procedure.DeleteTagProcedure;
 import org.apache.paimon.spark.procedure.DropFunctionProcedure;
 import org.apache.paimon.spark.procedure.DropGlobalIndexProcedure;
+import org.apache.paimon.spark.procedure.DropPolicyProcedure;
 import org.apache.paimon.spark.procedure.ExpirePartitionsProcedure;
 import org.apache.paimon.spark.procedure.ExpireSnapshotsProcedure;
 import org.apache.paimon.spark.procedure.ExpireTagsProcedure;
 import org.apache.paimon.spark.procedure.FastForwardProcedure;
 import org.apache.paimon.spark.procedure.GrantPermissionProcedure;
 import org.apache.paimon.spark.procedure.ListPermissionsProcedure;
+import org.apache.paimon.spark.procedure.ListPoliciesProcedure;
 import org.apache.paimon.spark.procedure.MarkPartitionDoneProcedure;
 import org.apache.paimon.spark.procedure.MaterializeDeletionVectorsProcedure;
 import org.apache.paimon.spark.procedure.MergeBranchProcedure;
@@ -140,6 +144,10 @@ private static Map<String, Supplier<ProcedureBuilder>> initProcedureBuilders() {
         procedureBuilders.put("grant_permission", GrantPermissionProcedure::builder);
         procedureBuilders.put("revoke_permission", RevokePermissionProcedure::builder);
         procedureBuilders.put("list_permissions", ListPermissionsProcedure::builder);
+        procedureBuilders.put("create_policy", CreatePolicyProcedure::builder);
+        procedureBuilders.put("create_or_replace_policy", CreateOrReplacePolicyProcedure::builder);
+        procedureBuilders.put("drop_policy", DropPolicyProcedure::builder);
+        procedureBuilders.put("list_policies", ListPoliciesProcedure::builder);
         return procedureBuilders.build();
     }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
index f869a9555cb4..4933831f6a62 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
@@ -20,31 +20,28 @@
 
 import org.apache.paimon.catalog.Catalog;
 import org.apache.paimon.catalog.DelegateCatalog;
-import org.apache.paimon.management.ColumnMask;
-import org.apache.paimon.management.ColumnSelection;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
-import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.rest.RESTCatalog;
 import org.apache.paimon.spark.catalog.WithPaimonCatalog;
 
-import org.apache.spark.sql.catalyst.util.ArrayData;
-import org.apache.spark.sql.catalyst.util.MapData;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
 
 import javax.annotation.Nullable;
 
-import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
 import java.util.Locale;
-import java.util.Map;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Shared REST catalog lookup and argument validation for permission procedures. */
+/** Shared REST catalog lookup and argument validation for management procedures. */
 abstract class BasePermissionProcedure extends BaseProcedure {
 
     protected BasePermissionProcedure(TableCatalog tableCatalog) {
@@ -52,6 +49,14 @@ protected BasePermissionProcedure(TableCatalog tableCatalog) {
     }
 
     protected PermissionManagement permissionManagement() {
+        return restCatalog().permissionManagement();
+    }
+
+    protected PolicyManagement policyManagement() {
+        return restCatalog().policyManagement();
+    }
+
+    private RESTCatalog restCatalog() {
         checkArgument(
                 tableCatalog() instanceof WithPaimonCatalog,
                 "Catalog '%s' is not a Paimon catalog.",
@@ -60,189 +65,66 @@ protected PermissionManagement permissionManagement() {
                 DelegateCatalog.rootCatalog(((WithPaimonCatalog) tableCatalog()).paimonCatalog());
         checkArgument(
                 root instanceof RESTCatalog,
-                "Catalog '%s' does not support permission management.",
+                "Catalog '%s' does not support permission or policy management.",
                 tableCatalog().name());
-        return ((RESTCatalog) root).permissionManagement();
+        return (RESTCatalog) root;
     }
 
-    protected static Permission permission(
+    protected static PermissionAssignment assignment(
             ResourceType resourceType,
             String access,
+            PrincipalType principalType,
             String principal,
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
-            @Nullable ArrayData columnNames,
-            @Nullable ArrayData excludedColumnNames,
-            @Nullable String rowFilter,
-            @Nullable MapData columnMasking,
+            @Nullable String scope,
             @Nullable String expireTime) {
-        database = emptyToNull(database);
-        table = emptyToNull(table);
-        function = emptyToNull(function);
-        view = emptyToNull(view);
-        access = requiredUpperCase(access, "access");
-        checkPrincipal(principal);
-        validateResource(resourceType, database, table, function, view);
-
-        List<String> included = toStrings(columnNames, "column_names");
-        List<String> excluded = toStrings(excludedColumnNames, "excluded_column_names");
-        checkArgument(
-                included == null || excluded == null,
-                "Only one of column_names and excluded_column_names may be specified.");
-        ColumnSelection columns =
-                included == null && excluded == null
-                        ? null
-                        : new ColumnSelection(included, excluded);
-
-        rowFilter = emptyToNull(rowFilter);
-        Map<String, ColumnMask> masks = toColumnMasks(columnMasking);
-        validatePolicy(resourceType, access, columns, rowFilter, masks, expireTime);
-
-        return new Permission(
-                resourceType,
-                null,
-                database,
-                table,
-                function,
-                view,
-                columns,
-                rowFilter == null ? null : new RowFilter(rowFilter, null),
-                masks,
+        return new PermissionAssignment(
+                resource(resourceType, database, table, function, view),
+                scope(scope),
                 access,
-                principal,
-                emptyToNull(expireTime));
+                new PrincipalRef(principalType, principal),
+                emptyToNull(expireTime),
+                null);
     }
 
-    protected static Permission revokePermission(
+    protected static PermissionIdentity identity(
             ResourceType resourceType,
             String access,
+            PrincipalType principalType,
             String principal,
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
-            @Nullable String view) {
-        database = emptyToNull(database);
-        table = emptyToNull(table);
-        function = emptyToNull(function);
-        view = emptyToNull(view);
-        validateResource(resourceType, database, table, function, view);
-        checkPrincipal(principal);
-        return new Permission(
-                resourceType,
-                null,
-                database,
-                table,
-                function,
-                view,
-                null,
-                null,
-                null,
-                requiredUpperCase(access, "access"),
-                principal,
-                null);
+            @Nullable String view,
+            @Nullable String scope) {
+        return new PermissionIdentity(
+                resource(resourceType, database, table, function, view),
+                scope(scope),
+                access,
+                new PrincipalRef(principalType, principal));
     }
 
-    private static void validateResource(
+    protected static PermissionResource resource(
             ResourceType resourceType,
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
             @Nullable String view) {
-        switch (resourceType) {
-            case CATALOG:
-            case CATALOG_ALL:
-                checkArgument(
-                        database == null && table == null && function == null && view == null,
-                        "%s resource cannot specify database, table, function, or view.",
-                        resourceType);
-                break;
-            case DATABASE:
-            case DATABASE_ALL:
-                checkArgument(database != null, "%s resource requires database.", resourceType);
-                checkArgument(
-                        table == null && function == null && view == null,
-                        "%s resource cannot specify table, function, or view.",
-                        resourceType);
-                break;
-            case TABLE:
-            case COLUMN:
-            case ROW_FILTER:
-            case COLUMN_MASKING:
-                checkArgument(
-                        database != null && table != null,
-                        "%s resource requires database and table.",
-                        resourceType);
-                checkArgument(
-                        function == null && view == null,
-                        "%s resource cannot specify function or view.",
-                        resourceType);
-                break;
-            case FUNCTION:
-                checkArgument(
-                        database != null && function != null,
-                        "FUNCTION resource requires database and function.");
-                checkArgument(
-                        table == null && view == null, "FUNCTION cannot specify table or view.");
-                break;
-            case VIEW:
-                checkArgument(
-                        database != null && view != null,
-                        "VIEW resource requires database and view.");
-                checkArgument(
-                        table == null && function == null,
-                        "VIEW cannot specify table or function.");
-                break;
-            default:
-                throw new IllegalArgumentException("Unsupported resource type: " + resourceType);
-        }
+        return new PermissionResource(
+                resourceType,
+                emptyToNull(database),
+                emptyToNull(table),
+                emptyToNull(function),
+                emptyToNull(view));
     }
 
-    private static void validatePolicy(
-            ResourceType resourceType,
-            String access,
-            @Nullable ColumnSelection columns,
-            @Nullable String rowFilter,
-            @Nullable Map<String, ColumnMask> columnMasking,
-            @Nullable String expireTime) {
-        if (resourceType == ResourceType.COLUMN) {
-            checkArgument(
-                    "SELECT".equals(access), "COLUMN permission only supports SELECT access.");
-            checkArgument(
-                    columns != null,
-                    "COLUMN permission requires column_names or excluded_column_names.");
-        } else {
-            checkArgument(columns == null, "Columns are supported only for COLUMN permissions.");
-        }
-
-        if (resourceType == ResourceType.ROW_FILTER) {
-            checkArgument(
-                    "ROW_FILTER".equals(access),
-                    "ROW_FILTER permission requires ROW_FILTER access.");
-            checkArgument(rowFilter != null, "ROW_FILTER permission requires row_filter.");
-            checkArgument(
-                    emptyToNull(expireTime) == null,
-                    "expire_time is not supported for ROW_FILTER permissions.");
-        } else {
-            checkArgument(
-                    rowFilter == null, "row_filter is supported only for ROW_FILTER permissions.");
-        }
-
-        if (resourceType == ResourceType.COLUMN_MASKING) {
-            checkArgument(
-                    "COLUMN_MASKING".equals(access),
-                    "COLUMN_MASKING permission requires COLUMN_MASKING access.");
-            checkArgument(
-                    columnMasking != null, "COLUMN_MASKING permission requires column_masking.");
-            checkArgument(
-                    emptyToNull(expireTime) == null,
-                    "expire_time is not supported for COLUMN_MASKING permissions.");
-        } else {
-            checkArgument(
-                    columnMasking == null,
-                    "column_masking is supported only for COLUMN_MASKING permissions.");
-        }
+    protected static PermissionScope scope(@Nullable String value) {
+        return isBlank(value)
+                ? PermissionScope.SELF
+                : enumValue(value, PermissionScope.class, "scope");
     }
 
     protected static <E extends Enum<E>> E enumValue(
@@ -259,50 +141,10 @@ protected static <E extends Enum<E>> E enumValue(
         }
     }
 
-    protected static void checkPrincipal(String principal) {
-        checkArgument(!isBlank(principal), "principal cannot be empty.");
-    }
-
-    private static String requiredUpperCase(String value, String argument) {
-        checkArgument(!isBlank(value), "%s cannot be empty.", argument);
-        return value.toUpperCase(Locale.ROOT);
-    }
-
-    @Nullable
-    private static List<String> toStrings(@Nullable ArrayData data, String argument) {
-        if (data == null) {
-            return null;
-        }
-        checkArgument(data.numElements() > 0, "%s cannot be empty.", argument);
-        List<String> result = new ArrayList<>(data.numElements());
-        for (int i = 0; i < data.numElements(); i++) {
-            checkArgument(!data.isNullAt(i), "%s cannot contain null.", argument);
-            String value = data.getUTF8String(i).toString();
-            checkArgument(!isBlank(value), "%s cannot contain empty values.", argument);
-            result.add(value);
-        }
-        return result;
-    }
-
     @Nullable
-    private static Map<String, ColumnMask> toColumnMasks(@Nullable MapData data) {
-        if (data == null) {
-            return null;
-        }
-        checkArgument(data.numElements() > 0, "column_masking cannot be empty.");
-        Map<String, ColumnMask> result = new HashMap<>();
-        for (int i = 0; i < data.numElements(); i++) {
-            checkArgument(
-                    !data.keyArray().isNullAt(i) && !data.valueArray().isNullAt(i),
-                    "column_masking cannot contain null keys or values.");
-            String key = data.keyArray().getUTF8String(i).toString();
-            String value = data.valueArray().getUTF8String(i).toString();
-            checkArgument(
-                    !isBlank(key) && !isBlank(value),
-                    "column_masking cannot contain empty keys or values.");
-            result.put(key, new ColumnMask(value, null));
-        }
-        return result;
+    protected static <E extends Enum<E>> E optionalEnum(
+            @Nullable String value, Class<E> enumClass, String argument) {
+        return isBlank(value) ? null : enumValue(value, enumClass, argument);
     }
 
     @Nullable
@@ -310,7 +152,7 @@ protected static String emptyToNull(@Nullable String value) {
         return isBlank(value) ? null : value;
     }
 
-    private static boolean isBlank(@Nullable String value) {
+    protected static boolean isBlank(@Nullable String value) {
         return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
new file mode 100644
index 000000000000..35f23d094196
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
@@ -0,0 +1,162 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PolicyArgument;
+import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyType;
+import org.apache.paimon.management.PrincipalRef;
+import org.apache.paimon.management.PrincipalType;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.management.RowFilter;
+
+import org.apache.spark.sql.catalyst.util.ArrayData;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.unsafe.types.UTF8String;
+
+import javax.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Shared typed argument conversion for table policy procedures. */
+abstract class BasePolicyProcedure extends BasePermissionProcedure {
+
+    protected BasePolicyProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    protected static org.apache.spark.sql.types.DataType principalArrayType() {
+        return DataTypes.createArrayType(StringType);
+    }
+
+    protected static org.apache.spark.sql.types.DataType functionArgumentArrayType() {
+        return DataTypes.createArrayType(StringType);
+    }
+
+    protected static DataPolicy policy(
+            String database,
+            String table,
+            String name,
+            PolicyType policyType,
+            String functionName,
+            ArrayData toPrincipals,
+            @Nullable ArrayData exceptPrincipals,
+            @Nullable String onColumn,
+            @Nullable ArrayData functionArguments,
+            @Nullable String comment) {
+        PermissionResource resource = tableResource(database, table);
+        List<PrincipalRef> targets = principals(toPrincipals, "to_principals", true);
+        List<PrincipalRef> exceptions = principals(exceptPrincipals, "except_principals", false);
+        List<PolicyArgument> arguments = arguments(functionArguments);
+        if (policyType == PolicyType.ROW_FILTER) {
+            checkArgument(isBlank(onColumn), "ROW_FILTER policy cannot specify on_column.");
+            return DataPolicy.rowFilter(
+                    resource,
+                    name,
+                    new RowFilter(functionName, arguments),
+                    targets,
+                    exceptions,
+                    emptyToNull(comment));
+        }
+        return DataPolicy.columnMask(
+                resource,
+                name,
+                new ColumnMask(functionName, onColumn, arguments),
+                targets,
+                exceptions,
+                emptyToNull(comment));
+    }
+
+    protected static PolicyIdentity policyIdentity(String database, String table, String name) {
+        return new PolicyIdentity(tableResource(database, table), name);
+    }
+
+    protected static PermissionResource tableResource(String database, String table) {
+        return resource(ResourceType.TABLE, database, table, null, null);
+    }
+
+    private static List<PrincipalRef> principals(
+            @Nullable ArrayData data, String argument, boolean required) {
+        if (data == null) {
+            checkArgument(!required, "%s is required.", argument);
+            return Collections.emptyList();
+        }
+        checkArgument(data.numElements() > 0 || !required, "%s cannot be empty.", argument);
+        List<PrincipalRef> principals = new ArrayList<>(data.numElements());
+        for (int i = 0; i < data.numElements(); i++) {
+            checkArgument(!data.isNullAt(i), "%s cannot contain null.", argument);
+            String encoded = data.getUTF8String(i).toString();
+            String[] principal = split(encoded, argument, "TYPE:id", false);
+            principals.add(
+                    new PrincipalRef(
+                            enumValue(principal[0], PrincipalType.class, argument + ".type"),
+                            principal[1]));
+        }
+        return principals;
+    }
+
+    private static List<PolicyArgument> arguments(@Nullable ArrayData data) {
+        if (data == null) {
+            return Collections.emptyList();
+        }
+        List<PolicyArgument> arguments = new ArrayList<>(data.numElements());
+        for (int i = 0; i < data.numElements(); i++) {
+            checkArgument(!data.isNullAt(i), "function_arguments cannot contain null.");
+            UTF8String value = data.getUTF8String(i);
+            String encoded = value.toString();
+            boolean constant = encoded.regionMatches(true, 0, "constant:", 0, "constant:".length());
+            String[] argument =
+                    split(
+                            encoded,
+                            "function_arguments",
+                            "column:value or constant:value",
+                            constant);
+            if ("column".equalsIgnoreCase(argument[0])) {
+                arguments.add(PolicyArgument.column(argument[1]));
+            } else {
+                checkArgument(
+                        "constant".equalsIgnoreCase(argument[0]),
+                        "function_arguments entries must start with column: or constant:.");
+                arguments.add(PolicyArgument.constant(argument[1]));
+            }
+        }
+        return arguments;
+    }
+
+    private static String[] split(
+            String encoded, String argument, String expected, boolean allowEmptyValue) {
+        int delimiter = encoded.indexOf(':');
+        checkArgument(
+                delimiter > 0 && (allowEmptyValue || delimiter < encoded.length() - 1),
+                "%s entry '%s' must use %s.",
+                argument,
+                encoded,
+                expected);
+        return new String[] {encoded.substring(0, delimiter), encoded.substring(delimiter + 1)};
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
new file mode 100644
index 000000000000..c54910b6a656
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PolicyType;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Shared implementation for creating or replacing a table data policy. */
+abstract class CreateOrReplacePolicyBaseProcedure extends BasePolicyProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("database", StringType),
+                ProcedureParameter.required("table", StringType),
+                ProcedureParameter.required("name", StringType),
+                ProcedureParameter.required("policy_type", StringType),
+                ProcedureParameter.required("function_name", StringType),
+                ProcedureParameter.required("to_principals", principalArrayType()),
+                ProcedureParameter.optional("except_principals", principalArrayType()),
+                ProcedureParameter.optional("on_column", StringType),
+                ProcedureParameter.optional("function_arguments", functionArgumentArrayType()),
+                ProcedureParameter.optional("comment", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                    });
+
+    protected CreateOrReplacePolicyBaseProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        DataPolicy policy =
+                policy(
+                        args.getString(0),
+                        args.getString(1),
+                        args.getString(2),
+                        enumValue(args.getString(3), PolicyType.class, PARAMETERS[3].name()),
+                        args.getString(4),
+                        args.getArray(5),
+                        args.isNullAt(6) ? null : args.getArray(6),
+                        args.isNullAt(7) ? null : args.getString(7),
+                        args.isNullAt(8) ? null : args.getArray(8),
+                        args.isNullAt(9) ? null : args.getString(9));
+        writePolicy(policy);
+        return new InternalRow[] {newInternalRow(true)};
+    }
+
+    protected abstract void writePolicy(DataPolicy policy);
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java
new file mode 100644
index 000000000000..d6c51ff7d31b
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.DataPolicy;
+
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+
+/** Creates or fully replaces a table row-filter or column-mask policy. */
+public class CreateOrReplacePolicyProcedure extends CreateOrReplacePolicyBaseProcedure {
+
+    private CreateOrReplacePolicyProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    protected void writePolicy(DataPolicy policy) {
+        policyManagement().createOrReplacePolicy(policy);
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<CreateOrReplacePolicyProcedure>() {
+            @Override
+            protected CreateOrReplacePolicyProcedure doBuild() {
+                return new CreateOrReplacePolicyProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "CreateOrReplacePolicyProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
new file mode 100644
index 000000000000..d3227608af0c
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.DataPolicy;
+
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+
+/** Creates a table row-filter or column-mask policy. */
+public class CreatePolicyProcedure extends CreateOrReplacePolicyBaseProcedure {
+
+    private CreatePolicyProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    protected void writePolicy(DataPolicy policy) {
+        policyManagement().createPolicy(policy);
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<CreatePolicyProcedure>() {
+            @Override
+            protected CreatePolicyProcedure doBuild() {
+                return new CreatePolicyProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "CreatePolicyProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
new file mode 100644
index 000000000000..7440bb9070a6
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.management.PolicyIdentity;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+
+import static org.apache.spark.sql.types.DataTypes.BooleanType;
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Drops a named row-filter or column-masking policy. */
+public class DropPolicyProcedure extends BasePolicyProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("database", StringType),
+                ProcedureParameter.required("table", StringType),
+                ProcedureParameter.required("name", StringType),
+                ProcedureParameter.optional("if_exists", BooleanType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                    });
+
+    private DropPolicyProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        PolicyIdentity identity =
+                policyIdentity(args.getString(0), args.getString(1), args.getString(2));
+        policyManagement().dropPolicy(identity, !args.isNullAt(3) && args.getBoolean(3));
+        return new InternalRow[] {newInternalRow(true)};
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<DropPolicyProcedure>() {
+            @Override
+            protected DropPolicyProcedure doBuild() {
+                return new DropPolicyProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "DropPolicyProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
index 8ddff7f08ec6..afee1e211980 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
@@ -18,12 +18,12 @@
 
 package org.apache.paimon.spark.procedure;
 
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
-import org.apache.spark.sql.types.DataTypes;
 import org.apache.spark.sql.types.Metadata;
 import org.apache.spark.sql.types.StructField;
 import org.apache.spark.sql.types.StructType;
@@ -37,24 +37,24 @@ public class GrantPermissionProcedure extends BasePermissionProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
                 ProcedureParameter.required("access", StringType),
+                ProcedureParameter.required("principal_type", StringType),
                 ProcedureParameter.required("principal", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
-                ProcedureParameter.optional("column_names", DataTypes.createArrayType(StringType)),
-                ProcedureParameter.optional(
-                        "excluded_column_names", DataTypes.createArrayType(StringType)),
-                ProcedureParameter.optional("row_filter", StringType),
-                ProcedureParameter.optional(
-                        "column_masking", DataTypes.createMapType(StringType, StringType)),
+                ProcedureParameter.optional("scope", StringType),
                 ProcedureParameter.optional("expire_time", StringType)
             };
 
     private static final StructType OUTPUT_TYPE =
             new StructType(
                     new StructField[] {
-                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                        new StructField(
+                                "result",
+                                org.apache.spark.sql.types.DataTypes.BooleanType,
+                                false,
+                                Metadata.empty())
                     });
 
     private GrantPermissionProcedure(TableCatalog tableCatalog) {
@@ -75,22 +75,20 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        Permission permission =
-                permission(
+        PermissionAssignment assignment =
+                assignment(
                         resourceType,
                         args.getString(1),
-                        args.getString(2),
-                        args.isNullAt(3) ? null : args.getString(3),
+                        enumValue(args.getString(2), PrincipalType.class, PARAMETERS[2].name()),
+                        args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6),
-                        args.isNullAt(7) ? null : args.getArray(7),
-                        args.isNullAt(8) ? null : args.getArray(8),
-                        args.isNullAt(9) ? null : args.getString(9),
-                        args.isNullAt(10) ? null : args.getMap(10),
-                        args.isNullAt(11) ? null : args.getString(11));
+                        args.isNullAt(7) ? null : args.getString(7),
+                        args.isNullAt(8) ? null : args.getString(8),
+                        args.isNullAt(9) ? null : args.getString(9));
 
-        permissionManagement().grantPermission(permission);
+        permissionManagement().grantPermission(assignment);
         return new InternalRow[] {newInternalRow(true)};
     }
 
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
index 80b1c0c00bcd..0a0ae4bc25d3 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
@@ -20,7 +20,9 @@
 
 import org.apache.paimon.PagedList;
 import org.apache.paimon.management.ListPermissionsRequest;
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionScope;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.utils.JsonSerdeUtil;
 
@@ -33,21 +35,25 @@
 
 import java.util.List;
 
-import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.spark.sql.types.DataTypes.BooleanType;
 import static org.apache.spark.sql.types.DataTypes.IntegerType;
 import static org.apache.spark.sql.types.DataTypes.StringType;
 
-/** Lists explicitly granted permissions. */
+/** Lists direct and optionally resource-inherited permissions on an exact target. */
 public class ListPermissionsProcedure extends BasePermissionProcedure {
 
     private static final ProcedureParameter[] PARAMETERS =
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
+                ProcedureParameter.optional("scope", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
+                ProcedureParameter.optional("principal_type", StringType),
                 ProcedureParameter.optional("principal", StringType),
+                ProcedureParameter.optional("access", StringType),
+                ProcedureParameter.optional("include_inherited", BooleanType),
                 ProcedureParameter.optional("max_results", IntegerType),
                 ProcedureParameter.optional("page_token", StringType)
             };
@@ -56,17 +62,16 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
             new StructType(
                     new StructField[] {
                         field("resource_type", StringType, false),
-                        field("catalog", StringType, true),
+                        field("scope", StringType, false),
                         field("database", StringType, true),
                         field("table", StringType, true),
                         field("function", StringType, true),
                         field("view", StringType, true),
-                        field("columns_json", StringType, true),
-                        field("row_filter_json", StringType, true),
-                        field("column_masking_json", StringType, true),
                         field("access", StringType, false),
+                        field("principal_type", StringType, false),
                         field("principal", StringType, false),
                         field("expire_time", StringType, true),
+                        field("inherited_from_json", StringType, true),
                         field("next_page_token", StringType, true)
                     });
 
@@ -88,42 +93,49 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        Integer maxResults = args.isNullAt(6) ? null : args.getInt(6);
-        checkArgument(maxResults == null || maxResults > 0, "max_results must be greater than 0.");
-
+        Integer maxResults = args.isNullAt(10) ? null : args.getInt(10);
         ListPermissionsRequest request =
                 new ListPermissionsRequest(
                         resourceType,
-                        args.isNullAt(1) ? null : emptyToNull(args.getString(1)),
+                        optionalEnum(
+                                args.isNullAt(1) ? null : args.getString(1),
+                                PermissionScope.class,
+                                PARAMETERS[1].name()),
                         args.isNullAt(2) ? null : emptyToNull(args.getString(2)),
                         args.isNullAt(3) ? null : emptyToNull(args.getString(3)),
                         args.isNullAt(4) ? null : emptyToNull(args.getString(4)),
                         args.isNullAt(5) ? null : emptyToNull(args.getString(5)),
+                        optionalEnum(
+                                args.isNullAt(6) ? null : args.getString(6),
+                                PrincipalType.class,
+                                PARAMETERS[6].name()),
                         args.isNullAt(7) ? null : emptyToNull(args.getString(7)),
+                        args.isNullAt(8) ? null : emptyToNull(args.getString(8)),
+                        !args.isNullAt(9) && args.getBoolean(9),
+                        args.isNullAt(11) ? null : emptyToNull(args.getString(11)),
                         maxResults);
-        PagedList<Permission> page = permissionManagement().listPermissions(request);
-        List<Permission> permissions = page.getElements();
-        if (permissions == null || permissions.isEmpty()) {
+        PagedList<PermissionAssignment> page = permissionManagement().listPermissions(request);
+        List<PermissionAssignment> assignments = page.getElements();
+        if (assignments == null || assignments.isEmpty()) {
             return new InternalRow[0];
         }
 
-        InternalRow[] rows = new InternalRow[permissions.size()];
-        for (int i = 0; i < permissions.size(); i++) {
-            Permission permission = permissions.get(i);
+        InternalRow[] rows = new InternalRow[assignments.size()];
+        for (int i = 0; i < assignments.size(); i++) {
+            PermissionAssignment assignment = assignments.get(i);
             rows[i] =
                     newInternalRow(
-                            string(permission.getResourceType().name()),
-                            string(permission.getCatalog()),
-                            string(permission.getDatabase()),
-                            string(permission.getTable()),
-                            string(permission.getFunction()),
-                            string(permission.getView()),
-                            json(permission.getColumns()),
-                            json(permission.getRowFilter()),
-                            json(permission.getColumnMasking()),
-                            string(permission.getAccess()),
-                            string(permission.getPrincipal()),
-                            string(permission.getExpireTime()),
+                            string(assignment.getResource().getType().name()),
+                            string(assignment.getScope().name()),
+                            string(assignment.getResource().getDatabase()),
+                            string(assignment.getResource().getTable()),
+                            string(assignment.getResource().getFunction()),
+                            string(assignment.getResource().getView()),
+                            string(assignment.getAccess()),
+                            string(assignment.getPrincipal().getType().name()),
+                            string(assignment.getPrincipal().getId()),
+                            string(assignment.getExpireTime()),
+                            json(assignment.getInheritedFrom()),
                             string(page.getNextPageToken()));
         }
         return rows;
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
new file mode 100644
index 000000000000..f0c5a79259fd
--- /dev/null
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
@@ -0,0 +1,163 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.spark.procedure;
+
+import org.apache.paimon.PagedList;
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.ListPoliciesRequest;
+import org.apache.paimon.management.PolicyType;
+import org.apache.paimon.management.PrincipalType;
+import org.apache.paimon.management.RowFilter;
+import org.apache.paimon.utils.JsonSerdeUtil;
+
+import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+import org.apache.spark.unsafe.types.UTF8String;
+
+import java.util.List;
+
+import static org.apache.spark.sql.types.DataTypes.IntegerType;
+import static org.apache.spark.sql.types.DataTypes.StringType;
+
+/** Lists policies attached to an exact table. */
+public class ListPoliciesProcedure extends BasePolicyProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("database", StringType),
+                ProcedureParameter.required("table", StringType),
+                ProcedureParameter.optional("name", StringType),
+                ProcedureParameter.optional("policy_type", StringType),
+                ProcedureParameter.optional("principal_type", StringType),
+                ProcedureParameter.optional("principal", StringType),
+                ProcedureParameter.optional("max_results", IntegerType),
+                ProcedureParameter.optional("page_token", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        field("database", StringType, false),
+                        field("table", StringType, false),
+                        field("name", StringType, false),
+                        field("policy_type", StringType, false),
+                        field("function_name", StringType, false),
+                        field("on_column", StringType, true),
+                        field("function_arguments_json", StringType, false),
+                        field("to_principals_json", StringType, false),
+                        field("except_principals_json", StringType, false),
+                        field("comment", StringType, true),
+                        field("next_page_token", StringType, true)
+                    });
+
+    private ListPoliciesProcedure(TableCatalog tableCatalog) {
+        super(tableCatalog);
+    }
+
+    @Override
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        ListPoliciesRequest request =
+                new ListPoliciesRequest(
+                        tableResource(args.getString(0), args.getString(1)),
+                        args.isNullAt(2) ? null : args.getString(2),
+                        optionalEnum(
+                                args.isNullAt(3) ? null : args.getString(3),
+                                PolicyType.class,
+                                PARAMETERS[3].name()),
+                        optionalEnum(
+                                args.isNullAt(4) ? null : args.getString(4),
+                                PrincipalType.class,
+                                PARAMETERS[4].name()),
+                        args.isNullAt(5) ? null : args.getString(5),
+                        args.isNullAt(7) ? null : args.getString(7),
+                        args.isNullAt(6) ? null : args.getInt(6));
+        PagedList<DataPolicy> page = policyManagement().listPolicies(request);
+        List<DataPolicy> policies = page.getElements();
+        if (policies == null || policies.isEmpty()) {
+            return new InternalRow[0];
+        }
+        InternalRow[] rows = new InternalRow[policies.size()];
+        for (int i = 0; i < policies.size(); i++) {
+            DataPolicy policy = policies.get(i);
+            RowFilter rowFilter = policy.getRowFilter();
+            ColumnMask columnMask = policy.getColumnMask();
+            rows[i] =
+                    newInternalRow(
+                            string(policy.getResource().getDatabase()),
+                            string(policy.getResource().getTable()),
+                            string(policy.getName()),
+                            string(policy.type().name()),
+                            string(
+                                    rowFilter == null
+                                            ? columnMask.getFunctionName()
+                                            : rowFilter.getFunctionName()),
+                            string(columnMask == null ? null : columnMask.getOnColumn()),
+                            json(
+                                    rowFilter == null
+                                            ? columnMask.getFunctionArguments()
+                                            : rowFilter.getFunctionArguments()),
+                            json(policy.getToPrincipals()),
+                            json(policy.getExceptPrincipals()),
+                            string(policy.getComment()),
+                            string(page.getNextPageToken()));
+        }
+        return rows;
+    }
+
+    private static StructField field(
+            String name, org.apache.spark.sql.types.DataType type, boolean nullable) {
+        return new StructField(name, type, nullable, Metadata.empty());
+    }
+
+    private static UTF8String string(String value) {
+        return value == null ? null : UTF8String.fromString(value);
+    }
+
+    private static UTF8String json(Object value) {
+        return string(JsonSerdeUtil.toFlatJson(value));
+    }
+
+    public static ProcedureBuilder builder() {
+        return new Builder<ListPoliciesProcedure>() {
+            @Override
+            protected ListPoliciesProcedure doBuild() {
+                return new ListPoliciesProcedure(tableCatalog());
+            }
+        };
+    }
+
+    @Override
+    public String description() {
+        return "ListPoliciesProcedure";
+    }
+}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
index b7173c9b72cf..706103979eac 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
@@ -18,7 +18,8 @@
 
 package org.apache.paimon.spark.procedure;
 
-import org.apache.paimon.management.Permission;
+import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
@@ -37,11 +38,13 @@ public class RevokePermissionProcedure extends BasePermissionProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
                 ProcedureParameter.required("access", StringType),
+                ProcedureParameter.required("principal_type", StringType),
                 ProcedureParameter.required("principal", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
-                ProcedureParameter.optional("view", StringType)
+                ProcedureParameter.optional("view", StringType),
+                ProcedureParameter.optional("scope", StringType)
             };
 
     private static final StructType OUTPUT_TYPE =
@@ -68,17 +71,19 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        Permission permission =
-                revokePermission(
+        PermissionIdentity identity =
+                identity(
                         resourceType,
                         args.getString(1),
-                        args.getString(2),
-                        args.isNullAt(3) ? null : args.getString(3),
+                        enumValue(args.getString(2), PrincipalType.class, PARAMETERS[2].name()),
+                        args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
-                        args.isNullAt(6) ? null : args.getString(6));
+                        args.isNullAt(6) ? null : args.getString(6),
+                        args.isNullAt(7) ? null : args.getString(7),
+                        args.isNullAt(8) ? null : args.getString(8));
 
-        permissionManagement().revokePermission(permission);
+        permissionManagement().revokePermission(identity);
         return new InternalRow[] {newInternalRow(true)};
     }
 
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
index 8192d1b426a9..96c247180997 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
@@ -18,8 +18,9 @@
 
 package org.apache.paimon.spark
 
+import org.apache.paimon.management.{PrincipalRef, PrincipalType}
 import org.apache.paimon.options.CatalogOptions
-import org.apache.paimon.rest.{RESTCatalogFactory, RESTCatalogInternalOptions, RESTCatalogOptions, RESTCatalogServer}
+import org.apache.paimon.rest.{RESTCatalogFactory, RESTCatalogInternalOptions, RESTCatalogServer}
 import org.apache.paimon.rest.auth.{AuthProviderEnum, BearTokenAuthProvider}
 import org.apache.paimon.rest.responses.ConfigResponse
 import org.apache.paimon.shade.guava30.com.google.common.collect.ImmutableMap
@@ -30,7 +31,7 @@ import java.util.UUID
 
 class PaimonSparkTestWithRestCatalogBase extends PaimonSparkTestBase {
 
-  private var restCatalogServer: RESTCatalogServer = _
+  protected var restCatalogServer: RESTCatalogServer = _
   private var serverUrl: String = _
   protected var warehouse: String = _
   private val initToken = "init_token"
@@ -42,8 +43,6 @@ class PaimonSparkTestWithRestCatalogBase extends PaimonSparkTestBase {
         RESTCatalogInternalOptions.PREFIX.key,
         "paimon",
         CatalogOptions.WAREHOUSE.key,
-        warehouse,
-        RESTCatalogOptions.MANAGEMENT_CATALOG.key,
         warehouse),
       ImmutableMap.of()
     )
@@ -53,6 +52,17 @@ class PaimonSparkTestWithRestCatalogBase extends PaimonSparkTestBase {
     restCatalogServer.start()
     serverUrl = restCatalogServer.getUrl
     super.beforeAll()
+    Seq("analyst", "first", "second", "reader", "function_reader").foreach(
+      id => restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.ROLE, id)))
+    restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.GROUP, "analysts"))
+    restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.USER, "admin"))
+    spark.sql("CREATE DATABASE IF NOT EXISTS paimon.sales")
+    spark.sql("""CREATE TABLE IF NOT EXISTS paimon.sales.orders (
+                |  id INT,
+                |  region STRING,
+                |  email STRING)
+                |TBLPROPERTIES ('query-auth.enabled' = 'true')
+                |""".stripMargin)
   }
 
   override protected def afterAll(): Unit = {
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index 00c882c99093..1d4ef1ce207f 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -18,111 +18,503 @@
 
 package org.apache.paimon.spark.procedure
 
+import org.apache.paimon.catalog.Identifier
+import org.apache.paimon.data.BinaryString
+import org.apache.paimon.management.{ColumnMask, PermissionResource, PrincipalRef, PrincipalType, ResourceType, RowFilter}
+import org.apache.paimon.predicate.{ConcatTransform, Equal, FieldRef, FieldTransform, LeafPredicate, Predicate, Transform}
+import org.apache.paimon.schema.TableSchema
 import org.apache.paimon.spark.{PaimonSparkTestBase, PaimonSparkTestWithRestCatalogBase}
+import org.apache.paimon.types.DataTypes
 
 import org.apache.spark.sql.Row
 import org.assertj.core.api.Assertions.assertThat
 
-/** End-to-end tests for permission management procedures. */
+import java.util.Collections
+import java.util.function.BiFunction
+
+/** End-to-end tests for permission and policy management procedures. */
 class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
 
-  test("grant, list and revoke a permission") {
+  test("grant, list and idempotently revoke a permission") {
     checkAnswer(
       spark.sql("""CALL sys.grant_permission(
-                  |  resource_type => 'column',
+                  |  resource_type => 'table',
                   |  access => 'select',
-                  |  principal => 'role:analyst',
+                  |  principal_type => 'role',
+                  |  principal => 'analyst',
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  column_names => array('id', 'amount'),
                   |  expire_time => '2027-01-01T00:00:00Z')
                   |""".stripMargin),
       Row(true)
     )
 
-    val permission = spark
-      .sql("""CALL sys.list_permissions(
-             |  principal => 'role:analyst',
-             |  resource_type => 'TABLE')
-             |""".stripMargin)
-      .head()
-    assertThat(permission.getString(0)).isEqualTo("COLUMN")
-    assertThat(permission.isNullAt(1)).isTrue
-    assertThat(permission.getString(2)).isEqualTo("sales")
-    assertThat(permission.getString(3)).isEqualTo("orders")
-    assertThat(permission.getString(6)).contains("\"columnNames\":[\"id\",\"amount\"]")
-    assertThat(permission.getString(9)).isEqualTo("SELECT")
-    assertThat(permission.getString(10)).isEqualTo("role:analyst")
-    assertThat(permission.getString(11)).isEqualTo("2027-01-01T00:00:00Z")
-    assertThat(permission.isNullAt(12)).isTrue
-
-    checkAnswer(
-      spark.sql("""CALL sys.revoke_permission(
-                  |  resource_type => 'COLUMN',
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'TABLE',
                   |  access => 'SELECT',
-                  |  principal => 'role:analyst',
+                  |  principal_type => 'ROLE',
+                  |  principal => 'analyst',
                   |  database => 'sales',
-                  |  table => 'orders')
+                  |  table => 'orders',
+                  |  expire_time => '2028-01-01T00:00:00Z')
                   |""".stripMargin),
       Row(true)
     )
+
+    val assignments = spark
+      .sql("""CALL sys.list_permissions(
+             |  resource_type => 'TABLE',
+             |  database => 'sales',
+             |  table => 'orders',
+             |  principal_type => 'ROLE',
+             |  principal => 'analyst')
+             |""".stripMargin)
+      .collect()
+    assertThat(assignments).hasSize(1)
+    val assignment = assignments.head
+    assertThat(assignment.getString(0)).isEqualTo("TABLE")
+    assertThat(assignment.getString(1)).isEqualTo("SELF")
+    assertThat(assignment.getString(2)).isEqualTo("sales")
+    assertThat(assignment.getString(3)).isEqualTo("orders")
+    assertThat(assignment.getString(6)).isEqualTo("SELECT")
+    assertThat(assignment.getString(7)).isEqualTo("ROLE")
+    assertThat(assignment.getString(8)).isEqualTo("analyst")
+    assertThat(assignment.getString(9)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.isNullAt(10)).isTrue
+    assertThat(assignment.isNullAt(11)).isTrue
+
+    val revoke = """CALL sys.revoke_permission(
+                   |  resource_type => 'TABLE',
+                   |  access => 'SELECT',
+                   |  principal_type => 'ROLE',
+                   |  principal => 'analyst',
+                   |  database => 'sales',
+                   |  table => 'orders')
+                   |""".stripMargin
+    checkAnswer(spark.sql(revoke), Row(true))
+    checkAnswer(spark.sql(revoke), Row(true))
     checkAnswer(
-      spark.sql(
-        "CALL sys.list_permissions(resource_type => 'COLUMN', principal => 'role:analyst')"
-      ),
+      spark.sql("""CALL sys.list_permissions(
+                  |  resource_type => 'TABLE',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  principal_type => 'ROLE',
+                  |  principal => 'analyst')
+                  |""".stripMargin),
       Nil
     )
   }
 
   test("list permissions supports opaque pagination tokens") {
-    grantCatalogPermission("role:first")
-    grantCatalogPermission("role:second")
+    grantCatalogPermission("first")
+    grantCatalogPermission("second")
 
     val first = spark
       .sql("CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1)")
       .head()
-    assertThat(first.getString(10)).isEqualTo("role:first")
-    assertThat(first.getString(12)).isEqualTo("1")
+    assertThat(first.getString(8)).isEqualTo("first")
+    assertThat(first.getString(11)).isEqualTo("1")
 
     val second = spark
       .sql(
         "CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1, page_token => '1')"
       )
       .head()
-    assertThat(second.getString(10)).isEqualTo("role:second")
-    assertThat(second.isNullAt(12)).isTrue
+    assertThat(second.getString(8)).isEqualTo("second")
+    assertThat(second.isNullAt(11)).isTrue
   }
 
-  test("policy payload is limited to its matching resource type") {
-    val error = intercept[IllegalArgumentException] {
+  test("create, replace, apply and idempotently drop table data policies") {
+    restCatalogServer.registerRowFilterPolicyCompiler("security.filter_region", rowFilterCompiler)
+    restCatalogServer.registerRowFilterPolicyCompiler(
+      "security.filter_region_v2",
+      rowFilterCompiler)
+    restCatalogServer.registerColumnMaskPolicyCompiler("security.mask_email", columnMaskCompiler)
+    restCatalogServer.setQueryPrincipals(
+      Collections.singleton(new PrincipalRef(PrincipalType.ROLE, "analyst")))
+    spark.sql(
+      "INSERT OVERWRITE paimon.sales.orders VALUES " +
+        "(1, 'APAC', 'apac@example.com'), (2, 'EMEA', 'emea@example.com')")
+
+    checkAnswer(
+      spark.sql("""CALL sys.create_policy(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'region_filter',
+                  |  policy_type => 'ROW_FILTER',
+                  |  function_name => 'security.filter_region',
+                  |  to_principals => array('ROLE:analyst'),
+                  |  function_arguments => array('column:region', 'constant:APAC'),
+                  |  comment => 'Filter rows by region')
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    val direct = spark
+      .sql("""CALL sys.list_policies(
+             |  database => 'sales',
+             |  table => 'orders',
+             |  name => 'region_filter')
+             |""".stripMargin)
+      .head()
+    assertThat(direct.getString(2)).isEqualTo("region_filter")
+    assertThat(direct.getString(3)).isEqualTo("ROW_FILTER")
+    assertThat(direct.getString(4)).isEqualTo("security.filter_region")
+    assertThat(direct.isNullAt(5)).isTrue
+    assertThat(direct.getString(6)).contains("\"column\":\"region\"")
+    assertThat(direct.getString(7)).contains("\"type\":\"ROLE\"")
+    checkAnswer(
+      spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
+      Row(1, "APAC", "apac@example.com")
+    )
+
+    checkAnswer(
+      spark.sql("""CALL sys.create_or_replace_policy(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'region_filter',
+                  |  policy_type => 'ROW_FILTER',
+                  |  function_name => 'security.filter_region_v2',
+                  |  function_arguments => array('column:region', 'constant:EMEA'),
+                  |  to_principals => array('ROLE:analyst'),
+                  |  except_principals => array('USER:admin'))
+                  |""".stripMargin),
+      Row(true)
+    )
+    val replaced = spark
+      .sql("""CALL sys.list_policies(
+             |  database => 'sales',
+             |  table => 'orders',
+             |  name => 'region_filter')
+             |""".stripMargin)
+      .head()
+    assertThat(replaced.getString(4)).isEqualTo("security.filter_region_v2")
+
+    checkAnswer(
+      spark.sql("""CALL sys.create_policy(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'mask_email',
+                  |  policy_type => 'COLUMN_MASKING',
+                  |  function_name => 'security.mask_email',
+                  |  on_column => 'email',
+                  |  function_arguments => array('constant:****'),
+                  |  to_principals => array('ROLE:analyst'),
+                  |  except_principals => array('USER:admin'))
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    val mask = spark
+      .sql("""CALL sys.list_policies(
+             |  database => 'sales',
+             |  table => 'orders',
+             |  policy_type => 'COLUMN_MASKING')
+             |""".stripMargin)
+      .head()
+    assertThat(mask.getString(2)).isEqualTo("mask_email")
+    assertThat(mask.getString(5)).isEqualTo("email")
+    assertThat(mask.getString(6)).contains("\"constant\":\"****\"")
+    assertThat(mask.getString(8)).contains("\"id\":\"admin\"")
+
+    checkAnswer(
+      spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
+      Row(2, "EMEA", "****")
+    )
+    val exemptPrincipals = new java.util.HashSet[PrincipalRef]()
+    exemptPrincipals.add(new PrincipalRef(PrincipalType.ROLE, "analyst"))
+    exemptPrincipals.add(new PrincipalRef(PrincipalType.USER, "admin"))
+    restCatalogServer.setQueryPrincipals(exemptPrincipals)
+    checkAnswer(
+      spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
+      Seq(
+        Row(1, "APAC", "apac@example.com"),
+        Row(2, "EMEA", "emea@example.com")
+      )
+    )
+
+    checkAnswer(
+      spark.sql("""CALL sys.drop_policy(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'region_filter',
+                  |  if_exists => true)
+                  |""".stripMargin),
+      Row(true)
+    )
+    checkAnswer(
+      spark.sql("""CALL sys.drop_policy(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'region_filter',
+                  |  if_exists => true)
+                  |""".stripMargin),
+      Row(true)
+    )
+    checkAnswer(
+      spark.sql("""CALL sys.list_policies(
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  name => 'region_filter')
+                  |""".stripMargin),
+      Nil
+    )
+    spark.sql(
+      "CALL sys.drop_policy(database => 'sales', table => 'orders', " +
+        "name => 'mask_email', if_exists => true)")
+  }
+
+  test("policy creation validates query authorization, functions and columns") {
+    restCatalogServer.registerRowFilterPolicyFunction(
+      "security.valid_filter",
+      LeafPredicate.of(
+        new FieldTransform(new FieldRef(0, "id", DataTypes.INT())),
+        Equal.INSTANCE,
+        Collections.singletonList(Integer.valueOf(1)))
+    )
+    spark.sql("CREATE TABLE paimon.sales.disabled_orders (id INT)")
+
+    val disabled = intercept[Exception] {
       spark
-        .sql("""CALL sys.grant_permission(
-               |  resource_type => 'TABLE',
-               |  access => 'SELECT',
-               |  principal => 'role:writer',
-               |  database => 'sales',
-               |  table => 'orders',
-               |  column_names => array('id'))
+        .sql("""CALL sys.create_policy(
+               |  database => 'sales', table => 'disabled_orders', name => 'disabled',
+               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
+               |  to_principals => array('ROLE:analyst'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(disabled.getMessage).contains("query-auth.enabled=true")
+
+    val missingFunction = intercept[Exception] {
+      spark
+        .sql("""CALL sys.create_policy(
+               |  database => 'sales', table => 'orders', name => 'missing_function',
+               |  policy_type => 'ROW_FILTER', function_name => 'security.missing',
+               |  to_principals => array('ROLE:analyst'))
                |""".stripMargin)
         .collect()
     }
-    assertThat(error.getMessage)
-      .contains("Columns are supported only for COLUMN permissions")
+    assertThat(missingFunction.getMessage).contains("does not exist")
+
+    val missingColumn = intercept[Exception] {
+      spark
+        .sql("""CALL sys.create_policy(
+               |  database => 'sales', table => 'orders', name => 'missing_column',
+               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
+               |  function_arguments => array('column:unknown'),
+               |  to_principals => array('ROLE:analyst'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(missingColumn.getMessage).contains("does not exist")
+
+    val missingPrincipal = intercept[Exception] {
+      spark
+        .sql("""CALL sys.create_policy(
+               |  database => 'sales', table => 'orders', name => 'missing_principal',
+               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
+               |  to_principals => array('ROLE:missing'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(missingPrincipal.getMessage).contains("principal does not exist")
+  }
+
+  test("table lifecycle preserves policy enforcement and rejects unsafe schema changes") {
+    restCatalogServer.registerRowFilterPolicyCompiler(
+      "security.lifecycle_filter",
+      rowFilterCompiler)
+    restCatalogServer.setQueryPrincipals(
+      Collections.singleton(new PrincipalRef(PrincipalType.ROLE, "analyst")))
+    spark.sql("""CREATE TABLE paimon.sales.lifecycle_orders (
+                |  id INT,
+                |  region STRING)
+                |TBLPROPERTIES ('query-auth.enabled' = 'true')
+                |""".stripMargin)
+    spark.sql("INSERT INTO paimon.sales.lifecycle_orders VALUES (1, 'APAC'), (2, 'EMEA')")
+    checkAnswer(
+      spark.sql("""CALL sys.create_policy(
+                  |  database => 'sales', table => 'lifecycle_orders', name => 'region_filter',
+                  |  policy_type => 'ROW_FILTER', function_name => 'security.lifecycle_filter',
+                  |  function_arguments => array('column:region', 'constant:APAC'),
+                  |  to_principals => array('ROLE:analyst'))
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    spark.sql("ALTER TABLE paimon.sales.lifecycle_orders RENAME TO paimon.sales.renamed_orders")
+    assertThat(
+      spark
+        .sql("CALL sys.list_policies(database => 'sales', table => 'renamed_orders', " +
+          "name => 'region_filter')")
+        .head()
+        .getString(1)).isEqualTo("renamed_orders")
+    assertThat(
+      paimonCatalog
+        .authTableQuery(Identifier.create("sales", "renamed_orders"), null)
+        .extractPredicate()).isNotNull
+
+    val disableAuth = intercept[Exception] {
+      spark
+        .sql("ALTER TABLE paimon.sales.renamed_orders " +
+          "SET TBLPROPERTIES ('query-auth.enabled' = 'false')")
+        .collect()
+    }
+    assertThat(disableAuth.getMessage).contains("Cannot disable query-auth.enabled")
+
+    val renameColumn = intercept[Exception] {
+      spark
+        .sql("ALTER TABLE paimon.sales.renamed_orders RENAME COLUMN region TO area")
+        .collect()
+    }
+    assertThat(renameColumn.getMessage).contains("policy argument column region")
+
+    spark.sql("DROP TABLE paimon.sales.renamed_orders")
+    spark.sql("""CREATE TABLE paimon.sales.renamed_orders (
+                |  id INT,
+                |  region STRING)
+                |TBLPROPERTIES ('query-auth.enabled' = 'true')
+                |""".stripMargin)
+    spark.sql("INSERT INTO paimon.sales.renamed_orders VALUES (1, 'APAC'), (2, 'EMEA')")
+    checkAnswer(
+      spark.sql("SELECT id, region FROM paimon.sales.renamed_orders ORDER BY id"),
+      Seq(Row(1, "APAC"), Row(2, "EMEA"))
+    )
+    checkAnswer(
+      spark.sql(
+        "CALL sys.list_policies(database => 'sales', table => 'renamed_orders', " +
+          "name => 'region_filter')"),
+      Nil
+    )
+    assertThat(
+      paimonCatalog
+        .authTableQuery(Identifier.create("sales", "renamed_orders"), null)
+        .extractPredicate()).isNull
+  }
+
+  test("management endpoints enforce target authorization") {
+    val resource =
+      new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null)
+    restCatalogServer.denyManagementPermission(resource)
+    try {
+      val permissionError = intercept[Exception] {
+        spark
+          .sql("""CALL sys.grant_permission(
+                 |  resource_type => 'TABLE', access => 'SELECT',
+                 |  principal_type => 'ROLE', principal => 'analyst',
+                 |  database => 'sales', table => 'orders')
+                 |""".stripMargin)
+          .collect()
+      }
+      assertThat(permissionError.getMessage).contains("cannot manage permissions")
+
+      val policyError = intercept[Exception] {
+        spark
+          .sql("CALL sys.list_policies(database => 'sales', table => 'orders')")
+          .collect()
+      }
+      assertThat(policyError.getMessage).contains("cannot manage permissions")
+    } finally {
+      restCatalogServer.allowManagementPermission(resource)
+    }
+  }
+
+  test("include inherited permissions resolves only resource ancestry") {
+    grantCatalogPermission("reader")
+
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'CATALOG',
+                  |  scope => 'DESCENDANTS',
+                  |  access => 'EXECUTE',
+                  |  principal_type => 'ROLE',
+                  |  principal => 'function_reader')
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    checkAnswer(
+      spark.sql("""CALL sys.list_permissions(
+                  |  resource_type => 'TABLE',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  principal_type => 'ROLE',
+                  |  principal => 'reader')
+                  |""".stripMargin),
+      Nil
+    )
+
+    val inherited = spark
+      .sql("""CALL sys.list_permissions(
+             |  resource_type => 'TABLE',
+             |  database => 'sales',
+             |  table => 'orders',
+             |  scope => 'SELF',
+             |  principal_type => 'ROLE',
+             |  principal => 'reader',
+             |  include_inherited => true)
+             |""".stripMargin)
+      .head()
+    assertThat(inherited.getString(0)).isEqualTo("TABLE")
+    assertThat(inherited.getString(1)).isEqualTo("SELF")
+    assertThat(inherited.getString(10)).contains("\"type\":\"CATALOG\"")
+
+    checkAnswer(
+      spark.sql("""CALL sys.list_permissions(
+                  |  resource_type => 'TABLE',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  principal_type => 'ROLE',
+                  |  principal => 'function_reader',
+                  |  include_inherited => true)
+                  |""".stripMargin),
+      Nil
+    )
   }
 
   private def grantCatalogPermission(principal: String): Unit = {
     checkAnswer(
       spark.sql(s"""CALL sys.grant_permission(
-                   |  resource_type => 'CATALOG_ALL',
+                   |  resource_type => 'CATALOG',
+                   |  scope => 'DESCENDANTS',
                    |  access => 'SELECT',
+                   |  principal_type => 'ROLE',
                    |  principal => '$principal')
                    |""".stripMargin),
       Row(true)
     )
   }
+
+  private val rowFilterCompiler = new BiFunction[TableSchema, RowFilter, Predicate] {
+    override def apply(schema: TableSchema, filter: RowFilter): Predicate = {
+      val arguments = filter.getFunctionArguments
+      require(arguments.size() == 2)
+      val column = arguments.get(0).getColumn
+      val constant = arguments.get(1).getConstant
+      require(column != null && constant != null)
+      val index = schema.fieldNames().indexOf(column)
+      require(index >= 0)
+      LeafPredicate.of(
+        new FieldTransform(new FieldRef(index, column, schema.fields().get(index).`type`())),
+        Equal.INSTANCE,
+        Collections.singletonList(BinaryString.fromString(constant))
+      )
+    }
+  }
+
+  private val columnMaskCompiler = new BiFunction[TableSchema, ColumnMask, Transform] {
+    override def apply(schema: TableSchema, mask: ColumnMask): Transform = {
+      val arguments = mask.getFunctionArguments
+      require(schema.fieldNames().contains(mask.getOnColumn))
+      require(arguments.size() == 1 && arguments.get(0).getConstant != null)
+      new ConcatTransform(
+        Collections.singletonList(BinaryString.fromString(arguments.get(0).getConstant)))
+    }
+  }
 }
 
-/** Permission procedures must fail clearly for catalogs without the management capability. */
+/** Management procedures must fail clearly for catalogs without the REST capability. */
 class PermissionProcedureUnsupportedCatalogTest extends PaimonSparkTestBase {
 
   test("filesystem catalog does not expose permission management") {
@@ -130,11 +522,12 @@ class PermissionProcedureUnsupportedCatalogTest extends PaimonSparkTestBase {
       spark
         .sql("""CALL sys.grant_permission(
                |  resource_type => 'CATALOG',
-               |  access => 'ALL',
-               |  principal => 'role:admin')
+               |  access => 'USE_CATALOG',
+               |  principal_type => 'ROLE',
+               |  principal => 'admin')
                |""".stripMargin)
         .collect()
     }
-    assertThat(error.getMessage).contains("does not support permission management")
+    assertThat(error.getMessage).contains("does not support permission or policy management")
   }
 }

From b3f3d9c2ca444dee24660bb794cf93c2a6c79502 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 19:56:09 +0800
Subject: [PATCH 05/12] [api][spark] Refine REST permission management model

---
 docs/docs/concepts/rest/management-api.md     | 145 +++----
 docs/scripts/validate-rest-openapi.js         | 255 +++++++++++--
 docs/static/rest-management-open-api.yaml     | 356 ++++++++++--------
 .../apache/paimon/management/DataPolicy.java  | 123 ++----
 .../management/ListPermissionsRequest.java    |  15 +-
 .../management/ListPoliciesRequest.java       |  34 +-
 .../paimon/management/PermissionAccess.java   |  31 +-
 .../management/PermissionAssignment.java      |  37 +-
 .../paimon/management/PermissionIdentity.java |  16 +-
 .../paimon/management/PolicyIdentity.java     |  54 ++-
 .../paimon/management/PolicyManagement.java   |   2 -
 .../paimon/management/PrincipalRef.java       |  90 -----
 .../paimon/management/PrincipalType.java      |  39 --
 .../java/org/apache/paimon/rest/RESTApi.java  |  33 +-
 .../paimon/rest/RESTPolicyManagement.java     |   5 -
 .../org/apache/paimon/rest/ResourcePaths.java |   6 -
 .../rest/requests/DropPolicyRequest.java      |  85 +++++
 .../rest/requests/GrantPermissionRequest.java |   5 +-
 .../paimon/rest/requests/PolicyRequest.java   |  71 +---
 .../requests/RevokePermissionRequest.java     |   5 +-
 .../rest/responses/GetPolicyResponse.java     |  48 ---
 .../PermissionManagementJsonTest.java         | 199 +++++-----
 .../rest/RESTPermissionManagementTest.java    |  18 +-
 .../paimon/rest/RESTPolicyManagementTest.java |  36 +-
 .../RequestJacksonCompatibilityTest.java      |   1 +
 .../org/apache/paimon/rest/PolicyKey.java     |  58 ++-
 .../org/apache/paimon/rest/PolicyKeyTest.java |  54 +++
 .../apache/paimon/rest/RESTCatalogServer.java | 141 +++----
 .../paimon/rest/RESTPermissionStore.java      |   7 +-
 .../paimon/rest/RESTPermissionStoreTest.java  |   4 +-
 .../apache/paimon/rest/ResourcePathsTest.java |   4 +-
 .../procedure/BasePermissionProcedure.java    |   8 +-
 .../spark/procedure/BasePolicyProcedure.java  |  58 +--
 .../CreateOrReplacePolicyBaseProcedure.java   |  18 +-
 .../spark/procedure/DropPolicyProcedure.java  |  16 +-
 .../procedure/GrantPermissionProcedure.java   |   9 +-
 .../procedure/ListPermissionsProcedure.java   |  18 +-
 .../procedure/ListPoliciesProcedure.java      |  30 +-
 .../procedure/RevokePermissionProcedure.java  |   9 +-
 .../PaimonSparkTestWithRestCatalogBase.scala  |   7 +-
 .../procedure/PermissionProcedureTest.scala   | 119 +++---
 41 files changed, 1129 insertions(+), 1140 deletions(-)
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index e84734f85e9f..92a5a5257cc0 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -22,7 +22,7 @@ limitations under the License.
 
 The REST Management API is an experimental OpenAPI 3.1 control-plane extension for object
 privileges, row filters, and column masks in a Paimon REST Catalog. Its current contract version is
-`0.3.0` and may evolve incompatibly while the design is being validated.
+`0.4.0` and may evolve incompatibly while the design is being validated.
 
 `RESTCatalog` exposes `permissionManagement()` and `policyManagement()` directly. These methods are
 intentionally not part of the generic `Catalog` interface. A non-REST catalog therefore reports an
@@ -41,9 +41,8 @@ POST /v1/{prefix}/permissions/revoke
 
 GET    /v1/{prefix}/databases/{database}/tables/{table}/policies
 POST   /v1/{prefix}/databases/{database}/tables/{table}/policies
-GET    /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
-PUT    /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
-DELETE /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}
+PUT    /v1/{prefix}/databases/{database}/tables/{table}/policies
+DELETE /v1/{prefix}/databases/{database}/tables/{table}/policies
 ```
 
 Policies are currently attached only to tables. The path is the attachment identity, so policy
@@ -87,8 +86,12 @@ Permission resources are structured objects:
 `SELF` applies only to the referenced resource and is the default. `DESCENDANTS` applies below a
 `CATALOG` or `DATABASE`; it is invalid on `TABLE`, `FUNCTION`, and `VIEW` resources.
 
-Principals are `{type, id}` pairs. Supported types are `USER`, `GROUP`, `ROLE`, and `SERVICE`.
-Principal ids are opaque stable identifiers in the server namespace.
+Principals are opaque, canonical strings that are globally unique in the server namespace. Their
+format is server-defined and may encode a user, group, role, or service identity, for example
+`role:analyst` or an external identity-provider ARN. Principal type and membership resolution are
+server responsibilities. Access values are limited to 32 characters and principals to 128
+characters. An implementation may resolve wire locators and principals to different stable
+persistence identifiers; those internal ids are not exposed by this API.
 
 Built-in accesses are resource-specific:
 
@@ -100,18 +103,33 @@ Built-in accesses are resource-specific:
 | `VIEW` | `SELECT`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
 | `FUNCTION` | `EXECUTE`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
 
-Inputs are case-insensitive and responses use upper case. Implementations may add namespaced
-accesses such as `vendor.example/SOME_ACCESS`; unknown unnamespaced accesses are rejected.
+Java and Spark helpers accept access names case-insensitively and normalize them before sending.
+The REST wire format uses upper case. Implementations may add namespaced accesses such as
+`VENDOR.EXAMPLE/SOME_ACCESS`; unknown unnamespaced accesses are rejected.
 
 An assignment identity is `resource`, `scope`, `access`, and `principal`. Granting the same identity
 replaces its expiry. Revocation is idempotent. `includeInherited` only expands resource ancestry;
 resolving group membership and role inheritance remains a server responsibility.
 
+`expireTime`, when present, is an exclusive upper bound evaluated against the REST server clock.
+At `now >= expireTime`, the assignment must not authorize access. Expired direct assignments may
+remain visible in listings until server cleanup, but `includeInherited=true` must not materialize an
+expired assignment as an effective inherited view. Timestamps must not be more precise than
+milliseconds.
+
+Resource objects in this API are wire locators, not persistence identities. Servers must bind direct
+assignments to a stable internal resource identity: renaming a database, table, function, or view
+retains its assignments and subsequent responses use the new locator; dropping it removes its direct
+assignments; recreating the same locator does not restore them. A child rename does not change a
+`DESCENDANTS` assignment attached to its catalog or database ancestor.
+
 ## Data policy model
 
-A data policy is a named entity attached directly to one table. Its principal selectors use
-`TO` and `EXCEPT` semantics: it applies when the caller matches at least one `toPrincipals`
-entry and no `exceptPrincipals` entry. `EXCEPT` wins when both match.
+A data policy is attached directly to one table and one principal. It applies whenever that
+principal is effective for the caller after the server resolves group and role membership. A
+principal can have at most one row filter on a table and at most one column mask on each table
+column. A row-filter identity is `(table, ROW_FILTER, principal)`; a column-mask identity is
+`(table, COLUMN_MASKING, principal, onColumn)`.
 
 Each policy contains exactly one typed definition:
 
@@ -120,9 +138,9 @@ Each policy contains exactly one typed definition:
 | `rowFilter` | `functionName`, ordered `functionArguments` | A boolean predicate applied to every scan. |
 | `columnMask` | `functionName`, `onColumn`, ordered `functionArguments` | A value compatible with the protected column. |
 
-The common fields are `name`, non-empty `toPrincipals`, optional `exceptPrincipals`, and an
-optional `comment`. A function argument is exactly one of `{"column":"region"}` or
-`{"constant":"APAC"}`. Constants are strings and may be empty; column names may not be empty.
+The common field is one `principal`. A function argument is exactly one of
+`{"column":"region"}` or `{"constant":"APAC"}`. Constants are strings and may be empty;
+column names may not be empty. `functionArguments` is optional and defaults to an empty list.
 
 For a row filter, the arguments are passed positionally and the function must return boolean. For a
 column mask, `onColumn` is the protected input and `functionArguments` contains additional
@@ -133,7 +151,7 @@ Policy create and create-or-replace must be rejected unless all of these conditi
 
 1. The target database and table exist.
 2. The table has `query-auth.enabled=true`; otherwise a stored policy could be silently bypassed.
-3. Every `TO` and `EXCEPT` principal exists.
+3. The referenced principal exists.
 4. The policy function exists, has a compatible signature, and can be compiled by the server.
 5. `onColumn` and every column argument exist in the target table.
 
@@ -141,11 +159,13 @@ These invariants continue to apply for the whole table lifecycle. Servers must b
 stable table identity, preserve that binding across table renames, and remove the policies when the
 table is dropped. A table with policies must reject changes that disable `query-auth.enabled` or
 remove or rename a protected or argument column, unless the policy update and schema change are
-performed atomically.
+performed atomically. If an implementation persists all masks for one principal in one document,
+creating, replacing, or dropping one column mask must atomically preserve masks for other columns.
 
-At authorization time, an unresolved function, invalid signature, or ambiguous set of masks must
-fail closed rather than omit a restriction. Multiple row filters may be combined with `AND`.
-Servers must define deterministic conflict handling when more than one mask targets the same column.
+At authorization time, all applicable row filters must be combined with logical `AND`. More than
+one applicable column mask targeting the same column must fail closed. An unresolved function,
+invalid signature, or policy compilation failure must also fail closed rather than omit a
+restriction.
 
 This experimental contract deliberately does not define governed tags, catalog/database policy
 inheritance, or tag-driven matching. Those features need explicit match conditions and conflict
@@ -166,16 +186,14 @@ Grant catalog access or a privilege inherited by catalog descendants:
 CALL paimon.sys.grant_permission(
   resource_type => 'CATALOG',
   access => 'USE_CATALOG',
-  principal_type => 'ROLE',
-  principal => 'catalog_user'
+  principal => 'role:catalog_user'
 );
 
 CALL paimon.sys.grant_permission(
   resource_type => 'CATALOG',
   scope => 'DESCENDANTS',
   access => 'SELECT',
-  principal_type => 'GROUP',
-  principal => 'analysts'
+  principal => 'group:analysts'
 );
 ```
 
@@ -186,8 +204,7 @@ CALL paimon.sys.grant_permission(
   resource_type => 'DATABASE',
   database => 'sales',
   access => 'CREATE_TABLE',
-  principal_type => 'ROLE',
-  principal => 'data_engineer'
+  principal => 'role:data_engineer'
 );
 
 CALL paimon.sys.grant_permission(
@@ -195,8 +212,7 @@ CALL paimon.sys.grant_permission(
   database => 'sales',
   scope => 'DESCENDANTS',
   access => 'SELECT',
-  principal_type => 'ROLE',
-  principal => 'sales_reader',
+  principal => 'role:sales_reader',
   expire_time => '2027-01-01T00:00:00Z'
 );
 ```
@@ -209,8 +225,7 @@ CALL paimon.sys.grant_permission(
   database => 'sales',
   table => 'orders',
   access => 'SELECT',
-  principal_type => 'USER',
-  principal => 'alice'
+  principal => 'user:alice'
 );
 
 CALL paimon.sys.grant_permission(
@@ -218,8 +233,7 @@ CALL paimon.sys.grant_permission(
   database => 'sales',
   function => 'calculate_tax',
   access => 'EXECUTE',
-  principal_type => 'ROLE',
-  principal => 'analyst'
+  principal => 'role:analyst'
 );
 
 CALL paimon.sys.grant_permission(
@@ -227,8 +241,7 @@ CALL paimon.sys.grant_permission(
   database => 'sales',
   view => 'daily_orders',
   access => 'SELECT',
-  principal_type => 'SERVICE',
-  principal => 'reporting_job'
+  principal => 'service:reporting_job'
 );
 ```
 
@@ -252,8 +265,7 @@ CALL paimon.sys.list_permissions(
   resource_type => 'TABLE',
   database => 'sales',
   table => 'orders',
-  principal_type => 'ROLE',
-  principal => 'analyst',
+  principal => 'role:analyst',
   access => 'SELECT'
 );
 ```
@@ -292,8 +304,7 @@ CALL paimon.sys.revoke_permission(
   database => 'sales',
   scope => 'DESCENDANTS',
   access => 'SELECT',
-  principal_type => 'ROLE',
-  principal => 'sales_reader'
+  principal => 'role:sales_reader'
 );
 ```
 
@@ -308,9 +319,9 @@ ALTER TABLE paimon.sales.orders
 SET TBLPROPERTIES ('query-auth.enabled' = 'true');
 ```
 
-`create_policy` accepts principal selectors as `array<string>` entries encoded as `TYPE:id`.
-Function arguments use `column:value` or `constant:value`. Only the first colon is a delimiter, so
-a principal id or constant may contain later colons. `constant:` represents a valid empty string.
+`create_policy` accepts the canonical `principal` directly. Function arguments use `column:value`
+or `constant:value`. Only the first colon is a delimiter, so a constant may contain later colons.
+`constant:` represents a valid empty string.
 
 This example asks the server to resolve
 `security.filter_region(region, 'APAC')` as a boolean predicate:
@@ -319,18 +330,16 @@ This example asks the server to resolve
 CALL paimon.sys.create_policy(
   database => 'sales',
   table => 'orders',
-  name => 'orders_region_filter',
   policy_type => 'ROW_FILTER',
+  principal => 'group:analysts',
   function_name => 'security.filter_region',
-  function_arguments => array('column:region', 'constant:APAC'),
-  to_principals => array('GROUP:analysts', 'ROLE:reporting'),
-  except_principals => array('USER:alice'),
-  comment => 'Restrict regional order visibility'
+  function_arguments => array('column:region', 'constant:APAC')
 );
 ```
 
-The call fails if the name already exists. Use `create_or_replace_policy` when upsert semantics are
-intended.
+The call fails if that principal already has a row filter on the table. Use
+`create_or_replace_policy` when upsert semantics are intended. Create another policy for a second
+principal with a separate call.
 
 ### Create column-masking policies
 
@@ -341,13 +350,11 @@ can be supplied positionally:
 CALL paimon.sys.create_policy(
   database => 'sales',
   table => 'customers',
-  name => 'mask_phone_by_region',
   policy_type => 'COLUMN_MASKING',
+  principal => 'role:support',
   function_name => 'security.mask_phone',
   on_column => 'phone_number',
-  function_arguments => array('column:region', 'constant:partial'),
-  to_principals => array('ROLE:support'),
-  except_principals => array('ROLE:privacy_admin')
+  function_arguments => array('column:region', 'constant:partial')
 );
 ```
 
@@ -358,12 +365,11 @@ written explicitly:
 CALL paimon.sys.create_policy(
   database => 'sales',
   table => 'customers',
-  name => 'mask_email',
   policy_type => 'COLUMN_MASKING',
+  principal => 'group:support',
   function_name => 'security.mask_email',
   on_column => 'email',
-  function_arguments => array('constant:'),
-  to_principals => array('GROUP:support')
+  function_arguments => array('constant:')
 );
 ```
 
@@ -371,19 +377,18 @@ CALL paimon.sys.create_policy(
 
 ### Create or fully replace a policy
 
-`create_or_replace_policy` maps to HTTP `PUT`. It creates an absent policy or fully replaces an
-existing policy with the same table and name; omitted optional values are cleared.
+`create_or_replace_policy` maps to HTTP `PUT`. It creates an absent policy or fully replaces the
+policy with the same table, policy type, principal, and, for a mask, protected column. Omitted
+optional values are cleared.
 
 ```sql
 CALL paimon.sys.create_or_replace_policy(
   database => 'sales',
   table => 'orders',
-  name => 'orders_region_filter',
   policy_type => 'ROW_FILTER',
+  principal => 'group:analysts',
   function_name => 'security.filter_region_v2',
-  function_arguments => array('column:region'),
-  to_principals => array('GROUP:analysts'),
-  comment => 'Use the second version of the filter'
+  function_arguments => array('column:region')
 );
 ```
 
@@ -401,23 +406,21 @@ CALL paimon.sys.list_policies(
 );
 ```
 
-Filter by name, policy type, or principal. `principal_type` and `principal` must be supplied
-together:
+Filter by policy type or principal. A `column` filter is valid only with
+`policy_type => 'COLUMN_MASKING'`:
 
 ```sql
 CALL paimon.sys.list_policies(
   database => 'sales',
   table => 'orders',
   policy_type => 'ROW_FILTER',
-  principal_type => 'GROUP',
-  principal => 'analysts'
+  principal => 'group:analysts'
 );
 ```
 
-The output columns are `database`, `table`, `name`, `policy_type`, `function_name`,
-`on_column`, `function_arguments_json`, `to_principals_json`, `except_principals_json`,
-`comment`, and `next_page_token`. Pass an opaque continuation token back unchanged with the same
-filters:
+The output columns are `database`, `table`, `policy_type`, `principal`, `function_name`,
+`on_column`, `function_arguments_json`, and `next_page_token`. Pass an opaque continuation token
+back unchanged with the same filters:
 
 ```sql
 CALL paimon.sys.list_policies(
@@ -440,7 +443,8 @@ Drop an existing policy:
 CALL paimon.sys.drop_policy(
   database => 'sales',
   table => 'orders',
-  name => 'orders_region_filter'
+  policy_type => 'ROW_FILTER',
+  principal => 'group:analysts'
 );
 ```
 
@@ -450,7 +454,8 @@ By default an absent policy is an error. Set `if_exists => true` for an idempote
 CALL paimon.sys.drop_policy(
   database => 'sales',
   table => 'orders',
-  name => 'orders_region_filter',
+  policy_type => 'ROW_FILTER',
+  principal => 'group:analysts',
   if_exists => true
 );
 ```
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index fd60dc12d2b4..b4084eff1b26 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -312,7 +312,6 @@ function validateManagementOpenApi() {
     'revokePermission',
     'listTablePolicies',
     'createTablePolicy',
-    'getTablePolicy',
     'createOrReplaceTablePolicy',
     'dropTablePolicy',
   ];
@@ -321,7 +320,6 @@ function validateManagementOpenApi() {
     '/v1/{prefix}/permissions/grant',
     '/v1/{prefix}/permissions/revoke',
     '/v1/{prefix}/databases/{database}/tables/{table}/policies',
-    '/v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}',
   ];
 
   resourcePaths.forEach((resourcePath) =>
@@ -333,6 +331,7 @@ function validateManagementOpenApi() {
   [
     '/v1/{prefix}/policies',
     '/v1/{prefix}/databases/{database}/policies',
+    '/v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}',
   ].forEach((resourcePath) =>
     contract.checkSpec(
       !contract.spec.paths[resourcePath],
@@ -341,21 +340,46 @@ function validateManagementOpenApi() {
   );
   operationIds.forEach(contract.requireOperation);
   ['listPermissions', 'grantPermission', 'revokePermission'].forEach((operationId) =>
-    contract.requireResponses(operationId, ['200', '400', '401', '403', '404', '500']),
+    contract.requireResponses(operationId, [
+      '200',
+      '400',
+      '401',
+      '403',
+      '404',
+      '429',
+      '500',
+      '503',
+    ]),
   );
   ['listTablePolicies', 'createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
-    contract.requireResponses(operationId, ['200', '400', '401', '403', '404', '500']),
-  );
-  ['getTablePolicy', 'dropTablePolicy'].forEach((operationId) =>
-    contract.requireResponses(operationId, ['200', '401', '403', '404', '500']),
-  );
+    contract.requireResponses(operationId, [
+      '200',
+      '400',
+      '401',
+      '403',
+      '404',
+      '429',
+      '500',
+      '503',
+    ]),
+  );
+  contract.requireResponses('dropTablePolicy', [
+    '200',
+    '400',
+    '401',
+    '403',
+    '404',
+    '429',
+    '500',
+    '503',
+  ]);
   ['createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
     contract.requireResponses(operationId, ['409']),
   );
   contract.checkSpec(
-    contract.spec.info.version === '0.3.0' &&
+    contract.spec.info.version === '0.4.0' &&
       contract.spec.info.description.toLowerCase().includes('experimental'),
-    'The management contract must be versioned 0.3.0 and marked experimental',
+    'The management contract must be versioned 0.4.0 and marked experimental',
   );
 
   const assignmentFields = [
@@ -428,49 +452,178 @@ function validateManagementOpenApi() {
   );
   contract.requireRequiredProperties('ListPermissionsResponse', ['permissions']);
 
-  contract.requireProperties('PrincipalRef', ['type', 'id']);
-  contract.requireRequiredProperties('PrincipalRef', ['type', 'id']);
+  const principal = contract.schema('Principal');
+  contract.checkSpec(
+    principal.type === 'string' && principal.minLength === 1 && principal.maxLength === 128,
+    'Principal must be a non-empty string that fits the 128-character persistence identity',
+  );
+  contract.checkSpec(
+    !contract.spec.components.schemas.PrincipalRef &&
+      !contract.spec.components.schemas.PrincipalType &&
+      !contract.spec.components.parameters.PrincipalTypeQuery,
+    'Principal must not expose a separate reference object or type',
+  );
+  ['PermissionAssignment', 'GrantPermissionRequest', 'RevokePermissionRequest'].forEach(
+    (schemaName) =>
+      contract.checkSpec(
+        contract.requireProperties(schemaName, ['principal']).principal.$ref ===
+          '#/components/schemas/Principal',
+        `Schema ${schemaName}.principal must reference Principal`,
+      ),
+  );
+  contract.checkSpec(
+    contract.spec.components.parameters.PrincipalQuery.schema.$ref ===
+      '#/components/schemas/Principal',
+    'PrincipalQuery must reference Principal',
+  );
   requireExactEnum(contract, 'ResourceType', ['CATALOG', 'DATABASE', 'TABLE', 'FUNCTION', 'VIEW']);
   requireExactEnum(contract, 'PermissionScope', ['SELF', 'DESCENDANTS']);
-  requireExactEnum(contract, 'PrincipalType', ['USER', 'GROUP', 'ROLE', 'SERVICE']);
   requireExactEnum(contract, 'PolicyType', ['ROW_FILTER', 'COLUMN_MASKING']);
 
+  const accessAlternatives = contract.schema('PermissionAccess').oneOf || [];
+  const builtInAccess = accessAlternatives.find((alternative) => alternative.enum);
+  const extensionAccess = accessAlternatives.find((alternative) => alternative.pattern);
+  const expectedAccesses = [
+    'USE_CATALOG',
+    'CREATE_DATABASE',
+    'USE_DATABASE',
+    'CREATE_TABLE',
+    'CREATE_VIEW',
+    'CREATE_FUNCTION',
+    'SELECT',
+    'INSERT',
+    'UPDATE',
+    'DELETE',
+    'ALTER',
+    'DROP',
+    'EXECUTE',
+    'MANAGE_PERMISSIONS',
+  ];
+  contract.checkSpec(
+    builtInAccess &&
+      builtInAccess.enum.length === expectedAccesses.length &&
+      expectedAccesses.every((access) => builtInAccess.enum.includes(access)),
+    'PermissionAccess must define the complete built-in access enum',
+  );
+  const extensionPattern = extensionAccess && new RegExp(extensionAccess.pattern);
+  contract.checkSpec(
+    extensionPattern &&
+      extensionPattern.test('VENDOR.EXAMPLE/SOME_ACCESS') &&
+      !extensionPattern.test('UNKNOWN') &&
+      !extensionPattern.test('vendor.example/SOME_ACCESS'),
+    'PermissionAccess must accept only canonical upper-case namespaced extensions',
+  );
+  contract.checkSpec(
+    accessAlternatives.every((alternative) => alternative.maxLength === 32),
+    'Every PermissionAccess alternative must fit the 32-character persistence field',
+  );
+  ['PermissionAssignment', 'GrantPermissionRequest', 'RevokePermissionRequest'].forEach(
+    (schemaName) =>
+      contract.checkSpec(
+        contract.requireProperties(schemaName, ['access']).access.$ref ===
+          '#/components/schemas/PermissionAccess',
+        `Schema ${schemaName}.access must reference PermissionAccess`,
+      ),
+  );
+  contract.checkSpec(
+    contract.spec.components.parameters.AccessQuery.schema.$ref ===
+      '#/components/schemas/PermissionAccess',
+    'AccessQuery must reference PermissionAccess',
+  );
+  ['DatabaseQuery', 'TableQuery', 'FunctionQuery', 'ViewQuery'].forEach((parameterName) => {
+    const locatorQuery = contract.spec.components.parameters[parameterName];
+    contract.checkSpec(
+      locatorQuery.schema.type === 'string' && locatorQuery.schema.minLength === 1,
+      `${parameterName} must be a non-empty string`,
+    );
+  });
+
+  ['TooManyRequests', 'ServiceUnavailable'].forEach((responseName) => {
+    const response = contract.spec.components.responses[responseName];
+    contract.checkSpec(response, `Missing reusable response: ${responseName}`);
+    contract.checkSpec(
+      response.headers['Retry-After'].$ref === '#/components/headers/RetryAfter',
+      `Response ${responseName} must expose the optional Retry-After header`,
+    );
+  });
+  contract.checkSpec(
+    contract.spec.components.headers.RetryAfter.schema.type === 'string',
+    'RetryAfter must allow HTTP delta-seconds or an HTTP date as a string',
+  );
+
+  const assignmentExpiry = contract.requireProperties('PermissionAssignment', ['expireTime'])
+    .expireTime.description.toLowerCase();
+  const grantExpiry = contract.requireProperties('GrantPermissionRequest', ['expireTime'])
+    .expireTime.description.toLowerCase();
+  [assignmentExpiry, grantExpiry].forEach((description) => {
+    contract.checkSpec(
+      description.includes('exclusive') &&
+        description.includes('server clock') &&
+        description.includes('millisecond') &&
+        description.includes('must not authorize'),
+      'expireTime must define exclusive millisecond server-clock authorization semantics',
+    );
+  });
+  const resourceDescription = contract.schema('PermissionResource').description.toLowerCase();
+  ['stable internal resource identity', 'renaming', 'dropping', 'recreating'].forEach((phrase) =>
+    contract.checkSpec(
+      resourceDescription.includes(phrase),
+      `PermissionResource lifecycle is missing: ${phrase}`,
+    ),
+  );
+  const policyDescription = contract.schema('DataPolicy').description.toLowerCase();
+  ['logical and', 'same column', 'fail closed'].forEach((phrase) =>
+    contract.checkSpec(
+      policyDescription.includes(phrase),
+      `DataPolicy composition is missing: ${phrase}`,
+    ),
+  );
+
   contract.requireSchemaReference('PolicyRequest', 'oneOf', 'RowFilterPolicyRequest');
   contract.requireSchemaReference('PolicyRequest', 'oneOf', 'ColumnMaskPolicyRequest');
   contract.requireSchemaReference('DataPolicy', 'oneOf', 'RowFilterDataPolicy');
   contract.requireSchemaReference('DataPolicy', 'oneOf', 'ColumnMaskDataPolicy');
   contract.requireProperties('RowFilter', ['functionName', 'functionArguments']);
   contract.requireProperties('ColumnMask', ['functionName', 'onColumn', 'functionArguments']);
-  contract.requireRequiredProperties('RowFilter', ['functionName', 'functionArguments']);
-  contract.requireRequiredProperties('ColumnMask', [
-    'functionName',
-    'onColumn',
-    'functionArguments',
-  ]);
-  ['RowFilterPolicyRequest', 'ColumnMaskPolicyRequest'].forEach((schemaName) => {
-    const properties = contract.requireProperties(schemaName, [
-      'name',
-      'toPrincipals',
-      'exceptPrincipals',
-      'comment',
-    ]);
-    ['toPrincipals', 'exceptPrincipals'].forEach((field) =>
-      contract.checkSpec(
-        properties[field].items.$ref === '#/components/schemas/PrincipalRef',
-        `${schemaName}.${field} must contain PrincipalRef values`,
-      ),
+  contract.requireRequiredProperties('RowFilter', ['functionName']);
+  contract.requireRequiredProperties('ColumnMask', ['functionName', 'onColumn']);
+  ['RowFilter', 'ColumnMask'].forEach((schemaName) => {
+    const schema = contract.schema(schemaName);
+    contract.checkSpec(
+      !(schema.required || []).includes('functionArguments') &&
+        schema.properties.functionArguments.default.length === 0,
+      `${schemaName}.functionArguments must be optional and default to an empty array`,
     );
+  });
+  ['RowFilterPolicyRequest', 'ColumnMaskPolicyRequest'].forEach((schemaName) => {
+    const properties = contract.requireProperties(schemaName, ['principal']);
     contract.checkSpec(
-      !properties.scope && !properties.type && !properties.resource,
-      `${schemaName} must not expose policy scope, type, or path resource`,
+      properties.principal.$ref === '#/components/schemas/Principal',
+      `${schemaName}.principal must reference Principal`,
     );
     contract.checkSpec(
-      !(contract.schema(schemaName).required || []).includes('exceptPrincipals'),
-      `${schemaName}.exceptPrincipals must be optional`,
+      !properties.scope &&
+        !properties.type &&
+        !properties.resource &&
+        !properties.name &&
+        !properties.toPrincipals &&
+        !properties.exceptPrincipals,
+      `${schemaName} must expose only one principal and no path identity`,
     );
+    contract.requireRequiredProperties(schemaName, ['principal']);
   });
   contract.requireProperties('RowFilterPolicyRequest', ['rowFilter']);
   contract.requireProperties('ColumnMaskPolicyRequest', ['columnMask']);
+  contract.requireRequiredProperties('RowFilterPolicyRequest', ['rowFilter']);
+  contract.requireRequiredProperties('ColumnMaskPolicyRequest', ['columnMask']);
+  contract.requireSchemaReference('DropPolicyRequest', 'oneOf', 'RowFilterPolicyIdentity');
+  contract.requireSchemaReference('DropPolicyRequest', 'oneOf', 'ColumnMaskPolicyIdentity');
+  contract.requireRequiredProperties('RowFilterPolicyIdentity', ['type', 'principal']);
+  contract.requireRequiredProperties('ColumnMaskPolicyIdentity', [
+    'type',
+    'principal',
+    'column',
+  ]);
   contract.checkSpec(
     Array.isArray(contract.schema('PolicyArgument').oneOf) &&
       contract.schema('PolicyArgument').oneOf.length === 2,
@@ -497,7 +650,17 @@ function validateManagementOpenApi() {
     policyList.policies.items.$ref === '#/components/schemas/DataPolicy',
     'ListPoliciesResponse.policies must contain DataPolicy values',
   );
-  contract.requireProperties('GetPolicyResponse', ['policy']);
+  ['RowFilterDataPolicy', 'ColumnMaskDataPolicy'].forEach((schemaName) => {
+    const properties = contract.requireProperties(schemaName, ['resource', 'principal']);
+    contract.checkSpec(
+      properties.principal.$ref === '#/components/schemas/Principal',
+      `${schemaName}.principal must reference Principal`,
+    );
+    contract.checkSpec(
+      !properties.name && !properties.toPrincipals && !properties.exceptPrincipals,
+      `${schemaName} must use a single principal identity`,
+    );
+  });
   contract.requireProperties('ErrorResponse', [
     'message',
     'resourceType',
@@ -518,7 +681,6 @@ function validateManagementOpenApi() {
     'TableQuery',
     'FunctionQuery',
     'ViewQuery',
-    'PrincipalTypeQuery',
     'PrincipalQuery',
     'AccessQuery',
     'IncludeInherited',
@@ -543,11 +705,22 @@ function validateManagementOpenApi() {
     !policyParameters.includes('IncludeInherited'),
     'Table policies must not expose includeInherited',
   );
+  ['PolicyTypeQuery', 'PrincipalQuery', 'PolicyColumnQuery', 'PageToken', 'MaxResults'].forEach(
+    (name) =>
+      contract.checkSpec(
+        policyParameters.includes(name),
+        `Operation listTablePolicies is missing query parameter: ${name}`,
+      ),
+  );
+  contract.checkSpec(
+    !policyParameters.includes('PolicyNameQuery'),
+    'Principal-scoped policies must not expose a policy-name filter',
+  );
+  const tablePoliciesPath =
+    contract.spec.paths['/v1/{prefix}/databases/{database}/tables/{table}/policies'];
   contract.checkSpec(
-    contract.spec.paths[
-      '/v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}'
-    ].put,
-    'Full policy replacement must use PUT',
+    tablePoliciesPath.put && tablePoliciesPath.delete,
+    'Full policy replacement and deletion must use the table policy collection identity',
   );
 
   contract.checkSpec(
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index 6965c30f7b1d..cc6f92c0fc05 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -17,14 +17,16 @@
 openapi: 3.1.1
 info:
   title: Paimon REST Management API
-  version: 0.3.0
+  version: 0.4.0
   description: |
     Experimental control-plane extension for permissions, table row filters, and table column
     masks in one Paimon REST Catalog prefix. A data policy restricts an already-authorized read;
-    it never grants SELECT by itself. Policy creation and replacement are accepted only when the
-    target table exists, has `query-auth.enabled=true`, and all referenced principals, functions,
-    and columns are valid. Principal lifecycle, function implementation, audit, and persistence
-    remain server responsibilities. This contract may evolve incompatibly while experimental.
+    it never grants SELECT by itself. Each policy is attached to one principal: a principal has at
+    most one row filter per table and at most one mask per table column. Policy creation and
+    replacement are accepted only when the target table exists, has `query-auth.enabled=true`, and
+    the referenced principal, function, and columns are valid. Principal lifecycle, function
+    implementation, audit, and persistence remain server responsibilities. This contract may evolve
+    incompatibly while experimental.
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0.html
@@ -44,9 +46,10 @@ paths:
         Direct assignments are returned by default. With `includeInherited=true`, the request
         still names one exact target and the server also returns effective views of ancestor
         `DESCENDANTS` assignments. An effective view uses the target in `resource`, `SELF` in
-        `scope`, and the source attachment in `inheritedFrom`. Following the catalog pagination
-        contract, an empty page terminates pagination and therefore must not carry a continuation
-        token.
+        `scope`, and the source attachment in `inheritedFrom`. Effective views must exclude expired
+        assignments. Direct expired assignments may remain visible until server cleanup. Following
+        the catalog pagination contract, an empty page terminates pagination and therefore must not
+        carry a continuation token.
       parameters:
         - $ref: '#/components/parameters/ResourceTypeQuery'
         - $ref: '#/components/parameters/ScopeQuery'
@@ -54,7 +57,6 @@ paths:
         - $ref: '#/components/parameters/TableQuery'
         - $ref: '#/components/parameters/FunctionQuery'
         - $ref: '#/components/parameters/ViewQuery'
-        - $ref: '#/components/parameters/PrincipalTypeQuery'
         - $ref: '#/components/parameters/PrincipalQuery'
         - $ref: '#/components/parameters/AccessQuery'
         - $ref: '#/components/parameters/IncludeInherited'
@@ -75,8 +77,12 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
   /v1/{prefix}/permissions/grant:
     parameters:
       - $ref: '#/components/parameters/Prefix'
@@ -86,7 +92,8 @@ paths:
       operationId: grantPermission
       description: |
         Creates an assignment or replaces the assignment with the same `resource`, `scope`,
-        `access`, and `principal`. The referenced resource and principal must exist.
+        `access`, and `principal`. The referenced resource and principal must exist. Servers bind
+        assignments to the resource lifecycle described by `PermissionResource`.
       requestBody:
         required: true
         content:
@@ -104,8 +111,12 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
   /v1/{prefix}/permissions/revoke:
     parameters:
       - $ref: '#/components/parameters/Prefix'
@@ -133,8 +144,12 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
 
   /v1/{prefix}/databases/{database}/tables/{table}/policies:
     parameters:
@@ -150,10 +165,9 @@ paths:
         contract, an empty page terminates pagination and therefore must not carry a continuation
         token.
       parameters:
-        - $ref: '#/components/parameters/PolicyNameQuery'
         - $ref: '#/components/parameters/PolicyTypeQuery'
-        - $ref: '#/components/parameters/PrincipalTypeQuery'
         - $ref: '#/components/parameters/PrincipalQuery'
+        - $ref: '#/components/parameters/PolicyColumnQuery'
         - $ref: '#/components/parameters/PageToken'
         - $ref: '#/components/parameters/MaxResults'
       responses:
@@ -171,16 +185,20 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
     post:
       tags: [policy]
       summary: Create a table policy
       operationId: createTablePolicy
       description: |
-        Fails with 409 when the policy name already exists or the table has not enabled query
-        authorization. Referenced principals, the policy function, protected column, and column
-        arguments are validated before persistence.
+        Fails with 409 when the same principal already has a row filter or a mask on the same
+        column, or when the table has not enabled query authorization. The principal, policy
+        function, protected column, and column arguments are validated before persistence.
       requestBody:
         $ref: '#/components/requestBodies/PolicyRequest'
       responses:
@@ -196,41 +214,20 @@ paths:
           $ref: '#/components/responses/NotFound'
         '409':
           $ref: '#/components/responses/Conflict'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
-  /v1/{prefix}/databases/{database}/tables/{table}/policies/{policyName}:
-    parameters:
-      - $ref: '#/components/parameters/Prefix'
-      - $ref: '#/components/parameters/Database'
-      - $ref: '#/components/parameters/Table'
-      - $ref: '#/components/parameters/PolicyName'
-    get:
-      tags: [policy]
-      summary: Get a table policy
-      operationId: getTablePolicy
-      responses:
-        '200':
-          description: Named table policy.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GetPolicyResponse'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '403':
-          $ref: '#/components/responses/Forbidden'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
     put:
       tags: [policy]
       summary: Create or fully replace a table policy
       operationId: createOrReplaceTablePolicy
       description: |
-        Upserts the named policy and replaces every mutable field. The table attachment and policy
-        name are immutable and the body name must equal `policyName`. The same validation and
-        `query-auth.enabled=true` requirement as create applies.
+        Upserts the policy identified by the body principal, definition type, and, for a column
+        mask, `onColumn`. The same validation and `query-auth.enabled=true` requirement as create
+        applies. Replacing one column mask does not replace masks on other columns.
       requestBody:
         $ref: '#/components/requestBodies/PolicyRequest'
       responses:
@@ -246,24 +243,40 @@ paths:
           $ref: '#/components/responses/NotFound'
         '409':
           $ref: '#/components/responses/Conflict'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
     delete:
       tags: [policy]
       summary: Drop a table policy
       operationId: dropTablePolicy
       description: Returns 404 when the policy is absent; clients may expose idempotency explicitly.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DropPolicyRequest'
       responses:
         '200':
           description: Policy dropped.
+        '400':
+          $ref: '#/components/responses/BadRequest'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/TooManyRequests'
         '500':
           $ref: '#/components/responses/ServerError'
+        '503':
+          $ref: '#/components/responses/ServiceUnavailable'
 
 components:
   securitySchemes:
@@ -293,13 +306,6 @@ components:
       schema:
         type: string
         minLength: 1
-    PolicyName:
-      name: policyName
-      in: path
-      required: true
-      schema:
-        type: string
-        minLength: 1
     ResourceTypeQuery:
       name: resourceType
       in: query
@@ -316,51 +322,49 @@ components:
       in: query
       schema:
         type: string
+        minLength: 1
     TableQuery:
       name: table
       in: query
       schema:
         type: string
+        minLength: 1
     FunctionQuery:
       name: function
       in: query
       schema:
         type: string
+        minLength: 1
     ViewQuery:
       name: view
       in: query
       schema:
         type: string
-    PrincipalTypeQuery:
-      name: principalType
-      in: query
-      description: Must be supplied together with `principal`.
-      schema:
-        $ref: '#/components/schemas/PrincipalType'
+        minLength: 1
     PrincipalQuery:
       name: principal
       in: query
-      description: Must be supplied together with `principalType`.
+      description: Exact opaque principal identifier.
       schema:
-        type: string
-        minLength: 1
+        $ref: '#/components/schemas/Principal'
     AccessQuery:
       name: access
       in: query
       schema:
-        type: string
-        minLength: 1
+        $ref: '#/components/schemas/PermissionAccess'
     IncludeInherited:
       name: includeInherited
       in: query
       schema:
         type: boolean
         default: false
-    PolicyNameQuery:
-      name: name
+    PolicyColumnQuery:
+      name: column
       in: query
+      description: Valid only together with `type=COLUMN_MASKING`.
       schema:
         type: string
+        minLength: 1
     PolicyTypeQuery:
       name: type
       in: query
@@ -419,12 +423,36 @@ components:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
+    TooManyRequests:
+      description: Request rate limit exceeded; retry only according to server guidance.
+      headers:
+        Retry-After:
+          $ref: '#/components/headers/RetryAfter'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
     ServerError:
       description: Unexpected server error.
       content:
         application/json:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
+    ServiceUnavailable:
+      description: Management service is temporarily unavailable.
+      headers:
+        Retry-After:
+          $ref: '#/components/headers/RetryAfter'
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+
+  headers:
+    RetryAfter:
+      description: Delay before retrying, as HTTP delta-seconds or an HTTP date.
+      schema:
+        type: string
 
   schemas:
     ResourceType:
@@ -433,24 +461,48 @@ components:
     PermissionScope:
       type: string
       enum: [SELF, DESCENDANTS]
-    PrincipalType:
-      type: string
-      enum: [USER, GROUP, ROLE, SERVICE]
+    PermissionAccess:
+      description: |
+        Canonical access value. The REST wire format uses upper case. Values are either a built-in
+        access or a namespaced server extension.
+      oneOf:
+        - type: string
+          maxLength: 32
+          enum:
+            - USE_CATALOG
+            - CREATE_DATABASE
+            - USE_DATABASE
+            - CREATE_TABLE
+            - CREATE_VIEW
+            - CREATE_FUNCTION
+            - SELECT
+            - INSERT
+            - UPDATE
+            - DELETE
+            - ALTER
+            - DROP
+            - EXECUTE
+            - MANAGE_PERMISSIONS
+        - type: string
+          maxLength: 32
+          pattern: '^[A-Z0-9][A-Z0-9._-]*/[A-Z0-9][A-Z0-9._-]*$'
     PolicyType:
       type: string
       enum: [ROW_FILTER, COLUMN_MASKING]
-    PrincipalRef:
-      type: object
-      additionalProperties: false
-      required: [type, id]
-      properties:
-        type:
-          $ref: '#/components/schemas/PrincipalType'
-        id:
-          type: string
-          minLength: 1
+    Principal:
+      type: string
+      minLength: 1
+      maxLength: 128
+      description: |
+        Opaque, canonical, globally unique identifier in the server principal namespace. Type and
+        membership resolution are server responsibilities.
     PermissionResource:
-      description: Exact catalog-scoped resource identity; fields not selected by type are invalid.
+      description: |
+        Exact catalog-scoped wire locator; fields not selected by type are invalid. Servers must
+        bind stored direct assignments to a stable internal resource identity. Renaming a database,
+        table, function, or view retains its direct assignments and responses use the new locator.
+        Dropping a resource removes its direct assignments, and recreating the same locator must not
+        inherit them. A child rename does not affect a CATALOG or DATABASE `DESCENDANTS` assignment.
       oneOf:
         - $ref: '#/components/schemas/CatalogResource'
         - $ref: '#/components/schemas/DatabaseResource'
@@ -531,13 +583,17 @@ components:
         scope:
           $ref: '#/components/schemas/PermissionScope'
         access:
-          type: string
-          minLength: 1
+          $ref: '#/components/schemas/PermissionAccess'
         principal:
-          $ref: '#/components/schemas/PrincipalRef'
+          $ref: '#/components/schemas/Principal'
         expireTime:
           type: string
           format: date-time
+          description: |
+            Exclusive authorization upper bound evaluated using the server clock. At
+            `now >= expireTime` this assignment must not authorize access, including through an
+            inherited effective view. A direct expired record may remain listable until cleanup.
+            The value must have at most millisecond precision.
         inheritedFrom:
           $ref: '#/components/schemas/PermissionResource'
     GrantPermissionRequest:
@@ -551,13 +607,16 @@ components:
           $ref: '#/components/schemas/PermissionScope'
           default: SELF
         access:
-          type: string
-          minLength: 1
+          $ref: '#/components/schemas/PermissionAccess'
         principal:
-          $ref: '#/components/schemas/PrincipalRef'
+          $ref: '#/components/schemas/Principal'
         expireTime:
           type: string
           format: date-time
+          description: |
+            Exclusive authorization upper bound evaluated using the server clock. At
+            `now >= expireTime` the assignment must not authorize access. The value must have at
+            most millisecond precision.
     RevokePermissionRequest:
       type: object
       additionalProperties: false
@@ -569,10 +628,9 @@ components:
           $ref: '#/components/schemas/PermissionScope'
           default: SELF
         access:
-          type: string
-          minLength: 1
+          $ref: '#/components/schemas/PermissionAccess'
         principal:
-          $ref: '#/components/schemas/PrincipalRef'
+          $ref: '#/components/schemas/Principal'
     ListPermissionsResponse:
       type: object
       additionalProperties: false
@@ -608,19 +666,20 @@ components:
     RowFilter:
       type: object
       additionalProperties: false
-      required: [functionName, functionArguments]
+      required: [functionName]
       properties:
         functionName:
           type: string
           minLength: 1
         functionArguments:
           type: array
+          default: []
           items:
             $ref: '#/components/schemas/PolicyArgument'
     ColumnMask:
       type: object
       additionalProperties: false
-      required: [functionName, onColumn, functionArguments]
+      required: [functionName, onColumn]
       properties:
         functionName:
           type: string
@@ -630,59 +689,58 @@ components:
           minLength: 1
         functionArguments:
           type: array
+          default: []
           items:
             $ref: '#/components/schemas/PolicyArgument'
     RowFilterPolicyRequest:
       type: object
       additionalProperties: false
-      required: [name, rowFilter, toPrincipals]
+      required: [rowFilter, principal]
       properties:
-        name:
-          type: string
-          minLength: 1
         rowFilter:
           $ref: '#/components/schemas/RowFilter'
-        toPrincipals:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        exceptPrincipals:
-          type: array
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        comment:
-          type: string
+        principal:
+          $ref: '#/components/schemas/Principal'
     ColumnMaskPolicyRequest:
       type: object
       additionalProperties: false
-      required: [name, columnMask, toPrincipals]
+      required: [columnMask, principal]
       properties:
-        name:
-          type: string
-          minLength: 1
         columnMask:
           $ref: '#/components/schemas/ColumnMask'
-        toPrincipals:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        exceptPrincipals:
-          type: array
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        comment:
-          type: string
+        principal:
+          $ref: '#/components/schemas/Principal'
     PolicyRequest:
-      description: Exactly one typed policy definition is allowed.
+      description: Exactly one typed policy definition for one principal is allowed.
       oneOf:
         - $ref: '#/components/schemas/RowFilterPolicyRequest'
         - $ref: '#/components/schemas/ColumnMaskPolicyRequest'
+    RowFilterPolicyIdentity:
+      type: object
+      additionalProperties: false
+      required: [type, principal]
+      properties:
+        type:
+          const: ROW_FILTER
+        principal:
+          $ref: '#/components/schemas/Principal'
+    ColumnMaskPolicyIdentity:
+      type: object
+      additionalProperties: false
+      required: [type, principal, column]
+      properties:
+        type:
+          const: COLUMN_MASKING
+        principal:
+          $ref: '#/components/schemas/Principal'
+        column:
+          type: string
+          minLength: 1
+    DropPolicyRequest:
+      description: Exact principal policy identity on the table named by the request path.
+      oneOf:
+        - $ref: '#/components/schemas/RowFilterPolicyIdentity'
+        - $ref: '#/components/schemas/ColumnMaskPolicyIdentity'
     TablePolicyResource:
       type: object
       additionalProperties: false
@@ -699,54 +757,31 @@ components:
     RowFilterDataPolicy:
       type: object
       additionalProperties: false
-      required: [resource, name, rowFilter, toPrincipals, exceptPrincipals]
+      required: [resource, rowFilter, principal]
       properties:
         resource:
           $ref: '#/components/schemas/TablePolicyResource'
-        name:
-          type: string
-          minLength: 1
         rowFilter:
           $ref: '#/components/schemas/RowFilter'
-        toPrincipals:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        exceptPrincipals:
-          type: array
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        comment:
-          type: string
+        principal:
+          $ref: '#/components/schemas/Principal'
     ColumnMaskDataPolicy:
       type: object
       additionalProperties: false
-      required: [resource, name, columnMask, toPrincipals, exceptPrincipals]
+      required: [resource, columnMask, principal]
       properties:
         resource:
           $ref: '#/components/schemas/TablePolicyResource'
-        name:
-          type: string
-          minLength: 1
         columnMask:
           $ref: '#/components/schemas/ColumnMask'
-        toPrincipals:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        exceptPrincipals:
-          type: array
-          uniqueItems: true
-          items:
-            $ref: '#/components/schemas/PrincipalRef'
-        comment:
-          type: string
+        principal:
+          $ref: '#/components/schemas/Principal'
     DataPolicy:
+      description: |
+        A policy applies when its principal is effective for the caller. All applicable row filters
+        must be combined with logical AND. More than one applicable column mask for the same column
+        must fail closed. An unresolved function, invalid signature, or policy compilation failure
+        must also fail closed rather than omit a restriction.
       oneOf:
         - $ref: '#/components/schemas/RowFilterDataPolicy'
         - $ref: '#/components/schemas/ColumnMaskDataPolicy'
@@ -761,13 +796,6 @@ components:
             $ref: '#/components/schemas/DataPolicy'
         nextPageToken:
           type: string
-    GetPolicyResponse:
-      type: object
-      additionalProperties: false
-      required: [policy]
-      properties:
-        policy:
-          $ref: '#/components/schemas/DataPolicy'
     ErrorResponse:
       type: object
       additionalProperties: true
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
index fb7f376ecc61..72afd38e035a 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
@@ -29,34 +29,30 @@
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Objects;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Named row-filter or column-mask policy attached to one table. */
+/**
+ * Principal-scoped row-filter or column-mask policy attached to one table.
+ *
+ * <p>A principal has at most one row filter per table and at most one mask per table column. When
+ * policies are enforced, applicable row filters are combined with logical AND and multiple
+ * effective masks for one column fail closed. Resolution, signature, and compilation failures also
+ * fail closed.
+ */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class DataPolicy {
 
     private static final String FIELD_RESOURCE = "resource";
-    private static final String FIELD_NAME = "name";
     private static final String FIELD_ROW_FILTER = "rowFilter";
     private static final String FIELD_COLUMN_MASK = "columnMask";
-    private static final String FIELD_TO_PRINCIPALS = "toPrincipals";
-    private static final String FIELD_EXCEPT_PRINCIPALS = "exceptPrincipals";
-    private static final String FIELD_COMMENT = "comment";
+    private static final String FIELD_PRINCIPAL = "principal";
 
     @JsonProperty(FIELD_RESOURCE)
     private final PermissionResource resource;
 
-    @JsonProperty(FIELD_NAME)
-    private final String name;
-
     @Nullable
     @JsonProperty(FIELD_ROW_FILTER)
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -67,85 +63,34 @@ public class DataPolicy {
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private final ColumnMask columnMask;
 
-    @JsonProperty(FIELD_TO_PRINCIPALS)
-    private final List<PrincipalRef> toPrincipals;
-
-    @JsonProperty(FIELD_EXCEPT_PRINCIPALS)
-    private final List<PrincipalRef> exceptPrincipals;
-
-    @Nullable
-    @JsonProperty(FIELD_COMMENT)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String comment;
+    @JsonProperty(FIELD_PRINCIPAL)
+    private final String principal;
 
     @JsonCreator
-    @ConstructorProperties({
-        FIELD_RESOURCE,
-        FIELD_NAME,
-        FIELD_ROW_FILTER,
-        FIELD_COLUMN_MASK,
-        FIELD_TO_PRINCIPALS,
-        FIELD_EXCEPT_PRINCIPALS,
-        FIELD_COMMENT
-    })
+    @ConstructorProperties({FIELD_RESOURCE, FIELD_ROW_FILTER, FIELD_COLUMN_MASK, FIELD_PRINCIPAL})
     public DataPolicy(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
-            @JsonProperty(FIELD_NAME) String name,
             @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
             @Nullable @JsonProperty(FIELD_COLUMN_MASK) ColumnMask columnMask,
-            @JsonProperty(FIELD_TO_PRINCIPALS) List<PrincipalRef> toPrincipals,
-            @Nullable @JsonProperty(FIELD_EXCEPT_PRINCIPALS) List<PrincipalRef> exceptPrincipals,
-            @Nullable @JsonProperty(FIELD_COMMENT) String comment) {
+            @JsonProperty(FIELD_PRINCIPAL) String principal) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         resource.validatePolicyAttachment();
-        checkArgument(!isBlank(name), "policy name cannot be empty.");
-        this.name = name;
         checkArgument(
                 (rowFilter == null) != (columnMask == null),
                 "A policy must contain exactly one of rowFilter and columnMask.");
         this.rowFilter = rowFilter;
         this.columnMask = columnMask;
-        checkArgument(
-                toPrincipals != null && !toPrincipals.isEmpty(),
-                "toPrincipals must contain at least one principal.");
-        checkArgument(
-                toPrincipals.stream().noneMatch(Objects::isNull),
-                "toPrincipals cannot contain null principals.");
-        checkArgument(
-                new HashSet<>(toPrincipals).size() == toPrincipals.size(),
-                "toPrincipals cannot contain duplicate principals.");
-        this.toPrincipals = immutable(toPrincipals);
-        List<PrincipalRef> exclusions = immutable(exceptPrincipals);
-        checkArgument(
-                exclusions.stream().noneMatch(Objects::isNull),
-                "exceptPrincipals cannot contain null principals.");
-        checkArgument(
-                new HashSet<>(exclusions).size() == exclusions.size(),
-                "exceptPrincipals cannot contain duplicate principals.");
-        this.exceptPrincipals = exclusions;
-        this.comment = isBlank(comment) ? null : comment;
+        this.principal = PermissionAssignment.validatePrincipal(principal);
     }
 
     public static DataPolicy rowFilter(
-            PermissionResource resource,
-            String name,
-            RowFilter rowFilter,
-            List<PrincipalRef> toPrincipals,
-            @Nullable List<PrincipalRef> exceptPrincipals,
-            @Nullable String comment) {
-        return new DataPolicy(
-                resource, name, rowFilter, null, toPrincipals, exceptPrincipals, comment);
+            PermissionResource resource, RowFilter rowFilter, String principal) {
+        return new DataPolicy(resource, rowFilter, null, principal);
     }
 
     public static DataPolicy columnMask(
-            PermissionResource resource,
-            String name,
-            ColumnMask columnMask,
-            List<PrincipalRef> toPrincipals,
-            @Nullable List<PrincipalRef> exceptPrincipals,
-            @Nullable String comment) {
-        return new DataPolicy(
-                resource, name, null, columnMask, toPrincipals, exceptPrincipals, comment);
+            PermissionResource resource, ColumnMask columnMask, String principal) {
+        return new DataPolicy(resource, null, columnMask, principal);
     }
 
     @JsonGetter(FIELD_RESOURCE)
@@ -153,11 +98,6 @@ public PermissionResource getResource() {
         return resource;
     }
 
-    @JsonGetter(FIELD_NAME)
-    public String getName() {
-        return name;
-    }
-
     @Nullable
     @JsonGetter(FIELD_ROW_FILTER)
     public RowFilter getRowFilter() {
@@ -174,29 +114,8 @@ public PolicyType type() {
         return rowFilter == null ? PolicyType.COLUMN_MASKING : PolicyType.ROW_FILTER;
     }
 
-    @JsonGetter(FIELD_TO_PRINCIPALS)
-    public List<PrincipalRef> getToPrincipals() {
-        return toPrincipals;
-    }
-
-    @JsonGetter(FIELD_EXCEPT_PRINCIPALS)
-    public List<PrincipalRef> getExceptPrincipals() {
-        return exceptPrincipals;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COMMENT)
-    public String getComment() {
-        return comment;
-    }
-
-    private static <T> List<T> immutable(@Nullable List<T> values) {
-        return values == null
-                ? Collections.emptyList()
-                : Collections.unmodifiableList(new ArrayList<>(values));
-    }
-
-    private static boolean isBlank(@Nullable String value) {
-        return value == null || value.trim().isEmpty();
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return principal;
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
index 1855cea9a63d..7a0059ef9037 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -33,7 +33,6 @@ public class ListPermissionsRequest {
 
     private final PermissionResource resource;
     @Nullable private final PermissionScope scope;
-    @Nullable private final PrincipalType principalType;
     @Nullable private final String principal;
     @Nullable private final String access;
     private final boolean includeInherited;
@@ -47,7 +46,6 @@ public ListPermissionsRequest(
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
-            @Nullable PrincipalType principalType,
             @Nullable String principal,
             @Nullable String access,
             boolean includeInherited,
@@ -59,16 +57,15 @@ public ListPermissionsRequest(
                     resourceType == ResourceType.CATALOG || resourceType == ResourceType.DATABASE,
                     "DESCENDANTS scope applies only to CATALOG or DATABASE assignments.");
         }
-        checkArgument(
-                (principalType == null) == isBlank(principal),
-                "principalType and principal must be specified together.");
+        if (!isBlank(principal)) {
+            PermissionAssignment.validatePrincipal(principal);
+        }
         checkArgument(maxResults == null || maxResults > 0, "maxResults must be greater than 0.");
         checkArgument(
                 maxResults == null || maxResults <= MAX_PAGE_SIZE,
                 "maxResults must be at most %s.",
                 MAX_PAGE_SIZE);
         this.scope = scope;
-        this.principalType = principalType;
         this.principal = isBlank(principal) ? null : principal;
         this.access =
                 isBlank(access)
@@ -110,11 +107,6 @@ public String getView() {
         return resource.getView();
     }
 
-    @Nullable
-    public PrincipalType getPrincipalType() {
-        return principalType;
-    }
-
     @Nullable
     public String getPrincipal() {
         return principal;
@@ -151,7 +143,6 @@ public ListPermissionsRequest withPageToken(@Nullable String newPageToken) {
                 resource.getTable(),
                 resource.getFunction(),
                 resource.getView(),
-                principalType,
                 principal,
                 access,
                 includeInherited,
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
index 6f1667614377..c8be5b39fc21 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPoliciesRequest.java
@@ -30,35 +30,35 @@
 public class ListPoliciesRequest {
 
     private final PermissionResource resource;
-    @Nullable private final String name;
     @Nullable private final PolicyType type;
-    @Nullable private final PrincipalType principalType;
     @Nullable private final String principal;
+    @Nullable private final String column;
     @Nullable private final String pageToken;
     @Nullable private final Integer maxResults;
 
     public ListPoliciesRequest(
             PermissionResource resource,
-            @Nullable String name,
             @Nullable PolicyType type,
-            @Nullable PrincipalType principalType,
             @Nullable String principal,
+            @Nullable String column,
             @Nullable String pageToken,
             @Nullable Integer maxResults) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         resource.validatePolicyAttachment();
-        checkArgument(
-                (principalType == null) == isBlank(principal),
-                "principalType and principal must be specified together.");
+        if (!isBlank(principal)) {
+            PermissionAssignment.validatePrincipal(principal);
+        }
         checkArgument(maxResults == null || maxResults > 0, "maxResults must be greater than 0.");
         checkArgument(
                 maxResults == null || maxResults <= ListPermissionsRequest.MAX_PAGE_SIZE,
                 "maxResults must be at most %s.",
                 ListPermissionsRequest.MAX_PAGE_SIZE);
-        this.name = isBlank(name) ? null : name;
         this.type = type;
-        this.principalType = principalType;
         this.principal = isBlank(principal) ? null : principal;
+        checkArgument(
+                isBlank(column) || type == PolicyType.COLUMN_MASKING,
+                "column filter requires type COLUMN_MASKING.");
+        this.column = isBlank(column) ? null : column;
         this.pageToken = isBlank(pageToken) ? null : pageToken;
         this.maxResults = maxResults;
     }
@@ -67,24 +67,19 @@ public PermissionResource getResource() {
         return resource;
     }
 
-    @Nullable
-    public String getName() {
-        return name;
-    }
-
     @Nullable
     public PolicyType getType() {
         return type;
     }
 
     @Nullable
-    public PrincipalType getPrincipalType() {
-        return principalType;
+    public String getPrincipal() {
+        return principal;
     }
 
     @Nullable
-    public String getPrincipal() {
-        return principal;
+    public String getColumn() {
+        return column;
     }
 
     @Nullable
@@ -98,8 +93,7 @@ public Integer getMaxResults() {
     }
 
     public ListPoliciesRequest withPageToken(@Nullable String newPageToken) {
-        return new ListPoliciesRequest(
-                resource, name, type, principalType, principal, newPageToken, maxResults);
+        return new ListPoliciesRequest(resource, type, principal, column, newPageToken, maxResults);
     }
 
     private static boolean isBlank(@Nullable String value) {
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
index 8bfbeb17f2bf..77b3949d626d 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
@@ -31,10 +31,18 @@
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Built-in access names and validation for permission assignments. */
+/**
+ * Built-in access names and validation for permission assignments.
+ *
+ * <p>Java callers may use any letter case. Values are canonicalized to the upper-case REST wire
+ * representation; server extensions must use the namespaced {@code NAMESPACE/ACCESS} form.
+ */
 @Experimental
 public final class PermissionAccess {
 
+    /** Maximum wire length supported by the portable permission storage contract. */
+    public static final int MAX_LENGTH = 32;
+
     public static final String USE_CATALOG = "USE_CATALOG";
     public static final String CREATE_DATABASE = "CREATE_DATABASE";
     public static final String USE_DATABASE = "USE_DATABASE";
@@ -58,7 +66,15 @@ private PermissionAccess() {}
 
     public static String canonicalize(String access) {
         checkArgument(access != null && !access.trim().isEmpty(), "access cannot be empty.");
+        checkArgument(
+                access.length() <= MAX_LENGTH,
+                "access must contain at most %s characters.",
+                MAX_LENGTH);
         String canonical = access.toUpperCase(Locale.ROOT);
+        checkArgument(
+                canonical.length() <= MAX_LENGTH,
+                "access must contain at most %s characters after canonicalization.",
+                MAX_LENGTH);
         if (EXTENSION_ACCESS.matcher(canonical).matches()
                 || BUILT_INS.values().stream().anyMatch(values -> values.contains(canonical))) {
             return canonical;
@@ -72,6 +88,7 @@ public static String canonicalize(String access) {
     public static String canonicalize(
             PermissionResource resource, PermissionScope scope, String access) {
         String canonical = canonicalize(access);
+        validateScope(resource.getType(), scope);
         if (EXTENSION_ACCESS.matcher(canonical).matches()) {
             return canonical;
         }
@@ -113,9 +130,7 @@ private static boolean appliesTo(ResourceType type, PermissionScope scope, Strin
         if (scope == PermissionScope.SELF) {
             return BUILT_INS.get(type).contains(access);
         }
-        checkArgument(
-                type == ResourceType.CATALOG || type == ResourceType.DATABASE,
-                "DESCENDANTS scope is supported only for CATALOG and DATABASE resources.");
+        validateScope(type, scope);
         if (type == ResourceType.CATALOG && BUILT_INS.get(ResourceType.DATABASE).contains(access)) {
             return true;
         }
@@ -124,6 +139,14 @@ private static boolean appliesTo(ResourceType type, PermissionScope scope, Strin
                 || BUILT_INS.get(ResourceType.FUNCTION).contains(access);
     }
 
+    private static void validateScope(ResourceType type, PermissionScope scope) {
+        checkArgument(
+                scope != PermissionScope.DESCENDANTS
+                        || type == ResourceType.CATALOG
+                        || type == ResourceType.DATABASE,
+                "DESCENDANTS scope is supported only for CATALOG and DATABASE resources.");
+    }
+
     private static Map<ResourceType, Set<String>> builtIns() {
         Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
         accesses.put(
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
index 553c0f84e8ab..61049895781c 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
@@ -35,11 +35,20 @@
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Direct permission assignment or a resource-inherited view of one. */
+/**
+ * Direct permission assignment or a resource-inherited view of one.
+ *
+ * <p>{@code expireTime}, when present, is an exclusive authorization upper bound evaluated against
+ * the server clock. At or after that instant, the assignment must not authorize access or produce
+ * an effective inherited view, although a direct expired record may remain listable until cleanup.
+ */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class PermissionAssignment {
 
+    /** Maximum principal identifier length in the portable REST management contract. */
+    public static final int MAX_PRINCIPAL_LENGTH = 128;
+
     private static final String FIELD_RESOURCE = "resource";
     private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
@@ -57,7 +66,7 @@ public class PermissionAssignment {
     private final String access;
 
     @JsonProperty(FIELD_PRINCIPAL)
-    private final PrincipalRef principal;
+    private final String principal;
 
     @Nullable
     @JsonProperty(FIELD_EXPIRE_TIME)
@@ -82,7 +91,7 @@ public PermissionAssignment(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal,
+            @JsonProperty(FIELD_PRINCIPAL) String principal,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime,
             @Nullable @JsonProperty(FIELD_INHERITED_FROM) PermissionResource inheritedFrom) {
         this(
@@ -98,16 +107,19 @@ public PermissionAssignment(
             PermissionResource resource,
             PermissionScope scope,
             String access,
-            PrincipalRef principal,
+            String principal,
             @Nullable String expireTime,
             @Nullable PermissionResource inheritedFrom) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         this.scope = checkNotNull(scope, "scope cannot be null");
         this.access = PermissionAccess.canonicalize(resource, scope, access);
-        this.principal = checkNotNull(principal, "principal cannot be null");
+        this.principal = validatePrincipal(principal);
         if (expireTime != null) {
             try {
-                Instant.parse(expireTime);
+                Instant instant = Instant.parse(expireTime);
+                checkArgument(
+                        instant.getNano() % 1_000_000 == 0,
+                        "expireTime must have at most millisecond precision.");
             } catch (DateTimeParseException e) {
                 throw new IllegalArgumentException(
                         "expireTime must be an ISO-8601 UTC instant.", e);
@@ -136,10 +148,21 @@ public String getAccess() {
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
-    public PrincipalRef getPrincipal() {
+    public String getPrincipal() {
+        return principal;
+    }
+
+    static String validatePrincipal(String principal) {
+        checkArgument(
+                principal != null && !principal.trim().isEmpty(), "principal cannot be empty.");
+        checkArgument(
+                principal.length() <= MAX_PRINCIPAL_LENGTH,
+                "principal must contain at most %s characters.",
+                MAX_PRINCIPAL_LENGTH);
         return principal;
     }
 
+    /** Returns the exclusive authorization upper bound, or null for no expiry. */
     @Nullable
     @JsonGetter(FIELD_EXPIRE_TIME)
     public String getExpireTime() {
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
index 3481724eeadb..214ebef4b51d 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
@@ -31,23 +31,21 @@ public class PermissionIdentity {
     private final PermissionResource resource;
     private final PermissionScope scope;
     private final String access;
-    private final PrincipalRef principal;
+    private final String principal;
 
     public PermissionIdentity(
-            PermissionResource resource,
-            PermissionScope scope,
-            String access,
-            PrincipalRef principal) {
+            PermissionResource resource, PermissionScope scope, String access, String principal) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         this.scope = checkNotNull(scope, "scope cannot be null");
         this.access = PermissionAccess.canonicalize(resource, scope, access);
-        this.principal = checkNotNull(principal, "principal cannot be null");
+        this.principal = PermissionAssignment.validatePrincipal(principal);
     }
 
     public static PermissionIdentity fromAssignment(PermissionAssignment assignment) {
+        PermissionResource inheritedFrom = assignment.getInheritedFrom();
         return new PermissionIdentity(
-                assignment.getResource(),
-                assignment.getScope(),
+                inheritedFrom == null ? assignment.getResource() : inheritedFrom,
+                inheritedFrom == null ? assignment.getScope() : PermissionScope.DESCENDANTS,
                 assignment.getAccess(),
                 assignment.getPrincipal());
     }
@@ -64,7 +62,7 @@ public String getAccess() {
         return access;
     }
 
-    public PrincipalRef getPrincipal() {
+    public String getPrincipal() {
         return principal;
     }
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
index 628bdd2eef2d..3c4003664517 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
@@ -20,32 +20,70 @@
 
 import org.apache.paimon.annotation.Experimental;
 
+import javax.annotation.Nullable;
+
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Resource-scoped identity of a named data policy. */
+/** Resource-scoped identity of one principal's row filter or column mask. */
 @Experimental
 public class PolicyIdentity {
 
     private final PermissionResource resource;
-    private final String name;
+    private final PolicyType type;
+    private final String principal;
+    @Nullable private final String column;
 
-    public PolicyIdentity(PermissionResource resource, String name) {
+    public PolicyIdentity(
+            PermissionResource resource,
+            PolicyType type,
+            String principal,
+            @Nullable String column) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         resource.validatePolicyAttachment();
-        checkArgument(name != null && !name.trim().isEmpty(), "policy name cannot be empty.");
-        this.name = name;
+        this.type = checkNotNull(type, "policy type cannot be null");
+        this.principal = PermissionAssignment.validatePrincipal(principal);
+        if (type == PolicyType.ROW_FILTER) {
+            checkArgument(isBlank(column), "ROW_FILTER identity cannot contain a column.");
+            this.column = null;
+        } else {
+            checkArgument(!isBlank(column), "column is required for COLUMN_MASKING identity.");
+            this.column = column;
+        }
     }
 
     public static PolicyIdentity fromPolicy(DataPolicy policy) {
-        return new PolicyIdentity(policy.getResource(), policy.getName());
+        ColumnMask columnMask = policy.getColumnMask();
+        return new PolicyIdentity(
+                policy.getResource(),
+                policy.type(),
+                policy.getPrincipal(),
+                columnMask == null ? null : columnMask.getOnColumn());
     }
 
     public PermissionResource getResource() {
         return resource;
     }
 
-    public String getName() {
-        return name;
+    public PolicyType getType() {
+        return type;
+    }
+
+    public String getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    public String getColumn() {
+        return column;
+    }
+
+    /** Stable wire identity used in error responses. */
+    public String resourceName() {
+        return type.name() + ":" + principal + (column == null ? "" : ":" + column);
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
index 1320277028ed..2a212316c7ac 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
@@ -27,8 +27,6 @@ public interface PolicyManagement {
 
     PagedList<DataPolicy> listPolicies(ListPoliciesRequest request);
 
-    DataPolicy getPolicy(PolicyIdentity identity);
-
     void createPolicy(DataPolicy policy);
 
     void createOrReplacePolicy(DataPolicy policy);
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
deleted file mode 100644
index 9a0bace674c1..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalRef.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.beans.ConstructorProperties;
-import java.util.Objects;
-
-import static org.apache.paimon.utils.Preconditions.checkArgument;
-import static org.apache.paimon.utils.Preconditions.checkNotNull;
-
-/** Stable reference to a permission principal. */
-@Experimental
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class PrincipalRef {
-
-    private static final String FIELD_TYPE = "type";
-    private static final String FIELD_ID = "id";
-
-    @JsonProperty(FIELD_TYPE)
-    private final PrincipalType type;
-
-    @JsonProperty(FIELD_ID)
-    private final String id;
-
-    @JsonCreator
-    @ConstructorProperties({FIELD_TYPE, FIELD_ID})
-    public PrincipalRef(@JsonProperty(FIELD_TYPE) String type, @JsonProperty(FIELD_ID) String id) {
-        this(PrincipalType.fromString(type), id);
-    }
-
-    public PrincipalRef(PrincipalType type, String id) {
-        this.type = checkNotNull(type, "principal type cannot be null");
-        checkArgument(!isBlank(id), "principal id cannot be empty.");
-        this.id = id;
-    }
-
-    @JsonGetter(FIELD_TYPE)
-    public PrincipalType getType() {
-        return type;
-    }
-
-    @JsonGetter(FIELD_ID)
-    public String getId() {
-        return id;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (!(o instanceof PrincipalRef)) {
-            return false;
-        }
-        PrincipalRef that = (PrincipalRef) o;
-        return type == that.type && id.equals(that.id);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(type, id);
-    }
-
-    private static boolean isBlank(String value) {
-        return value == null || value.trim().isEmpty();
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java b/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
deleted file mode 100644
index 0461e5ebd3b2..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PrincipalType.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import javax.annotation.Nullable;
-
-import java.util.Locale;
-
-/** Principal types supported by permission management. */
-@Experimental
-public enum PrincipalType {
-    USER,
-    GROUP,
-    ROLE,
-    SERVICE;
-
-    @Nullable
-    public static PrincipalType fromString(@Nullable String value) {
-        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index 136119d7a35e..cc6f838204ff 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -54,6 +54,7 @@
 import org.apache.paimon.rest.requests.CreateTagRequest;
 import org.apache.paimon.rest.requests.CreateViewRequest;
 import org.apache.paimon.rest.requests.DropPartitionsRequest;
+import org.apache.paimon.rest.requests.DropPolicyRequest;
 import org.apache.paimon.rest.requests.ForwardBranchRequest;
 import org.apache.paimon.rest.requests.GrantPermissionRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
@@ -76,7 +77,6 @@
 import org.apache.paimon.rest.responses.ErrorResponse;
 import org.apache.paimon.rest.responses.GetDatabaseResponse;
 import org.apache.paimon.rest.responses.GetFunctionResponse;
-import org.apache.paimon.rest.responses.GetPolicyResponse;
 import org.apache.paimon.rest.responses.GetTableResponse;
 import org.apache.paimon.rest.responses.GetTableSnapshotResponse;
 import org.apache.paimon.rest.responses.GetTableTokenResponse;
@@ -858,9 +858,6 @@ public ListPermissionsResponse listPermissions(ListPermissionsRequest request) {
         putQueryParameter(queryParams, "table", request.getTable());
         putQueryParameter(queryParams, "function", request.getFunction());
         putQueryParameter(queryParams, "view", request.getView());
-        if (request.getPrincipalType() != null) {
-            putQueryParameter(queryParams, "principalType", request.getPrincipalType().name());
-        }
         putQueryParameter(queryParams, "principal", request.getPrincipal());
         putQueryParameter(queryParams, "access", request.getAccess());
         if (request.includeInherited()) {
@@ -899,14 +896,11 @@ public void revokePermission(PermissionIdentity identity) {
     @Experimental
     public ListPoliciesResponse listPolicies(ListPoliciesRequest request) {
         Map<String, String> queryParams = Maps.newHashMap();
-        putQueryParameter(queryParams, "name", request.getName());
         if (request.getType() != null) {
             putQueryParameter(queryParams, "type", request.getType().name());
         }
-        if (request.getPrincipalType() != null) {
-            putQueryParameter(queryParams, "principalType", request.getPrincipalType().name());
-        }
         putQueryParameter(queryParams, "principal", request.getPrincipal());
+        putQueryParameter(queryParams, "column", request.getColumn());
         if (request.getMaxResults() != null) {
             queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
         }
@@ -918,16 +912,7 @@ public ListPoliciesResponse listPolicies(ListPoliciesRequest request) {
                 restAuthFunction);
     }
 
-    /** Gets a named policy from its exact attachment resource. */
-    @Experimental
-    public GetPolicyResponse getPolicy(PolicyIdentity identity) {
-        return client.get(
-                resourcePaths.policy(identity.getResource(), identity.getName()),
-                GetPolicyResponse.class,
-                restAuthFunction);
-    }
-
-    /** Creates a named policy on its attachment resource. */
+    /** Creates a principal policy on its attachment resource. */
     @Experimental
     public void createPolicy(DataPolicy policy) {
         client.post(
@@ -936,26 +921,26 @@ public void createPolicy(DataPolicy policy) {
                 restAuthFunction);
     }
 
-    /** Creates or fully replaces a named policy without changing its identity. */
+    /** Creates or fully replaces a principal policy without changing its identity. */
     @Experimental
     public void createOrReplacePolicy(DataPolicy policy) {
         client.put(
-                resourcePaths.policy(policy.getResource(), policy.getName()),
+                resourcePaths.policies(policy.getResource()),
                 new PolicyRequest(policy),
                 restAuthFunction);
     }
 
-    /** Drops a named policy from its exact attachment resource. */
+    /** Drops a principal policy from its exact attachment resource. */
     @Experimental
     public void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists) {
         try {
             client.delete(
-                    resourcePaths.policy(identity.getResource(), identity.getName()),
+                    resourcePaths.policies(identity.getResource()),
+                    new DropPolicyRequest(identity),
                     restAuthFunction);
         } catch (NoSuchResourceException e) {
             if (!ignoreIfNotExists
-                    || !ErrorResponse.RESOURCE_TYPE_POLICY.equals(e.resourceType())
-                    || !identity.getName().equals(e.resourceName())) {
+                    || !ErrorResponse.RESOURCE_TYPE_POLICY.equals(e.resourceType())) {
                 throw e;
             }
         }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
index 5c93756f1bda..2d82739afeb4 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
@@ -42,11 +42,6 @@ public PagedList<DataPolicy> listPolicies(ListPoliciesRequest request) {
         return new PagedList<>(response.getPolicies(), response.getNextPageToken());
     }
 
-    @Override
-    public DataPolicy getPolicy(PolicyIdentity identity) {
-        return api.getPolicy(identity).getPolicy();
-    }
-
     @Override
     public void createPolicy(DataPolicy policy) {
         api.createPolicy(policy);
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
index e312675ed679..5b79d61ac5d3 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/ResourcePaths.java
@@ -86,12 +86,6 @@ public String policies(PermissionResource resource) {
         return SLASH.join(table(resource.getDatabase(), resource.getTable()), POLICIES);
     }
 
-    /** Named policy nested below its attachment resource. */
-    @Experimental
-    public String policy(PermissionResource resource, String policyName) {
-        return SLASH.join(policies(resource), encodeString(policyName));
-    }
-
     public String databases() {
         return SLASH.join(V1, prefix, DATABASES);
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
new file mode 100644
index 000000000000..997fa38e4713
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest.requests;
+
+import org.apache.paimon.annotation.Experimental;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyType;
+import org.apache.paimon.rest.RESTRequest;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+
+/** Request for dropping one principal's row filter or column mask. */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class DropPolicyRequest implements RESTRequest {
+
+    private static final String FIELD_TYPE = "type";
+    private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_COLUMN = "column";
+
+    private final PolicyType type;
+    private final String principal;
+    @Nullable private final String column;
+
+    public DropPolicyRequest(PolicyIdentity identity) {
+        this(identity.getType(), identity.getPrincipal(), identity.getColumn());
+    }
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_TYPE, FIELD_PRINCIPAL, FIELD_COLUMN})
+    public DropPolicyRequest(
+            @JsonProperty(FIELD_TYPE) PolicyType type,
+            @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @Nullable @JsonProperty(FIELD_COLUMN) String column) {
+        this.type = type;
+        this.principal = principal;
+        this.column = column;
+    }
+
+    public PolicyIdentity identity(PermissionResource resource) {
+        return new PolicyIdentity(resource, type, principal, column);
+    }
+
+    @JsonGetter(FIELD_TYPE)
+    public PolicyType getType() {
+        return type;
+    }
+
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return principal;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public String getColumn() {
+        return column;
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
index ba701862927f..8b9e389e541b 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
@@ -22,7 +22,6 @@
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.PrincipalRef;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
@@ -69,7 +68,7 @@ public GrantPermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal,
+            @JsonProperty(FIELD_PRINCIPAL) String principal,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
         this.assignment =
                 new PermissionAssignment(
@@ -101,7 +100,7 @@ public String getAccess() {
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
-    public PrincipalRef getPrincipal() {
+    public String getPrincipal() {
         return assignment.getPrincipal();
     }
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
index 2426972661cd..50fa7d848ecf 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
@@ -22,7 +22,6 @@
 import org.apache.paimon.management.ColumnMask;
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PrincipalRef;
 import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.rest.RESTRequest;
 
@@ -36,78 +35,48 @@
 import javax.annotation.Nullable;
 
 import java.beans.ConstructorProperties;
-import java.util.List;
 
-/** Create or replace payload for a policy whose table is identified by the request path. */
+/**
+ * Create or replace payload for a principal policy whose table is identified by the request path.
+ */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class PolicyRequest implements RESTRequest {
 
-    private static final String FIELD_NAME = "name";
     private static final String FIELD_ROW_FILTER = "rowFilter";
     private static final String FIELD_COLUMN_MASK = "columnMask";
-    private static final String FIELD_TO_PRINCIPALS = "toPrincipals";
-    private static final String FIELD_EXCEPT_PRINCIPALS = "exceptPrincipals";
-    private static final String FIELD_COMMENT = "comment";
+    private static final String FIELD_PRINCIPAL = "principal";
 
-    private final String name;
     @Nullable private final RowFilter rowFilter;
     @Nullable private final ColumnMask columnMask;
-    private final List<PrincipalRef> toPrincipals;
-    private final List<PrincipalRef> exceptPrincipals;
-    @Nullable private final String comment;
+    private final String principal;
 
     public PolicyRequest(DataPolicy policy) {
-        this(
-                policy.getName(),
-                policy.getRowFilter(),
-                policy.getColumnMask(),
-                policy.getToPrincipals(),
-                policy.getExceptPrincipals(),
-                policy.getComment());
+        this(policy.getRowFilter(), policy.getColumnMask(), policy.getPrincipal());
     }
 
     @JsonCreator
-    @ConstructorProperties({
-        FIELD_NAME,
-        FIELD_ROW_FILTER,
-        FIELD_COLUMN_MASK,
-        FIELD_TO_PRINCIPALS,
-        FIELD_EXCEPT_PRINCIPALS,
-        FIELD_COMMENT
-    })
+    @ConstructorProperties({FIELD_ROW_FILTER, FIELD_COLUMN_MASK, FIELD_PRINCIPAL})
     public PolicyRequest(
-            @JsonProperty(FIELD_NAME) String name,
             @Nullable @JsonProperty(FIELD_ROW_FILTER) RowFilter rowFilter,
             @Nullable @JsonProperty(FIELD_COLUMN_MASK) ColumnMask columnMask,
-            @JsonProperty(FIELD_TO_PRINCIPALS) List<PrincipalRef> toPrincipals,
-            @Nullable @JsonProperty(FIELD_EXCEPT_PRINCIPALS) List<PrincipalRef> exceptPrincipals,
-            @Nullable @JsonProperty(FIELD_COMMENT) String comment) {
-        this.name = name;
+            @JsonProperty(FIELD_PRINCIPAL) String principal) {
         this.rowFilter = rowFilter;
         this.columnMask = columnMask;
-        this.toPrincipals = toPrincipals;
-        this.exceptPrincipals = exceptPrincipals;
-        this.comment = comment;
+        this.principal = principal;
     }
 
     public DataPolicy policy(PermissionResource resource) {
-        return new DataPolicy(
-                resource, name, rowFilter, columnMask, toPrincipals, exceptPrincipals, comment);
+        return new DataPolicy(resource, rowFilter, columnMask, principal);
     }
 
-    /** Creating a named resource cannot be replayed after an ambiguous server response. */
+    /** Creating a principal policy cannot be replayed after an ambiguous server response. */
     @JsonIgnore
     @Override
     public boolean isRetrySafe() {
         return false;
     }
 
-    @JsonGetter(FIELD_NAME)
-    public String getName() {
-        return name;
-    }
-
     @Nullable
     @JsonGetter(FIELD_ROW_FILTER)
     @JsonInclude(JsonInclude.Include.NON_NULL)
@@ -122,20 +91,8 @@ public ColumnMask getColumnMask() {
         return columnMask;
     }
 
-    @JsonGetter(FIELD_TO_PRINCIPALS)
-    public List<PrincipalRef> getToPrincipals() {
-        return toPrincipals;
-    }
-
-    @JsonGetter(FIELD_EXCEPT_PRINCIPALS)
-    public List<PrincipalRef> getExceptPrincipals() {
-        return exceptPrincipals;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COMMENT)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    public String getComment() {
-        return comment;
+    @JsonGetter(FIELD_PRINCIPAL)
+    public String getPrincipal() {
+        return principal;
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
index 245d0bc6129f..7100a7871d8a 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
@@ -22,7 +22,6 @@
 import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.PrincipalRef;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
@@ -56,7 +55,7 @@ public RevokePermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
-            @JsonProperty(FIELD_PRINCIPAL) PrincipalRef principal) {
+            @JsonProperty(FIELD_PRINCIPAL) String principal) {
         this.identity =
                 new PermissionIdentity(
                         resource,
@@ -81,7 +80,7 @@ public String getAccess() {
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
-    public PrincipalRef getPrincipal() {
+    public String getPrincipal() {
         return identity.getPrincipal();
     }
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java b/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
deleted file mode 100644
index 17c6c40cc361..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/rest/responses/GetPolicyResponse.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.rest.responses;
-
-import org.apache.paimon.annotation.Experimental;
-import org.apache.paimon.management.DataPolicy;
-import org.apache.paimon.rest.RESTResponse;
-
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
-
-/** Response containing one data policy. */
-@Experimental
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetPolicyResponse implements RESTResponse {
-
-    private static final String FIELD_POLICY = "policy";
-
-    private final DataPolicy policy;
-
-    @JsonCreator
-    public GetPolicyResponse(@JsonProperty(FIELD_POLICY) DataPolicy policy) {
-        this.policy = policy;
-    }
-
-    @JsonGetter(FIELD_POLICY)
-    public DataPolicy getPolicy() {
-        return policy;
-    }
-}
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index b0accec6aad7..2b390b52e2a5 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -19,17 +19,15 @@
 package org.apache.paimon.management;
 
 import org.apache.paimon.rest.RESTApi;
+import org.apache.paimon.rest.requests.DropPolicyRequest;
 import org.apache.paimon.rest.requests.GrantPermissionRequest;
 import org.apache.paimon.rest.requests.PolicyRequest;
 import org.apache.paimon.rest.requests.RevokePermissionRequest;
 
 import org.junit.jupiter.api.Test;
 
-import java.util.AbstractList;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -41,7 +39,7 @@ public class PermissionManagementJsonTest {
     private static final String ASSIGNMENT_JSON =
             "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
                     + "\"table\":\"orders\"},\"scope\":\"SELF\",\"access\":\"select\","
-                    + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"},"
+                    + "\"principal\":\"analyst\","
                     + "\"expireTime\":\"2027-01-01T00:00:00Z\"}";
 
     @Test
@@ -55,10 +53,7 @@ void testAssignmentDeserializesWithShadedAndExternalJackson() throws Exception {
     @Test
     void testAssignmentDeserializesLowerCaseDiscriminators() throws Exception {
         String lowerCaseJson =
-                ASSIGNMENT_JSON
-                        .replace("\"TABLE\"", "\"table\"")
-                        .replace("\"SELF\"", "\"self\"")
-                        .replace("\"ROLE\"", "\"role\"");
+                ASSIGNMENT_JSON.replace("\"TABLE\"", "\"table\"").replace("\"SELF\"", "\"self\"");
 
         assertAssignment(RESTApi.fromJson(lowerCaseJson, PermissionAssignment.class));
         assertAssignment(
@@ -100,7 +95,7 @@ void testOptionalRequestFieldsUseDocumentedDefaults() throws Exception {
         String permissionJson =
                 "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
                         + "\"table\":\"orders\"},\"access\":\"select\","
-                        + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"}}";
+                        + "\"principal\":\"analyst\"}";
 
         assertThat(RESTApi.fromJson(permissionJson, GrantPermissionRequest.class).getScope())
                 .isEqualTo(PermissionScope.SELF);
@@ -108,24 +103,21 @@ void testOptionalRequestFieldsUseDocumentedDefaults() throws Exception {
                 .isEqualTo(PermissionScope.SELF);
 
         String policyJson =
-                "{\"name\":\"filter\",\"rowFilter\":{\"functionName\":"
-                        + "\"security.filter\"},\"toPrincipals\":[{\"type\":\"ROLE\","
-                        + "\"id\":\"analyst\"}]}";
+                "{\"rowFilter\":{\"functionName\":\"security.filter\"},"
+                        + "\"principal\":\"analyst\"}";
         DataPolicy policy =
                 RESTApi.fromJson(policyJson, PolicyRequest.class).policy(tableResource());
-        assertThat(policy.getExceptPrincipals()).isEmpty();
+        assertThat(policy.getRowFilter().getFunctionArguments()).isEmpty();
     }
 
     @Test
-    void testPoliciesAreNamedFunctionBasedResources() throws Exception {
+    void testPoliciesArePrincipalScopedFunctionBasedResources() throws Exception {
         String json =
                 "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
-                        + "\"table\":\"orders\"},\"name\":\"mask_email\","
+                        + "\"table\":\"orders\"},"
                         + "\"columnMask\":{\"functionName\":\"security.mask_email\","
                         + "\"onColumn\":\"email\",\"functionArguments\":[{\"column\":\"region\"},"
-                        + "{\"constant\":\"CN\"}]},\"toPrincipals\":[{\"type\":\"GROUP\","
-                        + "\"id\":\"analysts\"}],\"exceptPrincipals\":[{\"type\":\"USER\","
-                        + "\"id\":\"admin\"}]}";
+                        + "{\"constant\":\"CN\"}]},\"principal\":\"analysts\"}";
 
         DataPolicy policy = RESTApi.fromJson(json, DataPolicy.class);
         DataPolicy externalPolicy =
@@ -138,8 +130,7 @@ void testPoliciesAreNamedFunctionBasedResources() throws Exception {
                 .isEqualTo("region");
         assertThat(policy.getColumnMask().getFunctionArguments().get(1).getConstant())
                 .isEqualTo("CN");
-        assertThat(policy.getToPrincipals())
-                .containsExactly(new PrincipalRef(PrincipalType.GROUP, "analysts"));
+        assertThat(policy.getPrincipal()).isEqualTo("analysts");
         assertThat(externalPolicy.getColumnMask().getFunctionName())
                 .isEqualTo("security.mask_email");
         assertThat(externalPolicy.getColumnMask().getFunctionArguments().get(1).getConstant())
@@ -149,7 +140,7 @@ void testPoliciesAreNamedFunctionBasedResources() throws Exception {
         assertThat(policyRequest.isRetrySafe()).isFalse();
         Map<?, ?> request = RESTApi.fromJson(RESTApi.toJson(policyRequest), Map.class);
         assertThat(request.containsKey("resource")).isFalse();
-        assertThat(request.get("name")).isEqualTo("mask_email");
+        assertThat(request.get("principal")).isEqualTo("analysts");
         assertThat(request.containsKey("type")).isFalse();
         assertThat(request.containsKey("scope")).isFalse();
         assertThat(request.get("columnMask")).isInstanceOf(Map.class);
@@ -170,7 +161,7 @@ void testAccessAndPolicyValidation() {
                                         tableResource(),
                                         PermissionScope.DESCENDANTS,
                                         "SELECT",
-                                        role("analyst"),
+                                        "analyst",
                                         null,
                                         null))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -181,7 +172,7 @@ void testAccessAndPolicyValidation() {
                                         catalogResource(),
                                         PermissionScope.SELF,
                                         "SELECT",
-                                        role("analyst"),
+                                        "analyst",
                                         null,
                                         null))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -192,7 +183,7 @@ void testAccessAndPolicyValidation() {
                                         catalogResource(),
                                         PermissionScope.SELF,
                                         "ALL",
-                                        role("analyst"),
+                                        "analyst",
                                         null,
                                         null))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -202,11 +193,55 @@ void testAccessAndPolicyValidation() {
                                         tableResource(),
                                         PermissionScope.SELF,
                                         "vendor.example/read_sensitive",
-                                        role("analyst"),
+                                        "analyst",
                                         null,
                                         null)
                                 .getAccess())
                 .isEqualTo("VENDOR.EXAMPLE/READ_SENSITIVE");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.DESCENDANTS,
+                                        "vendor.example/read_sensitive",
+                                        "analyst",
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("DESCENDANTS");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.SELF,
+                                        repeat('A', PermissionAccess.MAX_LENGTH + 1),
+                                        "analyst",
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("32");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.SELF,
+                                        "a/" + repeat('ß', 16),
+                                        "analyst",
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("after canonicalization");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.SELF,
+                                        "SELECT",
+                                        repeat('p', PermissionAssignment.MAX_PRINCIPAL_LENGTH + 1),
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("128");
         assertThatThrownBy(() -> new PolicyArgument("region", "CN"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("exactly one");
@@ -215,26 +250,31 @@ void testAccessAndPolicyValidation() {
                         () ->
                                 new DataPolicy(
                                         tableResource(),
-                                        "filter",
                                         new RowFilter("security.filter", null),
                                         new ColumnMask("security.mask", "region", null),
-                                        Collections.singletonList(role("analyst")),
-                                        null,
-                                        null))
+                                        "analyst"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("exactly one");
         assertThatThrownBy(
                         () ->
                                 new DataPolicy(
                                         catalogResource(),
-                                        "mask",
                                         null,
                                         new ColumnMask("security.mask", "email", null),
-                                        Collections.singletonList(role("analyst")),
-                                        null,
-                                        null))
+                                        "analyst"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("TABLE");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(),
+                                        PermissionScope.SELF,
+                                        "SELECT",
+                                        "analyst",
+                                        "2027-01-01T00:00:00.000001Z",
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("millisecond");
     }
 
     @Test
@@ -250,7 +290,6 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                                         null,
                                         null,
                                         null,
-                                        null,
                                         false,
                                         null,
                                         25))
@@ -267,7 +306,6 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                                         null,
                                         null,
                                         null,
-                                        null,
                                         false,
                                         null,
                                         1001))
@@ -283,7 +321,6 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                         null,
                         null,
                         null,
-                        null,
                         "select",
                         false,
                         null,
@@ -299,7 +336,6 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                                         null,
                                         null,
                                         null,
-                                        null,
                                         "USE_CATALOG",
                                         false,
                                         null,
@@ -309,64 +345,53 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
     }
 
     @Test
-    void testPolicyDefensivelyCopiesCollections() {
-        ArrayList<PrincipalRef> principals =
-                new ArrayList<>(Collections.singletonList(role("analyst")));
+    void testPolicyDefensivelyCopiesFunctionArguments() {
         ArrayList<PolicyArgument> arguments =
                 new ArrayList<>(Arrays.asList(PolicyArgument.column("region")));
         DataPolicy policy =
                 DataPolicy.rowFilter(
-                        tableResource(),
-                        "filter",
-                        new RowFilter("security.filter", arguments),
-                        principals,
-                        null,
-                        null);
+                        tableResource(), new RowFilter("security.filter", arguments), "analyst");
 
-        principals.add(role("admin"));
         arguments.add(PolicyArgument.constant("CN"));
 
-        assertThat(policy.getToPrincipals()).containsExactly(role("analyst"));
+        assertThat(policy.getPrincipal()).isEqualTo("analyst");
         assertThat(policy.getRowFilter().getFunctionArguments()).hasSize(1);
     }
 
     @Test
-    void testPolicyAcceptsListsThatRejectNullLookups() {
-        PrincipalRef principal = role("analyst");
-        List<PrincipalRef> principals =
-                new AbstractList<PrincipalRef>() {
-                    @Override
-                    public PrincipalRef get(int index) {
-                        if (index != 0) {
-                            throw new IndexOutOfBoundsException();
-                        }
-                        return principal;
-                    }
-
-                    @Override
-                    public int size() {
-                        return 1;
-                    }
-
-                    @Override
-                    public boolean contains(Object value) {
-                        if (value == null) {
-                            throw new NullPointerException("null lookups are not supported");
-                        }
-                        return super.contains(value);
-                    }
-                };
-
-        DataPolicy policy =
-                DataPolicy.rowFilter(
-                        tableResource(),
-                        "filter",
-                        new RowFilter("security.filter", Collections.emptyList()),
-                        principals,
-                        null,
-                        null);
+    void testPolicyIdentityAndDropRequestRoundTrip() throws Exception {
+        PolicyIdentity identity =
+                new PolicyIdentity(tableResource(), PolicyType.COLUMN_MASKING, "analyst", "email");
+        DropPolicyRequest request = new DropPolicyRequest(identity);
+        DropPolicyRequest roundTrip =
+                RESTApi.fromJson(RESTApi.toJson(request), DropPolicyRequest.class);
+
+        assertThat(roundTrip.identity(tableResource()).getType())
+                .isEqualTo(PolicyType.COLUMN_MASKING);
+        assertThat(roundTrip.identity(tableResource()).getPrincipal()).isEqualTo("analyst");
+        assertThat(roundTrip.identity(tableResource()).getColumn()).isEqualTo("email");
+        assertThatThrownBy(
+                        () ->
+                                new PolicyIdentity(
+                                        tableResource(),
+                                        PolicyType.COLUMN_MASKING,
+                                        "analyst",
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("column is required");
+    }
 
-        assertThat(policy.getToPrincipals()).containsExactly(principal);
+    @Test
+    void testInheritedAssignmentIdentityUsesAttachmentSource() {
+        PermissionResource database =
+                new PermissionResource(ResourceType.DATABASE, "sales", null, null, null);
+        PermissionAssignment inherited =
+                new PermissionAssignment(
+                        tableResource(), PermissionScope.SELF, "SELECT", "analyst", null, database);
+
+        PermissionIdentity identity = PermissionIdentity.fromAssignment(inherited);
+        assertThat(identity.getResource()).isEqualTo(database);
+        assertThat(identity.getScope()).isEqualTo(PermissionScope.DESCENDANTS);
     }
 
     @Test
@@ -386,8 +411,10 @@ private static PermissionResource tableResource() {
         return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
     }
 
-    private static PrincipalRef role(String id) {
-        return new PrincipalRef(PrincipalType.ROLE, id);
+    private static String repeat(char value, int length) {
+        char[] values = new char[length];
+        Arrays.fill(values, value);
+        return new String(values);
     }
 
     private static void assertAssignment(PermissionAssignment assignment) {
@@ -396,7 +423,7 @@ private static void assertAssignment(PermissionAssignment assignment) {
         assertThat(assignment.getResource().getTable()).isEqualTo("orders");
         assertThat(assignment.getScope()).isEqualTo(PermissionScope.SELF);
         assertThat(assignment.getAccess()).isEqualTo("SELECT");
-        assertThat(assignment.getPrincipal()).isEqualTo(role("analyst"));
+        assertThat(assignment.getPrincipal()).isEqualTo("analyst");
         assertThat(assignment.getExpireTime()).isEqualTo("2027-01-01T00:00:00Z");
         assertThat(assignment.getInheritedFrom()).isNull();
     }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
index b1a77e026674..0baf850fa712 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
@@ -25,8 +25,6 @@
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.rest.exceptions.ForbiddenException;
@@ -83,7 +81,7 @@ void setUp() throws Exception {
                                 "{\"permissions\":[{\"resource\":{\"type\":\"TABLE\","
                                         + "\"database\":\"sales\",\"table\":\"orders\"},"
                                         + "\"scope\":\"SELF\",\"access\":\"SELECT\","
-                                        + "\"principal\":{\"type\":\"ROLE\",\"id\":\"analyst\"}}],"
+                                        + "\"principal\":\"analyst\"}],"
                                         + "\"nextPageToken\":\"next\"}");
                     } else if ((BASE_PATH + "/grant").equals(path)) {
                         String body = readBody(exchange);
@@ -129,7 +127,6 @@ void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
                                 "orders",
                                 null,
                                 null,
-                                PrincipalType.ROLE,
                                 "analyst",
                                 null,
                                 true,
@@ -137,10 +134,9 @@ void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
                                 25));
 
         assertThat(page.getElements()).hasSize(1);
-        assertThat(page.getElements().get(0).getPrincipal().getId()).isEqualTo("analyst");
+        assertThat(page.getElements().get(0).getPrincipal()).isEqualTo("analyst");
         assertThat(page.getNextPageToken()).isEqualTo("next");
         assertThat(queryParameters(listQuery.get()))
-                .containsEntry("principalType", "ROLE")
                 .containsEntry("principal", "analyst")
                 .containsEntry("resourceType", "TABLE")
                 .containsEntry("scope", "SELF")
@@ -163,9 +159,7 @@ void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         assertThat(grantResource.get("type")).isEqualTo("TABLE");
         assertThat(grantResource.get("database")).isEqualTo("sales");
         assertThat(grantResource.get("table")).isEqualTo("orders");
-        Map<?, ?> grantPrincipal = (Map<?, ?>) grant.get("principal");
-        assertThat(grantPrincipal.get("type")).isEqualTo("ROLE");
-        assertThat(grantPrincipal.get("id")).isEqualTo("analyst");
+        assertThat(grant.get("principal")).isEqualTo("analyst");
         assertThat(grant.get("scope")).isEqualTo("SELF");
         assertThat(grant.containsKey("columns")).isFalse();
         assertThat(grant.containsKey("policy")).isFalse();
@@ -177,9 +171,7 @@ void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         assertThat(revokeResource.get("type")).isEqualTo("TABLE");
         assertThat(revokeResource.get("database")).isEqualTo("sales");
         assertThat(revokeResource.get("table")).isEqualTo("orders");
-        Map<?, ?> revokePrincipal = (Map<?, ?>) revoke.get("principal");
-        assertThat(revokePrincipal.get("type")).isEqualTo("ROLE");
-        assertThat(revokePrincipal.get("id")).isEqualTo("analyst");
+        assertThat(revoke.get("principal")).isEqualTo("analyst");
         assertThat(revoke.get("scope")).isEqualTo("SELF");
         assertThat(revoke.containsKey("expireTime")).isFalse();
         assertThat(revoke.containsKey("grantOption")).isFalse();
@@ -207,7 +199,7 @@ private static PermissionAssignment assignment(String principal) {
                 new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null),
                 PermissionScope.SELF,
                 "SELECT",
-                new PrincipalRef(PrincipalType.ROLE, principal),
+                principal,
                 null,
                 null);
     }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
index 66e48d05f927..6ae735248338 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
@@ -27,8 +27,6 @@
 import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyManagement;
 import org.apache.paimon.management.PolicyType;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.rest.exceptions.NoSuchResourceException;
@@ -60,13 +58,13 @@ public class RESTPolicyManagementTest {
 
     private static final String COLLECTION_PATH =
             "/v1/catalog+id/databases/sales/tables/orders/policies";
-    private static final String POLICY_PATH = COLLECTION_PATH + "/mask+email";
 
     private HttpServer server;
     private PolicyManagement management;
     private final AtomicReference<String> listQuery = new AtomicReference<>();
     private final AtomicReference<String> createBody = new AtomicReference<>();
     private final AtomicReference<String> updateBody = new AtomicReference<>();
+    private final AtomicReference<String> deleteBody = new AtomicReference<>();
     private final AtomicReference<String> deleteError = new AtomicReference<>();
     private final AtomicInteger deleteCalls = new AtomicInteger();
 
@@ -84,12 +82,11 @@ void setUp() throws Exception {
                     } else if (COLLECTION_PATH.equals(path) && "POST".equals(method)) {
                         createBody.set(readBody(exchange));
                         respond(exchange, 200, null);
-                    } else if (POLICY_PATH.equals(path) && "GET".equals(method)) {
-                        respond(exchange, 200, "{\"policy\":" + policyJson() + "}");
-                    } else if (POLICY_PATH.equals(path) && "PUT".equals(method)) {
+                    } else if (COLLECTION_PATH.equals(path) && "PUT".equals(method)) {
                         updateBody.set(readBody(exchange));
                         respond(exchange, 200, null);
-                    } else if (POLICY_PATH.equals(path) && "DELETE".equals(method)) {
+                    } else if (COLLECTION_PATH.equals(path) && "DELETE".equals(method)) {
+                        deleteBody.set(readBody(exchange));
                         deleteCalls.incrementAndGet();
                         if (deleteError.get() == null) {
                             respond(exchange, 200, null);
@@ -118,31 +115,25 @@ void tearDown() {
     }
 
     @Test
-    void testListAndGetUseResourceNestedPaths() {
+    void testListUsesResourceNestedPathAndIdentityFilters() {
         PagedList<DataPolicy> policies =
                 management.listPolicies(
                         new ListPoliciesRequest(
                                 tableResource(),
-                                "mask email",
                                 PolicyType.COLUMN_MASKING,
-                                PrincipalType.ROLE,
                                 "analyst",
+                                "email",
                                 "start",
                                 25));
 
         assertThat(policies.getElements()).hasSize(1);
         assertThat(policies.getNextPageToken()).isEqualTo("next");
         assertThat(listQuery.get())
-                .contains("name=mask%20email")
                 .contains("type=COLUMN_MASKING")
-                .contains("principalType=ROLE")
                 .contains("principal=analyst")
+                .contains("column=email")
                 .contains("maxResults=25")
                 .contains("pageToken=start");
-
-        DataPolicy policy = management.getPolicy(new PolicyIdentity(tableResource(), "mask email"));
-        assertThat(policy.getName()).isEqualTo("mask email");
-        assertThat(policy.getColumnMask().getOnColumn()).isEqualTo("email");
     }
 
     @Test
@@ -152,10 +143,13 @@ void testCreateUpdateAndDropUseCrudMethods() {
         management.createOrReplacePolicy(policy);
         management.dropPolicy(PolicyIdentity.fromPolicy(policy), false);
 
-        assertThat(createBody.get()).contains("\"name\":\"mask email\"");
+        assertThat(createBody.get()).contains("\"principal\":\"analyst\"");
         assertThat(createBody.get()).doesNotContain("\"resource\"");
         assertThat(updateBody.get()).contains("\"columnMask\"");
         assertThat(updateBody.get()).doesNotContain("\"scope\"");
+        assertThat(deleteBody.get())
+                .contains("\"type\":\"COLUMN_MASKING\"")
+                .contains("\"column\":\"email\"");
         assertThat(deleteCalls).hasValue(1);
     }
 
@@ -163,7 +157,8 @@ void testCreateUpdateAndDropUseCrudMethods() {
     void testDropIfExistsOnlyIgnoresMissingPolicy() {
         PolicyIdentity identity = PolicyIdentity.fromPolicy(policy());
         deleteError.set(
-                "{\"resourceType\":\"POLICY\",\"resourceName\":\"mask email\","
+                "{\"resourceType\":\"POLICY\",\"resourceName\":"
+                        + "\"COLUMN_MASKING:analyst:email\","
                         + "\"message\":\"missing\",\"code\":404}");
 
         management.dropPolicy(identity, true);
@@ -179,14 +174,11 @@ void testDropIfExistsOnlyIgnoresMissingPolicy() {
     private static DataPolicy policy() {
         return DataPolicy.columnMask(
                 tableResource(),
-                "mask email",
                 new ColumnMask(
                         "security.mask_email",
                         "email",
                         Collections.singletonList(PolicyArgument.column("region"))),
-                Collections.singletonList(new PrincipalRef(PrincipalType.ROLE, "analyst")),
-                Collections.emptyList(),
-                "Mask customer email");
+                "analyst");
     }
 
     private static PermissionResource tableResource() {
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
index 1751c6ecc9ef..9e645db3b79f 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/requests/RequestJacksonCompatibilityTest.java
@@ -169,6 +169,7 @@ public class RequestJacksonCompatibilityTest {
                             CreatePartitionsRequest.class,
                             CreateTableRequest.class,
                             CreateViewRequest.class,
+                            DropPolicyRequest.class,
                             GrantPermissionRequest.class,
                             PolicyRequest.class,
                             RegisterTableRequest.class,
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
index f5a6277a173c..4b0f31524559 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
@@ -18,17 +18,40 @@
 
 package org.apache.paimon.rest;
 
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyType;
+
+import javax.annotation.Nullable;
+
 import java.util.Objects;
 
 /** Stable identity of a policy stored by the REST catalog test server. */
-final class PolicyKey {
+final class PolicyKey implements Comparable<PolicyKey> {
 
     final String tableUuid;
-    final String name;
+    final PolicyType type;
+    final String principal;
+    @Nullable final String column;
+
+    PolicyKey(String tableUuid, DataPolicy policy) {
+        this(
+                tableUuid,
+                policy.type(),
+                policy.getPrincipal(),
+                policy.getColumnMask() == null ? null : policy.getColumnMask().getOnColumn());
+    }
 
-    PolicyKey(String tableUuid, String name) {
+    PolicyKey(String tableUuid, PolicyIdentity identity) {
+        this(tableUuid, identity.getType(), identity.getPrincipal(), identity.getColumn());
+    }
+
+    private PolicyKey(
+            String tableUuid, PolicyType type, String principal, @Nullable String column) {
         this.tableUuid = tableUuid;
-        this.name = name;
+        this.type = type;
+        this.principal = principal;
+        this.column = column;
     }
 
     @Override
@@ -40,11 +63,34 @@ public boolean equals(Object o) {
             return false;
         }
         PolicyKey that = (PolicyKey) o;
-        return tableUuid.equals(that.tableUuid) && name.equals(that.name);
+        return tableUuid.equals(that.tableUuid)
+                && type == that.type
+                && principal.equals(that.principal)
+                && Objects.equals(column, that.column);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(tableUuid, name);
+        return Objects.hash(tableUuid, type, principal, column);
+    }
+
+    @Override
+    public int compareTo(PolicyKey that) {
+        int result = tableUuid.compareTo(that.tableUuid);
+        if (result != 0) {
+            return result;
+        }
+        result = type.compareTo(that.type);
+        if (result != 0) {
+            return result;
+        }
+        result = principal.compareTo(that.principal);
+        if (result != 0) {
+            return result;
+        }
+        if (column == null) {
+            return that.column == null ? 0 : -1;
+        }
+        return that.column == null ? 1 : column.compareTo(that.column);
     }
 }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java
new file mode 100644
index 000000000000..ab205b3c1f26
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.management.ColumnMask;
+import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.ResourceType;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.TreeSet;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/** Tests for policy identities used by the REST catalog test server. */
+public class PolicyKeyTest {
+
+    @Test
+    void testOrderingDoesNotFlattenOpaquePrincipalAndColumn() {
+        PermissionResource resource =
+                new PermissionResource(ResourceType.TABLE, "database", "table", null, null);
+        PolicyKey first =
+                new PolicyKey(
+                        "table-id",
+                        DataPolicy.columnMask(resource, new ColumnMask("mask", "c", null), "a:b"));
+        PolicyKey second =
+                new PolicyKey(
+                        "table-id",
+                        DataPolicy.columnMask(resource, new ColumnMask("mask", "b:c", null), "a"));
+
+        TreeSet<PolicyKey> sorted = new TreeSet<>();
+        sorted.add(first);
+        sorted.add(second);
+
+        assertThat(sorted).containsExactly(second, first);
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 3b0711668be5..42f1d553c09f 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -45,8 +45,7 @@
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
+import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.operation.Lock;
@@ -72,6 +71,7 @@
 import org.apache.paimon.rest.requests.CreateTagRequest;
 import org.apache.paimon.rest.requests.CreateViewRequest;
 import org.apache.paimon.rest.requests.DropPartitionsRequest;
+import org.apache.paimon.rest.requests.DropPolicyRequest;
 import org.apache.paimon.rest.requests.GrantPermissionRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByFilterRequest;
 import org.apache.paimon.rest.requests.ListPartitionsByNamesRequest;
@@ -92,7 +92,6 @@
 import org.apache.paimon.rest.responses.ErrorResponse;
 import org.apache.paimon.rest.responses.GetDatabaseResponse;
 import org.apache.paimon.rest.responses.GetFunctionResponse;
-import org.apache.paimon.rest.responses.GetPolicyResponse;
 import org.apache.paimon.rest.responses.GetTableResponse;
 import org.apache.paimon.rest.responses.GetTableSnapshotResponse;
 import org.apache.paimon.rest.responses.GetTableTokenResponse;
@@ -225,8 +224,8 @@ public class RESTCatalogServer {
     private final Map<PolicyKey, DataPolicy> policyStore = new ConcurrentHashMap<>();
     private final Map<String, Object> tablePolicyLocks = new ConcurrentHashMap<>();
     private final TableLifecycleLocks tableLifecycleLocks = new TableLifecycleLocks();
-    private final Set<PrincipalRef> managementPrincipals = new HashSet<>();
-    private final Set<PrincipalRef> queryPrincipals = new HashSet<>();
+    private final Set<String> managementPrincipals = new HashSet<>();
+    private final Set<String> queryPrincipals = new HashSet<>();
     private final Map<String, BiFunction<TableSchema, RowFilter, Predicate>>
             rowFilterPolicyFunctions = new HashMap<>();
     private final Map<String, BiFunction<TableSchema, ColumnMask, Transform>>
@@ -379,11 +378,11 @@ public void setColumnMaskingAuth(Identifier identifier, Map<String, Transform> c
         }
     }
 
-    public void registerManagementPrincipal(PrincipalRef principal) {
+    public void registerManagementPrincipal(String principal) {
         managementPrincipals.add(principal);
     }
 
-    public void setQueryPrincipals(Set<PrincipalRef> principals) {
+    public void setQueryPrincipals(Set<String> principals) {
         queryPrincipals.clear();
         queryPrincipals.addAll(principals);
     }
@@ -1159,10 +1158,7 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
     }
 
     private boolean appliesToQueryPrincipal(DataPolicy policy) {
-        boolean selected = policy.getToPrincipals().stream().anyMatch(queryPrincipals::contains);
-        boolean excluded =
-                policy.getExceptPrincipals().stream().anyMatch(queryPrincipals::contains);
-        return selected && !excluded;
+        return queryPrincipals.contains(policy.getPrincipal());
     }
 
     private MockResponse commitTableHandle(Identifier identifier, String data) throws Exception {
@@ -3365,15 +3361,12 @@ private MockResponse validateResourceAndPrincipal(
         if (resourceError != null || !parameters.containsKey("principal")) {
             return resourceError;
         }
-        return validatePrincipal(
-                new PrincipalRef(
-                        PrincipalType.fromString(parameters.get("principalType")),
-                        parameters.get("principal")));
+        return validatePrincipal(parameters.get("principal"));
     }
 
     @Nullable
     private MockResponse validateResourceAndPrincipal(
-            PermissionResource resource, PrincipalRef principal) {
+            PermissionResource resource, String principal) {
         MockResponse resourceError = validateResource(resource);
         return resourceError == null ? validatePrincipal(principal) : resourceError;
     }
@@ -3434,13 +3427,13 @@ private MockResponse validateManagementPermission(PermissionResource resource) {
     }
 
     @Nullable
-    private MockResponse validatePrincipal(PrincipalRef principal) {
+    private MockResponse validatePrincipal(String principal) {
         return managementPrincipals.contains(principal)
                 ? null
                 : mockResponse(
                         new ErrorResponse(
                                 "PRINCIPAL",
-                                principal.getId(),
+                                principal,
                                 "Permission principal does not exist.",
                                 404),
                         404);
@@ -3508,13 +3501,9 @@ private MockResponse policiesApiHandler(
             return resourceError;
         }
         String tableUuid = tableUuid(path.resource);
-        if ("GET".equals(method) && path.name == null) {
+        if ("GET".equals(method)) {
             if (parameters.containsKey("principal")) {
-                MockResponse principalError =
-                        validatePrincipal(
-                                new PrincipalRef(
-                                        PrincipalType.fromString(parameters.get("principalType")),
-                                        parameters.get("principal")));
+                MockResponse principalError = validatePrincipal(parameters.get("principal"));
                 if (principalError != null) {
                     return principalError;
                 }
@@ -3524,7 +3513,9 @@ private MockResponse policiesApiHandler(
                             .filter(entry -> entry.getKey().tableUuid.equals(tableUuid))
                             .map(entry -> withResource(entry.getValue(), path.resource))
                             .filter(policy -> matchesPolicy(policy, parameters))
-                            .sorted(Comparator.comparing(DataPolicy::getName))
+                            .sorted(
+                                    Comparator.comparing(
+                                            policy -> new PolicyKey(tableUuid, policy)))
                             .collect(Collectors.toList());
             int start =
                     parameters.containsKey(PAGE_TOKEN)
@@ -3538,21 +3529,9 @@ private MockResponse policiesApiHandler(
                     200);
         }
 
-        if ("GET".equals(method) && path.name != null) {
-            DataPolicy policy = findPolicy(path.resource, path.name);
-            return policy == null
-                    ? mockResponse(
-                            new ErrorResponse(
-                                    ErrorResponse.RESOURCE_TYPE_POLICY,
-                                    path.name,
-                                    "Policy does not exist.",
-                                    404),
-                            404)
-                    : mockResponse(new GetPolicyResponse(policy), 200);
-        }
-
-        if ("POST".equals(method) && path.name == null) {
+        if ("POST".equals(method)) {
             DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
+            PolicyIdentity identity = PolicyIdentity.fromPolicy(policy);
             synchronized (policyLock(tableUuid)) {
                 MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
                 if (targetError != null) {
@@ -3562,12 +3541,12 @@ private MockResponse policiesApiHandler(
                 if (validation != null) {
                     return validation;
                 }
-                PolicyKey key = new PolicyKey(tableUuid, policy.getName());
+                PolicyKey key = new PolicyKey(tableUuid, policy);
                 if (policyStore.putIfAbsent(key, policy) != null) {
                     return mockResponse(
                             new ErrorResponse(
                                     ErrorResponse.RESOURCE_TYPE_POLICY,
-                                    policy.getName(),
+                                    identity.resourceName(),
                                     "Policy already exists.",
                                     409),
                             409);
@@ -3576,11 +3555,8 @@ private MockResponse policiesApiHandler(
             return new MockResponse().setResponseCode(200);
         }
 
-        if ("PUT".equals(method) && path.name != null) {
+        if ("PUT".equals(method)) {
             DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
-            checkArgument(
-                    path.name.equals(policy.getName()),
-                    "Policy name in the path and request body must match.");
             synchronized (policyLock(tableUuid)) {
                 MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
                 if (targetError != null) {
@@ -3590,25 +3566,27 @@ private MockResponse policiesApiHandler(
                 if (validation != null) {
                     return validation;
                 }
-                policyStore.put(new PolicyKey(tableUuid, path.name), policy);
+                policyStore.put(new PolicyKey(tableUuid, policy), policy);
             }
             return new MockResponse().setResponseCode(200);
         }
 
-        if ("DELETE".equals(method) && path.name != null) {
+        if ("DELETE".equals(method)) {
+            PolicyIdentity identity =
+                    RESTApi.fromJson(data, DropPolicyRequest.class).identity(path.resource);
             DataPolicy existing;
             synchronized (policyLock(tableUuid)) {
                 MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
                 if (targetError != null) {
                     return targetError;
                 }
-                existing = policyStore.remove(new PolicyKey(tableUuid, path.name));
+                existing = policyStore.remove(new PolicyKey(tableUuid, identity));
             }
             if (existing == null) {
                 return mockResponse(
                         new ErrorResponse(
                                 ErrorResponse.RESOURCE_TYPE_POLICY,
-                                path.name,
+                                identity.resourceName(),
                                 "Policy does not exist.",
                                 404),
                         404);
@@ -3634,17 +3612,9 @@ private MockResponse validatePolicy(DataPolicy policy) {
                             409),
                     409);
         }
-        for (PrincipalRef principal : policy.getToPrincipals()) {
-            MockResponse principalError = validatePrincipal(principal);
-            if (principalError != null) {
-                return principalError;
-            }
-        }
-        for (PrincipalRef principal : policy.getExceptPrincipals()) {
-            MockResponse principalError = validatePrincipal(principal);
-            if (principalError != null) {
-                return principalError;
-            }
+        MockResponse principalError = validatePrincipal(policy.getPrincipal());
+        if (principalError != null) {
+            return principalError;
         }
 
         RowFilter rowFilter = policy.getRowFilter();
@@ -3699,12 +3669,6 @@ private MockResponse validatePolicy(DataPolicy policy) {
         return null;
     }
 
-    @Nullable
-    private DataPolicy findPolicy(PermissionResource resource, String name) {
-        DataPolicy policy = policyStore.get(new PolicyKey(tableUuid(resource), name));
-        return policy == null ? null : withResource(policy, resource);
-    }
-
     private String tableUuid(PermissionResource resource) {
         return tableMetadataStore
                 .get(Identifier.create(resource.getDatabase(), resource.getTable()).getFullName())
@@ -3736,20 +3700,8 @@ private MockResponse validatePolicyTableVersion(
 
     private static DataPolicy withResource(DataPolicy policy, PermissionResource resource) {
         return policy.getRowFilter() == null
-                ? DataPolicy.columnMask(
-                        resource,
-                        policy.getName(),
-                        policy.getColumnMask(),
-                        policy.getToPrincipals(),
-                        policy.getExceptPrincipals(),
-                        policy.getComment())
-                : DataPolicy.rowFilter(
-                        resource,
-                        policy.getName(),
-                        policy.getRowFilter(),
-                        policy.getToPrincipals(),
-                        policy.getExceptPrincipals(),
-                        policy.getComment());
+                ? DataPolicy.columnMask(resource, policy.getColumnMask(), policy.getPrincipal())
+                : DataPolicy.rowFilter(resource, policy.getRowFilter(), policy.getPrincipal());
     }
 
     private Predicate compileRowFilter(TableSchema schema, RowFilter rowFilter) {
@@ -3825,38 +3777,35 @@ private void validatePoliciesForSchema(
     }
 
     private static boolean matchesPolicy(DataPolicy policy, Map<String, String> parameters) {
-        if (!matches(parameters, "name", policy.getName())
-                || !matches(parameters, "type", policy.type().name())) {
+        if (!matches(parameters, "type", policy.type().name())) {
             return false;
         }
-        if (!parameters.containsKey("principal")) {
-            return true;
+        if (parameters.containsKey("column")) {
+            ColumnMask columnMask = policy.getColumnMask();
+            if (columnMask == null
+                    || !Objects.equals(parameters.get("column"), columnMask.getOnColumn())) {
+                return false;
+            }
         }
-        PrincipalRef principal =
-                new PrincipalRef(
-                        PrincipalType.fromString(parameters.get("principalType")),
-                        parameters.get("principal"));
-        return policy.getToPrincipals().contains(principal)
-                && !policy.getExceptPrincipals().contains(principal);
+        return !parameters.containsKey("principal")
+                || policy.getPrincipal().equals(parameters.get("principal"));
     }
 
     private PolicyPath policyPath(String resourcePath) {
         String catalogBase = StringUtils.substringBeforeLast(permissionUri, "/");
         checkArgument(resourcePath.startsWith(catalogBase + "/"), "Not a catalog policy path.");
         String[] parts = resourcePath.substring(catalogBase.length() + 1).split("/");
-        if (parts.length >= 5
+        if (parts.length == 5
                 && "databases".equals(parts[0])
                 && "tables".equals(parts[2])
                 && "policies".equals(parts[4])) {
-            checkArgument(parts.length <= 6, "Invalid table policy path.");
             return new PolicyPath(
                     new PermissionResource(
                             ResourceType.TABLE,
                             RESTUtil.decodeString(parts[1]),
                             RESTUtil.decodeString(parts[3]),
                             null,
-                            null),
-                    parts.length == 6 ? RESTUtil.decodeString(parts[5]) : null);
+                            null));
         }
         throw new IllegalArgumentException("Not a policy path.");
     }
@@ -3864,11 +3813,9 @@ private PolicyPath policyPath(String resourcePath) {
     private static class PolicyPath {
 
         private final PermissionResource resource;
-        @Nullable private final String name;
 
-        private PolicyPath(PermissionResource resource, @Nullable String name) {
+        private PolicyPath(PermissionResource resource) {
             this.resource = resource;
-            this.name = name;
         }
     }
 
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
index 5978f860facb..e74a0b6cd4c2 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
@@ -66,8 +66,7 @@ private static boolean matchesSource(
             Map<String, String> parameters,
             boolean includeInherited) {
         PermissionResource resource = assignment.getResource();
-        return matches(parameters, "principal", assignment.getPrincipal().getId())
-                && matches(parameters, "principalType", assignment.getPrincipal().getType().name())
+        return matches(parameters, "principal", assignment.getPrincipal())
                 && matches(parameters, "access", assignment.getAccess())
                 && (includeInherited
                         || (matches(parameters, "resourceType", resource.getType().name())
@@ -144,9 +143,7 @@ private static String sortKey(PermissionAssignment assignment) {
                 + '\0'
                 + assignment.getAccess()
                 + '\0'
-                + assignment.getPrincipal().getType().name()
-                + '\0'
-                + assignment.getPrincipal().getId();
+                + assignment.getPrincipal();
     }
 
     private static String value(String value) {
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
index 16b9fd4c14f4..40f4f1154c43 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
@@ -21,8 +21,6 @@
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 
 import org.junit.jupiter.api.Test;
@@ -38,7 +36,7 @@
 /** Tests atomic replacement and effective-view filtering in {@link RESTPermissionStore}. */
 class RESTPermissionStoreTest {
 
-    private static final PrincipalRef ANALYST = new PrincipalRef(PrincipalType.ROLE, "analyst");
+    private static final String ANALYST = "analyst";
 
     @Test
     void testConcurrentGrantReplacesTheSameIdentity() {
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
index 8f97380f17f0..bba45b64c92e 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/ResourcePathsTest.java
@@ -65,7 +65,7 @@ public void testPoliciesAreNestedUnderAttachmentResource() {
         assertThrows(IllegalArgumentException.class, () -> paths.policies(catalog));
         assertThrows(IllegalArgumentException.class, () -> paths.policies(database));
         assertEquals(
-                "/v1/catalog%2Fid/databases/sales+db/tables/orders%2Fall/policies/mask+email",
-                paths.policy(table, "mask email"));
+                "/v1/catalog%2Fid/databases/sales+db/tables/orders%2Fall/policies",
+                paths.policies(table));
     }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
index 4933831f6a62..edc533287245 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
@@ -26,8 +26,6 @@
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.management.PolicyManagement;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.rest.RESTCatalog;
 import org.apache.paimon.spark.catalog.WithPaimonCatalog;
@@ -73,7 +71,6 @@ private RESTCatalog restCatalog() {
     protected static PermissionAssignment assignment(
             ResourceType resourceType,
             String access,
-            PrincipalType principalType,
             String principal,
             @Nullable String database,
             @Nullable String table,
@@ -85,7 +82,7 @@ protected static PermissionAssignment assignment(
                 resource(resourceType, database, table, function, view),
                 scope(scope),
                 access,
-                new PrincipalRef(principalType, principal),
+                principal,
                 emptyToNull(expireTime),
                 null);
     }
@@ -93,7 +90,6 @@ protected static PermissionAssignment assignment(
     protected static PermissionIdentity identity(
             ResourceType resourceType,
             String access,
-            PrincipalType principalType,
             String principal,
             @Nullable String database,
             @Nullable String table,
@@ -104,7 +100,7 @@ protected static PermissionIdentity identity(
                 resource(resourceType, database, table, function, view),
                 scope(scope),
                 access,
-                new PrincipalRef(principalType, principal));
+                principal);
     }
 
     protected static PermissionResource resource(
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
index 35f23d094196..b87c5b7fb9b6 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
@@ -24,8 +24,6 @@
 import org.apache.paimon.management.PolicyArgument;
 import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyType;
-import org.apache.paimon.management.PrincipalRef;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.management.RowFilter;
 
@@ -50,10 +48,6 @@ protected BasePolicyProcedure(TableCatalog tableCatalog) {
         super(tableCatalog);
     }
 
-    protected static org.apache.spark.sql.types.DataType principalArrayType() {
-        return DataTypes.createArrayType(StringType);
-    }
-
     protected static org.apache.spark.sql.types.DataType functionArgumentArrayType() {
         return DataTypes.createArrayType(StringType);
     }
@@ -61,65 +55,35 @@ protected static org.apache.spark.sql.types.DataType functionArgumentArrayType()
     protected static DataPolicy policy(
             String database,
             String table,
-            String name,
             PolicyType policyType,
+            String principal,
             String functionName,
-            ArrayData toPrincipals,
-            @Nullable ArrayData exceptPrincipals,
             @Nullable String onColumn,
-            @Nullable ArrayData functionArguments,
-            @Nullable String comment) {
+            @Nullable ArrayData functionArguments) {
         PermissionResource resource = tableResource(database, table);
-        List<PrincipalRef> targets = principals(toPrincipals, "to_principals", true);
-        List<PrincipalRef> exceptions = principals(exceptPrincipals, "except_principals", false);
         List<PolicyArgument> arguments = arguments(functionArguments);
         if (policyType == PolicyType.ROW_FILTER) {
             checkArgument(isBlank(onColumn), "ROW_FILTER policy cannot specify on_column.");
             return DataPolicy.rowFilter(
-                    resource,
-                    name,
-                    new RowFilter(functionName, arguments),
-                    targets,
-                    exceptions,
-                    emptyToNull(comment));
+                    resource, new RowFilter(functionName, arguments), principal);
         }
         return DataPolicy.columnMask(
-                resource,
-                name,
-                new ColumnMask(functionName, onColumn, arguments),
-                targets,
-                exceptions,
-                emptyToNull(comment));
+                resource, new ColumnMask(functionName, onColumn, arguments), principal);
     }
 
-    protected static PolicyIdentity policyIdentity(String database, String table, String name) {
-        return new PolicyIdentity(tableResource(database, table), name);
+    protected static PolicyIdentity policyIdentity(
+            String database,
+            String table,
+            PolicyType type,
+            String principal,
+            @Nullable String column) {
+        return new PolicyIdentity(tableResource(database, table), type, principal, column);
     }
 
     protected static PermissionResource tableResource(String database, String table) {
         return resource(ResourceType.TABLE, database, table, null, null);
     }
 
-    private static List<PrincipalRef> principals(
-            @Nullable ArrayData data, String argument, boolean required) {
-        if (data == null) {
-            checkArgument(!required, "%s is required.", argument);
-            return Collections.emptyList();
-        }
-        checkArgument(data.numElements() > 0 || !required, "%s cannot be empty.", argument);
-        List<PrincipalRef> principals = new ArrayList<>(data.numElements());
-        for (int i = 0; i < data.numElements(); i++) {
-            checkArgument(!data.isNullAt(i), "%s cannot contain null.", argument);
-            String encoded = data.getUTF8String(i).toString();
-            String[] principal = split(encoded, argument, "TYPE:id", false);
-            principals.add(
-                    new PrincipalRef(
-                            enumValue(principal[0], PrincipalType.class, argument + ".type"),
-                            principal[1]));
-        }
-        return principals;
-    }
-
     private static List<PolicyArgument> arguments(@Nullable ArrayData data) {
         if (data == null) {
             return Collections.emptyList();
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
index c54910b6a656..4f4b40368b43 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
@@ -37,14 +37,11 @@ abstract class CreateOrReplacePolicyBaseProcedure extends BasePolicyProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("database", StringType),
                 ProcedureParameter.required("table", StringType),
-                ProcedureParameter.required("name", StringType),
                 ProcedureParameter.required("policy_type", StringType),
+                ProcedureParameter.required("principal", StringType),
                 ProcedureParameter.required("function_name", StringType),
-                ProcedureParameter.required("to_principals", principalArrayType()),
-                ProcedureParameter.optional("except_principals", principalArrayType()),
                 ProcedureParameter.optional("on_column", StringType),
-                ProcedureParameter.optional("function_arguments", functionArgumentArrayType()),
-                ProcedureParameter.optional("comment", StringType)
+                ProcedureParameter.optional("function_arguments", functionArgumentArrayType())
             };
 
     private static final StructType OUTPUT_TYPE =
@@ -73,14 +70,11 @@ public InternalRow[] call(InternalRow args) {
                 policy(
                         args.getString(0),
                         args.getString(1),
-                        args.getString(2),
-                        enumValue(args.getString(3), PolicyType.class, PARAMETERS[3].name()),
+                        enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
+                        args.getString(3),
                         args.getString(4),
-                        args.getArray(5),
-                        args.isNullAt(6) ? null : args.getArray(6),
-                        args.isNullAt(7) ? null : args.getString(7),
-                        args.isNullAt(8) ? null : args.getArray(8),
-                        args.isNullAt(9) ? null : args.getString(9));
+                        args.isNullAt(5) ? null : args.getString(5),
+                        args.isNullAt(6) ? null : args.getArray(6));
         writePolicy(policy);
         return new InternalRow[] {newInternalRow(true)};
     }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
index 7440bb9070a6..b1d6b32c03da 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
@@ -19,6 +19,7 @@
 package org.apache.paimon.spark.procedure;
 
 import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PolicyType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
@@ -30,14 +31,16 @@
 import static org.apache.spark.sql.types.DataTypes.BooleanType;
 import static org.apache.spark.sql.types.DataTypes.StringType;
 
-/** Drops a named row-filter or column-masking policy. */
+/** Drops one principal's row-filter or column-masking policy. */
 public class DropPolicyProcedure extends BasePolicyProcedure {
 
     private static final ProcedureParameter[] PARAMETERS =
             new ProcedureParameter[] {
                 ProcedureParameter.required("database", StringType),
                 ProcedureParameter.required("table", StringType),
-                ProcedureParameter.required("name", StringType),
+                ProcedureParameter.required("policy_type", StringType),
+                ProcedureParameter.required("principal", StringType),
+                ProcedureParameter.optional("column", StringType),
                 ProcedureParameter.optional("if_exists", BooleanType)
             };
 
@@ -64,8 +67,13 @@ public StructType outputType() {
     @Override
     public InternalRow[] call(InternalRow args) {
         PolicyIdentity identity =
-                policyIdentity(args.getString(0), args.getString(1), args.getString(2));
-        policyManagement().dropPolicy(identity, !args.isNullAt(3) && args.getBoolean(3));
+                policyIdentity(
+                        args.getString(0),
+                        args.getString(1),
+                        enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
+                        args.getString(3),
+                        args.isNullAt(4) ? null : args.getString(4));
+        policyManagement().dropPolicy(identity, !args.isNullAt(5) && args.getBoolean(5));
         return new InternalRow[] {newInternalRow(true)};
     }
 
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
index afee1e211980..720af70eaf10 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
@@ -19,7 +19,6 @@
 package org.apache.paimon.spark.procedure;
 
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
@@ -37,7 +36,6 @@ public class GrantPermissionProcedure extends BasePermissionProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
                 ProcedureParameter.required("access", StringType),
-                ProcedureParameter.required("principal_type", StringType),
                 ProcedureParameter.required("principal", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
@@ -79,14 +77,13 @@ public InternalRow[] call(InternalRow args) {
                 assignment(
                         resourceType,
                         args.getString(1),
-                        enumValue(args.getString(2), PrincipalType.class, PARAMETERS[2].name()),
-                        args.getString(3),
+                        args.getString(2),
+                        args.isNullAt(3) ? null : args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6),
                         args.isNullAt(7) ? null : args.getString(7),
-                        args.isNullAt(8) ? null : args.getString(8),
-                        args.isNullAt(9) ? null : args.getString(9));
+                        args.isNullAt(8) ? null : args.getString(8));
 
         permissionManagement().grantPermission(assignment);
         return new InternalRow[] {newInternalRow(true)};
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
index 0a0ae4bc25d3..fd6994511cfb 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
@@ -22,7 +22,6 @@
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.utils.JsonSerdeUtil;
 
@@ -50,7 +49,6 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
-                ProcedureParameter.optional("principal_type", StringType),
                 ProcedureParameter.optional("principal", StringType),
                 ProcedureParameter.optional("access", StringType),
                 ProcedureParameter.optional("include_inherited", BooleanType),
@@ -68,7 +66,6 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
                         field("function", StringType, true),
                         field("view", StringType, true),
                         field("access", StringType, false),
-                        field("principal_type", StringType, false),
                         field("principal", StringType, false),
                         field("expire_time", StringType, true),
                         field("inherited_from_json", StringType, true),
@@ -93,7 +90,7 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        Integer maxResults = args.isNullAt(10) ? null : args.getInt(10);
+        Integer maxResults = args.isNullAt(9) ? null : args.getInt(9);
         ListPermissionsRequest request =
                 new ListPermissionsRequest(
                         resourceType,
@@ -105,14 +102,10 @@ public InternalRow[] call(InternalRow args) {
                         args.isNullAt(3) ? null : emptyToNull(args.getString(3)),
                         args.isNullAt(4) ? null : emptyToNull(args.getString(4)),
                         args.isNullAt(5) ? null : emptyToNull(args.getString(5)),
-                        optionalEnum(
-                                args.isNullAt(6) ? null : args.getString(6),
-                                PrincipalType.class,
-                                PARAMETERS[6].name()),
+                        args.isNullAt(6) ? null : emptyToNull(args.getString(6)),
                         args.isNullAt(7) ? null : emptyToNull(args.getString(7)),
-                        args.isNullAt(8) ? null : emptyToNull(args.getString(8)),
-                        !args.isNullAt(9) && args.getBoolean(9),
-                        args.isNullAt(11) ? null : emptyToNull(args.getString(11)),
+                        !args.isNullAt(8) && args.getBoolean(8),
+                        args.isNullAt(10) ? null : emptyToNull(args.getString(10)),
                         maxResults);
         PagedList<PermissionAssignment> page = permissionManagement().listPermissions(request);
         List<PermissionAssignment> assignments = page.getElements();
@@ -132,8 +125,7 @@ public InternalRow[] call(InternalRow args) {
                             string(assignment.getResource().getFunction()),
                             string(assignment.getResource().getView()),
                             string(assignment.getAccess()),
-                            string(assignment.getPrincipal().getType().name()),
-                            string(assignment.getPrincipal().getId()),
+                            string(assignment.getPrincipal()),
                             string(assignment.getExpireTime()),
                             json(assignment.getInheritedFrom()),
                             string(page.getNextPageToken()));
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
index f0c5a79259fd..7d826614ae5a 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
@@ -23,7 +23,6 @@
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PolicyType;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.utils.JsonSerdeUtil;
 
@@ -46,10 +45,9 @@ public class ListPoliciesProcedure extends BasePolicyProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("database", StringType),
                 ProcedureParameter.required("table", StringType),
-                ProcedureParameter.optional("name", StringType),
                 ProcedureParameter.optional("policy_type", StringType),
-                ProcedureParameter.optional("principal_type", StringType),
                 ProcedureParameter.optional("principal", StringType),
+                ProcedureParameter.optional("column", StringType),
                 ProcedureParameter.optional("max_results", IntegerType),
                 ProcedureParameter.optional("page_token", StringType)
             };
@@ -59,14 +57,11 @@ public class ListPoliciesProcedure extends BasePolicyProcedure {
                     new StructField[] {
                         field("database", StringType, false),
                         field("table", StringType, false),
-                        field("name", StringType, false),
                         field("policy_type", StringType, false),
+                        field("principal", StringType, false),
                         field("function_name", StringType, false),
                         field("on_column", StringType, true),
                         field("function_arguments_json", StringType, false),
-                        field("to_principals_json", StringType, false),
-                        field("except_principals_json", StringType, false),
-                        field("comment", StringType, true),
                         field("next_page_token", StringType, true)
                     });
 
@@ -89,18 +84,14 @@ public InternalRow[] call(InternalRow args) {
         ListPoliciesRequest request =
                 new ListPoliciesRequest(
                         tableResource(args.getString(0), args.getString(1)),
-                        args.isNullAt(2) ? null : args.getString(2),
                         optionalEnum(
-                                args.isNullAt(3) ? null : args.getString(3),
+                                args.isNullAt(2) ? null : args.getString(2),
                                 PolicyType.class,
-                                PARAMETERS[3].name()),
-                        optionalEnum(
-                                args.isNullAt(4) ? null : args.getString(4),
-                                PrincipalType.class,
-                                PARAMETERS[4].name()),
-                        args.isNullAt(5) ? null : args.getString(5),
-                        args.isNullAt(7) ? null : args.getString(7),
-                        args.isNullAt(6) ? null : args.getInt(6));
+                                PARAMETERS[2].name()),
+                        args.isNullAt(3) ? null : args.getString(3),
+                        args.isNullAt(4) ? null : args.getString(4),
+                        args.isNullAt(6) ? null : args.getString(6),
+                        args.isNullAt(5) ? null : args.getInt(5));
         PagedList<DataPolicy> page = policyManagement().listPolicies(request);
         List<DataPolicy> policies = page.getElements();
         if (policies == null || policies.isEmpty()) {
@@ -115,8 +106,8 @@ public InternalRow[] call(InternalRow args) {
                     newInternalRow(
                             string(policy.getResource().getDatabase()),
                             string(policy.getResource().getTable()),
-                            string(policy.getName()),
                             string(policy.type().name()),
+                            string(policy.getPrincipal()),
                             string(
                                     rowFilter == null
                                             ? columnMask.getFunctionName()
@@ -126,9 +117,6 @@ public InternalRow[] call(InternalRow args) {
                                     rowFilter == null
                                             ? columnMask.getFunctionArguments()
                                             : rowFilter.getFunctionArguments()),
-                            json(policy.getToPrincipals()),
-                            json(policy.getExceptPrincipals()),
-                            string(policy.getComment()),
                             string(page.getNextPageToken()));
         }
         return rows;
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
index 706103979eac..0b383633c3de 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
@@ -19,7 +19,6 @@
 package org.apache.paimon.spark.procedure;
 
 import org.apache.paimon.management.PermissionIdentity;
-import org.apache.paimon.management.PrincipalType;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
@@ -38,7 +37,6 @@ public class RevokePermissionProcedure extends BasePermissionProcedure {
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
                 ProcedureParameter.required("access", StringType),
-                ProcedureParameter.required("principal_type", StringType),
                 ProcedureParameter.required("principal", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
@@ -75,13 +73,12 @@ public InternalRow[] call(InternalRow args) {
                 identity(
                         resourceType,
                         args.getString(1),
-                        enumValue(args.getString(2), PrincipalType.class, PARAMETERS[2].name()),
-                        args.getString(3),
+                        args.getString(2),
+                        args.isNullAt(3) ? null : args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6),
-                        args.isNullAt(7) ? null : args.getString(7),
-                        args.isNullAt(8) ? null : args.getString(8));
+                        args.isNullAt(7) ? null : args.getString(7));
 
         permissionManagement().revokePermission(identity);
         return new InternalRow[] {newInternalRow(true)};
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
index 96c247180997..12b5c8febecc 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/PaimonSparkTestWithRestCatalogBase.scala
@@ -18,7 +18,6 @@
 
 package org.apache.paimon.spark
 
-import org.apache.paimon.management.{PrincipalRef, PrincipalType}
 import org.apache.paimon.options.CatalogOptions
 import org.apache.paimon.rest.{RESTCatalogFactory, RESTCatalogInternalOptions, RESTCatalogServer}
 import org.apache.paimon.rest.auth.{AuthProviderEnum, BearTokenAuthProvider}
@@ -53,9 +52,9 @@ class PaimonSparkTestWithRestCatalogBase extends PaimonSparkTestBase {
     serverUrl = restCatalogServer.getUrl
     super.beforeAll()
     Seq("analyst", "first", "second", "reader", "function_reader").foreach(
-      id => restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.ROLE, id)))
-    restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.GROUP, "analysts"))
-    restCatalogServer.registerManagementPrincipal(new PrincipalRef(PrincipalType.USER, "admin"))
+      restCatalogServer.registerManagementPrincipal)
+    restCatalogServer.registerManagementPrincipal("analysts")
+    restCatalogServer.registerManagementPrincipal("admin")
     spark.sql("CREATE DATABASE IF NOT EXISTS paimon.sales")
     spark.sql("""CREATE TABLE IF NOT EXISTS paimon.sales.orders (
                 |  id INT,
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index 1d4ef1ce207f..02274632cd82 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -20,7 +20,7 @@ package org.apache.paimon.spark.procedure
 
 import org.apache.paimon.catalog.Identifier
 import org.apache.paimon.data.BinaryString
-import org.apache.paimon.management.{ColumnMask, PermissionResource, PrincipalRef, PrincipalType, ResourceType, RowFilter}
+import org.apache.paimon.management.{ColumnMask, PermissionResource, ResourceType, RowFilter}
 import org.apache.paimon.predicate.{ConcatTransform, Equal, FieldRef, FieldTransform, LeafPredicate, Predicate, Transform}
 import org.apache.paimon.schema.TableSchema
 import org.apache.paimon.spark.{PaimonSparkTestBase, PaimonSparkTestWithRestCatalogBase}
@@ -40,7 +40,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.grant_permission(
                   |  resource_type => 'table',
                   |  access => 'select',
-                  |  principal_type => 'role',
                   |  principal => 'analyst',
                   |  database => 'sales',
                   |  table => 'orders',
@@ -53,7 +52,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.grant_permission(
                   |  resource_type => 'TABLE',
                   |  access => 'SELECT',
-                  |  principal_type => 'ROLE',
                   |  principal => 'analyst',
                   |  database => 'sales',
                   |  table => 'orders',
@@ -67,7 +65,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
              |  resource_type => 'TABLE',
              |  database => 'sales',
              |  table => 'orders',
-             |  principal_type => 'ROLE',
              |  principal => 'analyst')
              |""".stripMargin)
       .collect()
@@ -78,16 +75,14 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     assertThat(assignment.getString(2)).isEqualTo("sales")
     assertThat(assignment.getString(3)).isEqualTo("orders")
     assertThat(assignment.getString(6)).isEqualTo("SELECT")
-    assertThat(assignment.getString(7)).isEqualTo("ROLE")
-    assertThat(assignment.getString(8)).isEqualTo("analyst")
-    assertThat(assignment.getString(9)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.getString(7)).isEqualTo("analyst")
+    assertThat(assignment.getString(8)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.isNullAt(9)).isTrue
     assertThat(assignment.isNullAt(10)).isTrue
-    assertThat(assignment.isNullAt(11)).isTrue
 
     val revoke = """CALL sys.revoke_permission(
                    |  resource_type => 'TABLE',
                    |  access => 'SELECT',
-                   |  principal_type => 'ROLE',
                    |  principal => 'analyst',
                    |  database => 'sales',
                    |  table => 'orders')
@@ -99,7 +94,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
                   |  resource_type => 'TABLE',
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  principal_type => 'ROLE',
                   |  principal => 'analyst')
                   |""".stripMargin),
       Nil
@@ -113,16 +107,16 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val first = spark
       .sql("CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1)")
       .head()
-    assertThat(first.getString(8)).isEqualTo("first")
-    assertThat(first.getString(11)).isEqualTo("1")
+    assertThat(first.getString(7)).isEqualTo("first")
+    assertThat(first.getString(10)).isEqualTo("1")
 
     val second = spark
       .sql(
         "CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1, page_token => '1')"
       )
       .head()
-    assertThat(second.getString(8)).isEqualTo("second")
-    assertThat(second.isNullAt(11)).isTrue
+    assertThat(second.getString(7)).isEqualTo("second")
+    assertThat(second.isNullAt(10)).isTrue
   }
 
   test("create, replace, apply and idempotently drop table data policies") {
@@ -131,8 +125,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       "security.filter_region_v2",
       rowFilterCompiler)
     restCatalogServer.registerColumnMaskPolicyCompiler("security.mask_email", columnMaskCompiler)
-    restCatalogServer.setQueryPrincipals(
-      Collections.singleton(new PrincipalRef(PrincipalType.ROLE, "analyst")))
+    restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
     spark.sql(
       "INSERT OVERWRITE paimon.sales.orders VALUES " +
         "(1, 'APAC', 'apac@example.com'), (2, 'EMEA', 'emea@example.com')")
@@ -141,12 +134,10 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.create_policy(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'region_filter',
                   |  policy_type => 'ROW_FILTER',
+                  |  principal => 'analyst',
                   |  function_name => 'security.filter_region',
-                  |  to_principals => array('ROLE:analyst'),
-                  |  function_arguments => array('column:region', 'constant:APAC'),
-                  |  comment => 'Filter rows by region')
+                  |  function_arguments => array('column:region', 'constant:APAC'))
                   |""".stripMargin),
       Row(true)
     )
@@ -155,15 +146,15 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       .sql("""CALL sys.list_policies(
              |  database => 'sales',
              |  table => 'orders',
-             |  name => 'region_filter')
+             |  policy_type => 'ROW_FILTER',
+             |  principal => 'analyst')
              |""".stripMargin)
       .head()
-    assertThat(direct.getString(2)).isEqualTo("region_filter")
-    assertThat(direct.getString(3)).isEqualTo("ROW_FILTER")
+    assertThat(direct.getString(2)).isEqualTo("ROW_FILTER")
+    assertThat(direct.getString(3)).isEqualTo("analyst")
     assertThat(direct.getString(4)).isEqualTo("security.filter_region")
     assertThat(direct.isNullAt(5)).isTrue
     assertThat(direct.getString(6)).contains("\"column\":\"region\"")
-    assertThat(direct.getString(7)).contains("\"type\":\"ROLE\"")
     checkAnswer(
       spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
       Row(1, "APAC", "apac@example.com")
@@ -173,12 +164,10 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.create_or_replace_policy(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'region_filter',
                   |  policy_type => 'ROW_FILTER',
+                  |  principal => 'analyst',
                   |  function_name => 'security.filter_region_v2',
-                  |  function_arguments => array('column:region', 'constant:EMEA'),
-                  |  to_principals => array('ROLE:analyst'),
-                  |  except_principals => array('USER:admin'))
+                  |  function_arguments => array('column:region', 'constant:EMEA'))
                   |""".stripMargin),
       Row(true)
     )
@@ -186,7 +175,8 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       .sql("""CALL sys.list_policies(
              |  database => 'sales',
              |  table => 'orders',
-             |  name => 'region_filter')
+             |  policy_type => 'ROW_FILTER',
+             |  principal => 'analyst')
              |""".stripMargin)
       .head()
     assertThat(replaced.getString(4)).isEqualTo("security.filter_region_v2")
@@ -195,13 +185,11 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.create_policy(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'mask_email',
                   |  policy_type => 'COLUMN_MASKING',
+                  |  principal => 'analyst',
                   |  function_name => 'security.mask_email',
                   |  on_column => 'email',
-                  |  function_arguments => array('constant:****'),
-                  |  to_principals => array('ROLE:analyst'),
-                  |  except_principals => array('USER:admin'))
+                  |  function_arguments => array('constant:****'))
                   |""".stripMargin),
       Row(true)
     )
@@ -213,32 +201,21 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
              |  policy_type => 'COLUMN_MASKING')
              |""".stripMargin)
       .head()
-    assertThat(mask.getString(2)).isEqualTo("mask_email")
+    assertThat(mask.getString(2)).isEqualTo("COLUMN_MASKING")
+    assertThat(mask.getString(3)).isEqualTo("analyst")
     assertThat(mask.getString(5)).isEqualTo("email")
     assertThat(mask.getString(6)).contains("\"constant\":\"****\"")
-    assertThat(mask.getString(8)).contains("\"id\":\"admin\"")
 
     checkAnswer(
       spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
       Row(2, "EMEA", "****")
     )
-    val exemptPrincipals = new java.util.HashSet[PrincipalRef]()
-    exemptPrincipals.add(new PrincipalRef(PrincipalType.ROLE, "analyst"))
-    exemptPrincipals.add(new PrincipalRef(PrincipalType.USER, "admin"))
-    restCatalogServer.setQueryPrincipals(exemptPrincipals)
-    checkAnswer(
-      spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
-      Seq(
-        Row(1, "APAC", "apac@example.com"),
-        Row(2, "EMEA", "emea@example.com")
-      )
-    )
-
     checkAnswer(
       spark.sql("""CALL sys.drop_policy(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'region_filter',
+                  |  policy_type => 'ROW_FILTER',
+                  |  principal => 'analyst',
                   |  if_exists => true)
                   |""".stripMargin),
       Row(true)
@@ -247,7 +224,8 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.drop_policy(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'region_filter',
+                  |  policy_type => 'ROW_FILTER',
+                  |  principal => 'analyst',
                   |  if_exists => true)
                   |""".stripMargin),
       Row(true)
@@ -256,13 +234,15 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       spark.sql("""CALL sys.list_policies(
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  name => 'region_filter')
+                  |  policy_type => 'ROW_FILTER',
+                  |  principal => 'analyst')
                   |""".stripMargin),
       Nil
     )
     spark.sql(
       "CALL sys.drop_policy(database => 'sales', table => 'orders', " +
-        "name => 'mask_email', if_exists => true)")
+        "policy_type => 'COLUMN_MASKING', " +
+        "principal => 'analyst', column => 'email', if_exists => true)")
   }
 
   test("policy creation validates query authorization, functions and columns") {
@@ -278,9 +258,9 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val disabled = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'disabled_orders', name => 'disabled',
+               |  database => 'sales', table => 'disabled_orders',
                |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
-               |  to_principals => array('ROLE:analyst'))
+               |  principal => 'analyst')
                |""".stripMargin)
         .collect()
     }
@@ -289,9 +269,9 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val missingFunction = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'orders', name => 'missing_function',
+               |  database => 'sales', table => 'orders',
                |  policy_type => 'ROW_FILTER', function_name => 'security.missing',
-               |  to_principals => array('ROLE:analyst'))
+               |  principal => 'analyst')
                |""".stripMargin)
         .collect()
     }
@@ -300,10 +280,10 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val missingColumn = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'orders', name => 'missing_column',
+               |  database => 'sales', table => 'orders',
                |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
                |  function_arguments => array('column:unknown'),
-               |  to_principals => array('ROLE:analyst'))
+               |  principal => 'analyst')
                |""".stripMargin)
         .collect()
     }
@@ -312,9 +292,9 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val missingPrincipal = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'orders', name => 'missing_principal',
+               |  database => 'sales', table => 'orders',
                |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
-               |  to_principals => array('ROLE:missing'))
+               |  principal => 'missing')
                |""".stripMargin)
         .collect()
     }
@@ -325,8 +305,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     restCatalogServer.registerRowFilterPolicyCompiler(
       "security.lifecycle_filter",
       rowFilterCompiler)
-    restCatalogServer.setQueryPrincipals(
-      Collections.singleton(new PrincipalRef(PrincipalType.ROLE, "analyst")))
+    restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
     spark.sql("""CREATE TABLE paimon.sales.lifecycle_orders (
                 |  id INT,
                 |  region STRING)
@@ -335,10 +314,10 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     spark.sql("INSERT INTO paimon.sales.lifecycle_orders VALUES (1, 'APAC'), (2, 'EMEA')")
     checkAnswer(
       spark.sql("""CALL sys.create_policy(
-                  |  database => 'sales', table => 'lifecycle_orders', name => 'region_filter',
+                  |  database => 'sales', table => 'lifecycle_orders',
                   |  policy_type => 'ROW_FILTER', function_name => 'security.lifecycle_filter',
                   |  function_arguments => array('column:region', 'constant:APAC'),
-                  |  to_principals => array('ROLE:analyst'))
+                  |  principal => 'analyst')
                   |""".stripMargin),
       Row(true)
     )
@@ -347,7 +326,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     assertThat(
       spark
         .sql("CALL sys.list_policies(database => 'sales', table => 'renamed_orders', " +
-          "name => 'region_filter')")
+          "policy_type => 'ROW_FILTER', principal => 'analyst')")
         .head()
         .getString(1)).isEqualTo("renamed_orders")
     assertThat(
@@ -384,7 +363,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     checkAnswer(
       spark.sql(
         "CALL sys.list_policies(database => 'sales', table => 'renamed_orders', " +
-          "name => 'region_filter')"),
+          "policy_type => 'ROW_FILTER', principal => 'analyst')"),
       Nil
     )
     assertThat(
@@ -402,7 +381,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
         spark
           .sql("""CALL sys.grant_permission(
                  |  resource_type => 'TABLE', access => 'SELECT',
-                 |  principal_type => 'ROLE', principal => 'analyst',
+                 |  principal => 'analyst',
                  |  database => 'sales', table => 'orders')
                  |""".stripMargin)
           .collect()
@@ -428,7 +407,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
                   |  resource_type => 'CATALOG',
                   |  scope => 'DESCENDANTS',
                   |  access => 'EXECUTE',
-                  |  principal_type => 'ROLE',
                   |  principal => 'function_reader')
                   |""".stripMargin),
       Row(true)
@@ -439,7 +417,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
                   |  resource_type => 'TABLE',
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  principal_type => 'ROLE',
                   |  principal => 'reader')
                   |""".stripMargin),
       Nil
@@ -451,21 +428,19 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
              |  database => 'sales',
              |  table => 'orders',
              |  scope => 'SELF',
-             |  principal_type => 'ROLE',
              |  principal => 'reader',
              |  include_inherited => true)
              |""".stripMargin)
       .head()
     assertThat(inherited.getString(0)).isEqualTo("TABLE")
     assertThat(inherited.getString(1)).isEqualTo("SELF")
-    assertThat(inherited.getString(10)).contains("\"type\":\"CATALOG\"")
+    assertThat(inherited.getString(9)).contains("\"type\":\"CATALOG\"")
 
     checkAnswer(
       spark.sql("""CALL sys.list_permissions(
                   |  resource_type => 'TABLE',
                   |  database => 'sales',
                   |  table => 'orders',
-                  |  principal_type => 'ROLE',
                   |  principal => 'function_reader',
                   |  include_inherited => true)
                   |""".stripMargin),
@@ -479,7 +454,6 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
                    |  resource_type => 'CATALOG',
                    |  scope => 'DESCENDANTS',
                    |  access => 'SELECT',
-                   |  principal_type => 'ROLE',
                    |  principal => '$principal')
                    |""".stripMargin),
       Row(true)
@@ -523,7 +497,6 @@ class PermissionProcedureUnsupportedCatalogTest extends PaimonSparkTestBase {
         .sql("""CALL sys.grant_permission(
                |  resource_type => 'CATALOG',
                |  access => 'USE_CATALOG',
-               |  principal_type => 'ROLE',
                |  principal => 'admin')
                |""".stripMargin)
         .collect()

From 2a9ce29e39d52d4ad77238092d3620ccd4bb4b41 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 21:22:00 +0800
Subject: [PATCH 06/12] [api][spark] Simplify permission and data policy
 contracts

---
 docs/docs/concepts/rest/management-api.md     | 150 +++----
 docs/scripts/validate-rest-openapi.js         |  76 +---
 docs/static/rest-management-open-api.yaml     | 124 ++----
 .../apache/paimon/management/ColumnMask.java  |  55 +--
 .../apache/paimon/management/DataPolicy.java  |   3 +-
 .../management/ListPermissionsRequest.java    |  29 +-
 .../paimon/management/PermissionAccess.java   |  50 +--
 .../management/PermissionAssignment.java      |  63 +--
 .../paimon/management/PermissionIdentity.java |  20 +-
 .../paimon/management/PermissionScope.java    |  37 --
 .../paimon/management/PolicyArgument.java     |  90 -----
 .../apache/paimon/management/RowFilter.java   |  54 +--
 .../java/org/apache/paimon/rest/RESTApi.java  |   6 -
 .../rest/requests/GrantPermissionRequest.java |  30 +-
 .../requests/RevokePermissionRequest.java     |  19 +-
 .../PermissionManagementJsonTest.java         | 186 +++------
 .../rest/RESTPermissionManagementTest.java    |  11 +-
 .../paimon/rest/RESTPolicyManagementTest.java |   7 +-
 .../paimon/catalog/TableQueryAuthResult.java  |  42 +-
 .../table/source/AbstractDataTableRead.java   |  19 +-
 .../catalog/TableQueryAuthResultTest.java     |  87 ++++
 .../org/apache/paimon/rest/PolicyKeyTest.java |   6 +-
 .../apache/paimon/rest/RESTCatalogServer.java | 202 +++++-----
 .../paimon/rest/RESTPermissionStore.java      |  86 +---
 .../paimon/rest/RESTPermissionStoreTest.java  |  46 +--
 .../procedure/BasePermissionProcedure.java    |  20 +-
 .../spark/procedure/BasePolicyProcedure.java  |  66 +---
 .../CreateOrReplacePolicyBaseProcedure.java   |   8 +-
 .../procedure/GrantPermissionProcedure.java   |   4 +-
 .../procedure/ListPermissionsProcedure.java   |  26 +-
 .../procedure/ListPoliciesProcedure.java      |  19 +-
 .../procedure/RevokePermissionProcedure.java  |   6 +-
 .../procedure/PermissionProcedureTest.scala   | 372 +++++++++---------
 33 files changed, 701 insertions(+), 1318 deletions(-)
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/catalog/TableQueryAuthResultTest.java

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index 92a5a5257cc0..b63938c067a7 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -22,7 +22,7 @@ limitations under the License.
 
 The REST Management API is an experimental OpenAPI 3.1 control-plane extension for object
 privileges, row filters, and column masks in a Paimon REST Catalog. Its current contract version is
-`0.4.0` and may evolve incompatibly while the design is being validated.
+`1.0` and may evolve incompatibly while the design is being validated.
 
 `RESTCatalog` exposes `permissionManagement()` and `policyManagement()` directly. These methods are
 intentionally not part of the generic `Catalog` interface. A non-REST catalog therefore reports an
@@ -46,7 +46,7 @@ DELETE /v1/{prefix}/databases/{database}/tables/{table}/policies
 ```
 
 Policies are currently attached only to tables. The path is the attachment identity, so policy
-request bodies do not repeat a catalog, database, table, resource type, or scope. Catalog- and
+request bodies do not repeat a catalog, database, table, or resource type. Catalog- and
 database-level matching can be added later with explicit matching semantics instead of implied
 path inheritance.
 
@@ -63,13 +63,13 @@ This separation also defines the expected query path:
 
 1. The server evaluates object privileges.
 2. The server resolves all row-filter and column-masking policies applicable to the caller.
-3. The existing REST Catalog table authorization endpoint returns the compiled Paimon predicate
-   and column transforms to the engine.
+3. The existing REST Catalog table authorization endpoint returns the stored Paimon predicate and
+   column transforms to the engine.
 4. The engine applies those restrictions when planning the scan.
 
-Management payloads store function references and arguments, not executable SQL text or compiled
-Paimon expressions. Function lookup, signature checking, policy conflict detection, and expression
-compilation are server responsibilities.
+Management payloads use the same serialized Paimon `Predicate` and `Transform` representation as
+the existing `AuthTableQueryResponse`. Policy conflict detection, schema validation, and principal
+resolution are server responsibilities.
 
 ## Permission model
 
@@ -83,9 +83,6 @@ Permission resources are structured objects:
 | `FUNCTION` | `database`, `function` | `{"type":"FUNCTION","database":"sales","function":"calculate_tax"}` |
 | `VIEW` | `database`, `view` | `{"type":"VIEW","database":"sales","view":"daily_orders"}` |
 
-`SELF` applies only to the referenced resource and is the default. `DESCENDANTS` applies below a
-`CATALOG` or `DATABASE`; it is invalid on `TABLE`, `FUNCTION`, and `VIEW` resources.
-
 Principals are opaque, canonical strings that are globally unique in the server namespace. Their
 format is server-defined and may encode a user, group, role, or service identity, for example
 `role:analyst` or an external identity-provider ARN. Principal type and membership resolution are
@@ -95,7 +92,7 @@ persistence identifiers; those internal ids are not exposed by this API.
 
 Built-in accesses are resource-specific:
 
-| Resource | `SELF` accesses |
+| Resource | Accesses |
 | --- | --- |
 | `CATALOG` | `USE_CATALOG`, `CREATE_DATABASE`, `MANAGE_PERMISSIONS` |
 | `DATABASE` | `USE_DATABASE`, `CREATE_TABLE`, `CREATE_VIEW`, `CREATE_FUNCTION`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
@@ -107,21 +104,20 @@ Java and Spark helpers accept access names case-insensitively and normalize them
 The REST wire format uses upper case. Implementations may add namespaced accesses such as
 `VENDOR.EXAMPLE/SOME_ACCESS`; unknown unnamespaced accesses are rejected.
 
-An assignment identity is `resource`, `scope`, `access`, and `principal`. Granting the same identity
-replaces its expiry. Revocation is idempotent. `includeInherited` only expands resource ancestry;
-resolving group membership and role inheritance remains a server responsibility.
+An assignment identity is `resource`, `access`, and `principal`. Granting the same identity replaces
+its expiry, and revocation is idempotent. Assignments apply only to the exact referenced resource;
+resource inheritance is not part of this experimental contract. Resolving group membership and role
+inheritance remains a server responsibility.
 
 `expireTime`, when present, is an exclusive upper bound evaluated against the REST server clock.
 At `now >= expireTime`, the assignment must not authorize access. Expired direct assignments may
-remain visible in listings until server cleanup, but `includeInherited=true` must not materialize an
-expired assignment as an effective inherited view. Timestamps must not be more precise than
+remain visible in listings until server cleanup. Timestamps must not be more precise than
 milliseconds.
 
 Resource objects in this API are wire locators, not persistence identities. Servers must bind direct
 assignments to a stable internal resource identity: renaming a database, table, function, or view
 retains its assignments and subsequent responses use the new locator; dropping it removes its direct
-assignments; recreating the same locator does not restore them. A child rename does not change a
-`DESCENDANTS` assignment attached to its catalog or database ancestor.
+assignments; recreating the same locator does not restore them.
 
 ## Data policy model
 
@@ -135,37 +131,35 @@ Each policy contains exactly one typed definition:
 
 | Definition | Required fields | Result |
 | --- | --- | --- |
-| `rowFilter` | `functionName`, ordered `functionArguments` | A boolean predicate applied to every scan. |
-| `columnMask` | `functionName`, `onColumn`, ordered `functionArguments` | A value compatible with the protected column. |
-
-The common field is one `principal`. A function argument is exactly one of
-`{"column":"region"}` or `{"constant":"APAC"}`. Constants are strings and may be empty;
-column names may not be empty. `functionArguments` is optional and defaults to an empty list.
+| `rowFilter` | `predicate` | One serialized Paimon `Predicate`, applied to every scan. |
+| `columnMask` | `onColumn`, `transform` | One serialized Paimon `Transform` whose result replaces the protected column. |
 
-For a row filter, the arguments are passed positionally and the function must return boolean. For a
-column mask, `onColumn` is the protected input and `functionArguments` contains additional
-positional arguments. The REST server resolves the named function and compiles it into the existing
-Paimon predicate or column transform returned by table query authorization.
+The common field is one `principal`. `rowFilter.predicate` maps directly to one entry in
+`AuthTableQueryResponse.filter`. `columnMask.onColumn` and `columnMask.transform` map directly to
+one key and value in `AuthTableQueryResponse.columnMasking`. Each JSON value is limited to 60 KiB
+in UTF-8. This is Paimon's versioned serialization format rather than SQL text or a portable policy
+DSL; clients and servers must use compatible Paimon versions.
 
 Policy create and create-or-replace must be rejected unless all of these conditions hold:
 
 1. The target database and table exist.
 2. The table has `query-auth.enabled=true`; otherwise a stored policy could be silently bypassed.
 3. The referenced principal exists.
-4. The policy function exists, has a compatible signature, and can be compiled by the server.
-5. `onColumn` and every column argument exist in the target table.
+4. The predicate or transform is recognized by the server, deserializes to a non-null Paimon
+   object, and is canonicalized before storage.
+5. Every referenced field and `onColumn` exists in the target table, and a transform's output type
+   matches its protected column.
 
 These invariants continue to apply for the whole table lifecycle. Servers must bind policies to a
 stable table identity, preserve that binding across table renames, and remove the policies when the
 table is dropped. A table with policies must reject changes that disable `query-auth.enabled` or
-remove or rename a protected or argument column, unless the policy update and schema change are
+remove or rename a protected or referenced column, unless the policy update and schema change are
 performed atomically. If an implementation persists all masks for one principal in one document,
 creating, replacing, or dropping one column mask must atomically preserve masks for other columns.
 
 At authorization time, all applicable row filters must be combined with logical `AND`. More than
-one applicable column mask targeting the same column must fail closed. An unresolved function,
-invalid signature, or policy compilation failure must also fail closed rather than omit a
-restriction.
+one applicable column mask targeting the same column must fail closed. An invalid, unsupported, or
+schema-incompatible predicate or transform must also fail closed rather than omit a restriction.
 
 This experimental contract deliberately does not define governed tags, catalog/database policy
 inheritance, or tag-driven matching. Those features need explicit match conditions and conflict
@@ -180,7 +174,7 @@ The following examples assume a Spark catalog named `paimon`. Replace it with th
 
 `grant_permission` returns one row with `result = true` when the server accepts the assignment.
 
-Grant catalog access or a privilege inherited by catalog descendants:
+Grant catalog access:
 
 ```sql
 CALL paimon.sys.grant_permission(
@@ -188,31 +182,16 @@ CALL paimon.sys.grant_permission(
   access => 'USE_CATALOG',
   principal => 'role:catalog_user'
 );
-
-CALL paimon.sys.grant_permission(
-  resource_type => 'CATALOG',
-  scope => 'DESCENDANTS',
-  access => 'SELECT',
-  principal => 'group:analysts'
-);
 ```
 
-Grant database privileges on the database itself or all objects below it:
+Grant a database privilege with an optional expiration time:
 
 ```sql
 CALL paimon.sys.grant_permission(
   resource_type => 'DATABASE',
   database => 'sales',
   access => 'CREATE_TABLE',
-  principal => 'role:data_engineer'
-);
-
-CALL paimon.sys.grant_permission(
-  resource_type => 'DATABASE',
-  database => 'sales',
-  scope => 'DESCENDANTS',
-  access => 'SELECT',
-  principal => 'role:sales_reader',
+  principal => 'role:data_engineer',
   expire_time => '2027-01-01T00:00:00Z'
 );
 ```
@@ -258,7 +237,7 @@ CALL paimon.sys.list_permissions(
 );
 ```
 
-Filter by principal, scope, or access:
+Filter by principal or access:
 
 ```sql
 CALL paimon.sys.list_permissions(
@@ -270,19 +249,7 @@ CALL paimon.sys.list_permissions(
 );
 ```
 
-Include catalog and database descendant assignments effective on a table:
-
-```sql
-CALL paimon.sys.list_permissions(
-  resource_type => 'TABLE',
-  database => 'sales',
-  table => 'orders',
-  include_inherited => true
-);
-```
-
-The `inherited_from_json` output identifies the direct assignment source. `next_page_token` is
-opaque; pass it back unchanged with the same filters:
+The `next_page_token` output is opaque; pass it back unchanged with the same filters:
 
 ```sql
 CALL paimon.sys.list_permissions(
@@ -296,13 +263,13 @@ CALL paimon.sys.list_permissions(
 
 ### Revoke permissions
 
-Supply the same four identity fields used by the grant. `expire_time` is not part of identity.
+Supply the same three identity fields used by the grant. `expire_time` is not part of identity.
 
 ```sql
 CALL paimon.sys.revoke_permission(
-  resource_type => 'DATABASE',
+  resource_type => 'TABLE',
   database => 'sales',
-  scope => 'DESCENDANTS',
+  table => 'orders',
   access => 'SELECT',
   principal => 'role:sales_reader'
 );
@@ -319,12 +286,9 @@ ALTER TABLE paimon.sales.orders
 SET TBLPROPERTIES ('query-auth.enabled' = 'true');
 ```
 
-`create_policy` accepts the canonical `principal` directly. Function arguments use `column:value`
-or `constant:value`. Only the first colon is a delimiter, so a constant may contain later colons.
-`constant:` represents a valid empty string.
-
-This example asks the server to resolve
-`security.filter_region(region, 'APAC')` as a boolean predicate:
+`create_policy` accepts the canonical `principal` and a serialized Paimon `Predicate`. The JSON
+below is the same representation accepted in one `AuthTableQueryResponse.filter` entry. Named
+arguments are recommended because row-filter and column-mask definitions use different fields:
 
 ```sql
 CALL paimon.sys.create_policy(
@@ -332,8 +296,7 @@ CALL paimon.sys.create_policy(
   table => 'orders',
   policy_type => 'ROW_FILTER',
   principal => 'group:analysts',
-  function_name => 'security.filter_region',
-  function_arguments => array('column:region', 'constant:APAC')
+  predicate_json => '{"kind":"LEAF","transform":{"name":"FIELD_REF","fieldRef":{"index":1,"name":"region","type":"STRING"}},"function":"EQUAL","literals":["APAC"]}'
 );
 ```
 
@@ -343,8 +306,10 @@ principal with a separate call.
 
 ### Create column-masking policies
 
-For column masking, `on_column` identifies the protected column. Additional columns or constants
-can be supplied positionally:
+For column masking, `on_column` identifies the protected column and `transform_json` is the same
+serialized Paimon `Transform` representation used as an
+`AuthTableQueryResponse.columnMasking` value. This example replaces every visible phone number
+with a fixed string:
 
 ```sql
 CALL paimon.sys.create_policy(
@@ -352,14 +317,13 @@ CALL paimon.sys.create_policy(
   table => 'customers',
   policy_type => 'COLUMN_MASKING',
   principal => 'role:support',
-  function_name => 'security.mask_phone',
   on_column => 'phone_number',
-  function_arguments => array('column:region', 'constant:partial')
+  transform_json => '{"name":"CONCAT","inputs":["****"]}'
 );
 ```
 
-A mask with no additional arguments may omit `function_arguments`. An empty-string argument is
-written explicitly:
+A transform may reference table fields by name. The server remaps their indices to the current
+schema, rejects missing fields, and verifies that the result type matches `on_column`:
 
 ```sql
 CALL paimon.sys.create_policy(
@@ -367,13 +331,14 @@ CALL paimon.sys.create_policy(
   table => 'customers',
   policy_type => 'COLUMN_MASKING',
   principal => 'group:support',
-  function_name => 'security.mask_email',
   on_column => 'email',
-  function_arguments => array('constant:')
+  transform_json => '{"name":"CONCAT","inputs":[{"index":1,"name":"region","type":"STRING"},"-masked"]}'
 );
 ```
 
-`on_column` is required for `COLUMN_MASKING` and rejected for `ROW_FILTER`.
+`predicate_json` is required only for `ROW_FILTER`. `on_column` and `transform_json` are required
+only for `COLUMN_MASKING`. JSON containing a single quote must escape it as `''` inside the SQL
+string literal.
 
 ### Create or fully replace a policy
 
@@ -387,8 +352,7 @@ CALL paimon.sys.create_or_replace_policy(
   table => 'orders',
   policy_type => 'ROW_FILTER',
   principal => 'group:analysts',
-  function_name => 'security.filter_region_v2',
-  function_arguments => array('column:region')
+  predicate_json => '{"kind":"LEAF","transform":{"name":"FIELD_REF","fieldRef":{"index":1,"name":"region","type":"STRING"}},"function":"EQUAL","literals":["EMEA"]}'
 );
 ```
 
@@ -418,9 +382,10 @@ CALL paimon.sys.list_policies(
 );
 ```
 
-The output columns are `database`, `table`, `policy_type`, `principal`, `function_name`,
-`on_column`, `function_arguments_json`, and `next_page_token`. Pass an opaque continuation token
-back unchanged with the same filters:
+The output columns are `database`, `table`, `policy_type`, `principal`, `predicate_json`,
+`on_column`, `transform_json`, and `next_page_token`. A row filter has only `predicate_json`; a
+column mask has only `on_column` and `transform_json`. Pass an opaque continuation token back
+unchanged with the same filters:
 
 ```sql
 CALL paimon.sys.list_policies(
@@ -462,5 +427,4 @@ CALL paimon.sys.drop_policy(
 
 Creating, replacing, dropping, or inspecting permissions and policies requires the server to
 authorize the caller for `MANAGE_PERMISSIONS` on the relevant resource. Authentication, principal
-membership, policy persistence, function resolution, and audit logging remain REST server
-concerns.
+membership, policy persistence, schema validation, and audit logging remain REST server concerns.
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index b4084eff1b26..0276af2d21cc 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -377,29 +377,16 @@ function validateManagementOpenApi() {
     contract.requireResponses(operationId, ['409']),
   );
   contract.checkSpec(
-    contract.spec.info.version === '0.4.0' &&
+    contract.spec.info.version === '1.0' &&
       contract.spec.info.description.toLowerCase().includes('experimental'),
-    'The management contract must be versioned 0.4.0 and marked experimental',
+    'The management contract must be versioned 1.0 and marked experimental',
   );
 
-  const assignmentFields = [
-    'resource',
-    'scope',
-    'access',
-    'principal',
-    'expireTime',
-    'inheritedFrom',
-  ];
+  const assignmentFields = ['resource', 'access', 'principal', 'expireTime'];
   contract.requireProperties('PermissionAssignment', assignmentFields);
-  contract.requireRequiredProperties('PermissionAssignment', [
-    'resource',
-    'scope',
-    'access',
-    'principal',
-  ]);
+  contract.requireRequiredProperties('PermissionAssignment', ['resource', 'access', 'principal']);
   const grantProperties = contract.requireProperties('GrantPermissionRequest', [
     'resource',
-    'scope',
     'access',
     'principal',
     'expireTime',
@@ -409,11 +396,7 @@ function validateManagementOpenApi() {
     'access',
     'principal',
   ]);
-  contract.checkSpec(
-    grantProperties.scope.default === 'SELF',
-    'GrantPermissionRequest.scope must default to SELF',
-  );
-  ['inheritedFrom', 'columns', 'policy', 'grantOption'].forEach((field) =>
+  ['columns', 'policy', 'grantOption'].forEach((field) =>
     contract.checkSpec(
       !grantProperties[field],
       `Schema GrantPermissionRequest must omit field: ${field}`,
@@ -421,7 +404,6 @@ function validateManagementOpenApi() {
   );
   const revokeProperties = contract.requireProperties('RevokePermissionRequest', [
     'resource',
-    'scope',
     'access',
     'principal',
   ]);
@@ -430,11 +412,7 @@ function validateManagementOpenApi() {
     'access',
     'principal',
   ]);
-  contract.checkSpec(
-    revokeProperties.scope.default === 'SELF',
-    'RevokePermissionRequest.scope must default to SELF',
-  );
-  ['expireTime', 'inheritedFrom', 'columns', 'policy', 'grantOption'].forEach((field) =>
+  ['expireTime', 'columns', 'policy', 'grantOption'].forEach((field) =>
     contract.checkSpec(
       !revokeProperties[field],
       `Schema RevokePermissionRequest must omit field: ${field}`,
@@ -477,7 +455,6 @@ function validateManagementOpenApi() {
     'PrincipalQuery must reference Principal',
   );
   requireExactEnum(contract, 'ResourceType', ['CATALOG', 'DATABASE', 'TABLE', 'FUNCTION', 'VIEW']);
-  requireExactEnum(contract, 'PermissionScope', ['SELF', 'DESCENDANTS']);
   requireExactEnum(contract, 'PolicyType', ['ROW_FILTER', 'COLUMN_MASKING']);
 
   const accessAlternatives = contract.schema('PermissionAccess').oneOf || [];
@@ -583,16 +560,17 @@ function validateManagementOpenApi() {
   contract.requireSchemaReference('PolicyRequest', 'oneOf', 'ColumnMaskPolicyRequest');
   contract.requireSchemaReference('DataPolicy', 'oneOf', 'RowFilterDataPolicy');
   contract.requireSchemaReference('DataPolicy', 'oneOf', 'ColumnMaskDataPolicy');
-  contract.requireProperties('RowFilter', ['functionName', 'functionArguments']);
-  contract.requireProperties('ColumnMask', ['functionName', 'onColumn', 'functionArguments']);
-  contract.requireRequiredProperties('RowFilter', ['functionName']);
-  contract.requireRequiredProperties('ColumnMask', ['functionName', 'onColumn']);
-  ['RowFilter', 'ColumnMask'].forEach((schemaName) => {
-    const schema = contract.schema(schemaName);
+  const rowFilter = contract.requireProperties('RowFilter', ['predicate']);
+  const columnMask = contract.requireProperties('ColumnMask', ['onColumn', 'transform']);
+  contract.requireRequiredProperties('RowFilter', ['predicate']);
+  contract.requireRequiredProperties('ColumnMask', ['onColumn', 'transform']);
+  [rowFilter.predicate, columnMask.transform].forEach((definition) => {
     contract.checkSpec(
-      !(schema.required || []).includes('functionArguments') &&
-        schema.properties.functionArguments.default.length === 0,
-      `${schemaName}.functionArguments must be optional and default to an empty array`,
+      definition.type === 'string' &&
+        definition.minLength === 1 &&
+        definition['x-maxUtf8Bytes'] === 61440 &&
+        definition.contentMediaType === 'application/json',
+      'Policy definitions must be bounded non-empty JSON strings',
     );
   });
   ['RowFilterPolicyRequest', 'ColumnMaskPolicyRequest'].forEach((schemaName) => {
@@ -602,8 +580,7 @@ function validateManagementOpenApi() {
       `${schemaName}.principal must reference Principal`,
     );
     contract.checkSpec(
-      !properties.scope &&
-        !properties.type &&
+      !properties.type &&
         !properties.resource &&
         !properties.name &&
         !properties.toPrincipals &&
@@ -624,15 +601,6 @@ function validateManagementOpenApi() {
     'principal',
     'column',
   ]);
-  contract.checkSpec(
-    Array.isArray(contract.schema('PolicyArgument').oneOf) &&
-      contract.schema('PolicyArgument').oneOf.length === 2,
-    'PolicyArgument must contain exactly one column or constant',
-  );
-  contract.checkSpec(
-    !contract.schema('ConstantPolicyArgument').properties.constant.minLength,
-    'ConstantPolicyArgument.constant must allow the empty string',
-  );
   const tablePolicyResource = contract.requireProperties('TablePolicyResource', [
     'type',
     'database',
@@ -676,14 +644,12 @@ function validateManagementOpenApi() {
     );
   [
     'ResourceTypeQuery',
-    'ScopeQuery',
     'DatabaseQuery',
     'TableQuery',
     'FunctionQuery',
     'ViewQuery',
     'PrincipalQuery',
     'AccessQuery',
-    'IncludeInherited',
     'PageToken',
     'MaxResults',
   ].forEach((name) =>
@@ -692,6 +658,10 @@ function validateManagementOpenApi() {
       `Operation listPermissions is missing query parameter: ${name}`,
     ),
   );
+  contract.checkSpec(
+    permissionParameters.length === 9,
+    'Operation listPermissions must expose only exact-resource filters and pagination',
+  );
   contract.checkSpec(
     contract.spec.components.parameters.ResourceTypeQuery.required === true,
     'Operation listPermissions must require resourceType',
@@ -701,10 +671,6 @@ function validateManagementOpenApi() {
     .parameters.map((parameter) =>
       parameter.$ref ? parameter.$ref.split('/').pop() : parameter.name,
     );
-  contract.checkSpec(
-    !policyParameters.includes('IncludeInherited'),
-    'Table policies must not expose includeInherited',
-  );
   ['PolicyTypeQuery', 'PrincipalQuery', 'PolicyColumnQuery', 'PageToken', 'MaxResults'].forEach(
     (name) =>
       contract.checkSpec(
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index cc6f92c0fc05..1581b1fdacbb 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -17,16 +17,16 @@
 openapi: 3.1.1
 info:
   title: Paimon REST Management API
-  version: 0.4.0
+  version: "1.0"
   description: |
     Experimental control-plane extension for permissions, table row filters, and table column
     masks in one Paimon REST Catalog prefix. A data policy restricts an already-authorized read;
     it never grants SELECT by itself. Each policy is attached to one principal: a principal has at
     most one row filter per table and at most one mask per table column. Policy creation and
     replacement are accepted only when the target table exists, has `query-auth.enabled=true`, and
-    the referenced principal, function, and columns are valid. Principal lifecycle, function
-    implementation, audit, and persistence remain server responsibilities. This contract may evolve
-    incompatibly while experimental.
+    the referenced principal, serialized Paimon predicate or transform, and columns are valid.
+    Principal lifecycle, audit, and persistence remain server responsibilities. This contract may
+    evolve incompatibly while experimental.
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0.html
@@ -43,23 +43,18 @@ paths:
       summary: List permission assignments on an exact resource
       operationId: listPermissions
       description: |
-        Direct assignments are returned by default. With `includeInherited=true`, the request
-        still names one exact target and the server also returns effective views of ancestor
-        `DESCENDANTS` assignments. An effective view uses the target in `resource`, `SELF` in
-        `scope`, and the source attachment in `inheritedFrom`. Effective views must exclude expired
-        assignments. Direct expired assignments may remain visible until server cleanup. Following
-        the catalog pagination contract, an empty page terminates pagination and therefore must not
+        Returns direct assignments attached to the requested exact resource. Expired assignments
+        may remain visible until server cleanup, but must not authorize access. Following the
+        catalog pagination contract, an empty page terminates pagination and therefore must not
         carry a continuation token.
       parameters:
         - $ref: '#/components/parameters/ResourceTypeQuery'
-        - $ref: '#/components/parameters/ScopeQuery'
         - $ref: '#/components/parameters/DatabaseQuery'
         - $ref: '#/components/parameters/TableQuery'
         - $ref: '#/components/parameters/FunctionQuery'
         - $ref: '#/components/parameters/ViewQuery'
         - $ref: '#/components/parameters/PrincipalQuery'
         - $ref: '#/components/parameters/AccessQuery'
-        - $ref: '#/components/parameters/IncludeInherited'
         - $ref: '#/components/parameters/PageToken'
         - $ref: '#/components/parameters/MaxResults'
       responses:
@@ -91,9 +86,9 @@ paths:
       summary: Grant or replace a permission assignment
       operationId: grantPermission
       description: |
-        Creates an assignment or replaces the assignment with the same `resource`, `scope`,
-        `access`, and `principal`. The referenced resource and principal must exist. Servers bind
-        assignments to the resource lifecycle described by `PermissionResource`.
+        Creates an assignment or replaces the assignment with the same `resource`, `access`, and
+        `principal`. The referenced resource and principal must exist. Servers bind assignments to
+        the resource lifecycle described by `PermissionResource`.
       requestBody:
         required: true
         content:
@@ -161,7 +156,7 @@ paths:
       summary: List policies attached directly to a table
       operationId: listTablePolicies
       description: |
-        Policies have no ancestor scope in this contract. Following the catalog pagination
+        Policies are attached directly to the requested table. Following the catalog pagination
         contract, an empty page terminates pagination and therefore must not carry a continuation
         token.
       parameters:
@@ -198,7 +193,8 @@ paths:
       description: |
         Fails with 409 when the same principal already has a row filter or a mask on the same
         column, or when the table has not enabled query authorization. The principal, policy
-        function, protected column, and column arguments are validated before persistence.
+        predicate or transform, protected column, and referenced fields are validated before
+        persistence.
       requestBody:
         $ref: '#/components/requestBodies/PolicyRequest'
       responses:
@@ -312,11 +308,6 @@ components:
       required: true
       schema:
         $ref: '#/components/schemas/ResourceType'
-    ScopeQuery:
-      name: scope
-      in: query
-      schema:
-        $ref: '#/components/schemas/PermissionScope'
     DatabaseQuery:
       name: database
       in: query
@@ -352,12 +343,6 @@ components:
       in: query
       schema:
         $ref: '#/components/schemas/PermissionAccess'
-    IncludeInherited:
-      name: includeInherited
-      in: query
-      schema:
-        type: boolean
-        default: false
     PolicyColumnQuery:
       name: column
       in: query
@@ -394,7 +379,7 @@ components:
 
   responses:
     BadRequest:
-      description: Invalid request shape, resource identity, function, signature, or column.
+      description: Invalid request shape, resource identity, predicate, transform, or column.
       content:
         application/json:
           schema:
@@ -412,7 +397,7 @@ components:
           schema:
             $ref: '#/components/schemas/ErrorResponse'
     NotFound:
-      description: Referenced resource, principal, policy, or function does not exist.
+      description: Referenced resource, principal, or policy does not exist.
       content:
         application/json:
           schema:
@@ -458,9 +443,6 @@ components:
     ResourceType:
       type: string
       enum: [CATALOG, DATABASE, TABLE, FUNCTION, VIEW]
-    PermissionScope:
-      type: string
-      enum: [SELF, DESCENDANTS]
     PermissionAccess:
       description: |
         Canonical access value. The REST wire format uses upper case. Values are either a built-in
@@ -502,7 +484,7 @@ components:
         bind stored direct assignments to a stable internal resource identity. Renaming a database,
         table, function, or view retains its direct assignments and responses use the new locator.
         Dropping a resource removes its direct assignments, and recreating the same locator must not
-        inherit them. A child rename does not affect a CATALOG or DATABASE `DESCENDANTS` assignment.
+        inherit them.
       oneOf:
         - $ref: '#/components/schemas/CatalogResource'
         - $ref: '#/components/schemas/DatabaseResource'
@@ -576,12 +558,10 @@ components:
     PermissionAssignment:
       type: object
       additionalProperties: false
-      required: [resource, scope, access, principal]
+      required: [resource, access, principal]
       properties:
         resource:
           $ref: '#/components/schemas/PermissionResource'
-        scope:
-          $ref: '#/components/schemas/PermissionScope'
         access:
           $ref: '#/components/schemas/PermissionAccess'
         principal:
@@ -591,11 +571,8 @@ components:
           format: date-time
           description: |
             Exclusive authorization upper bound evaluated using the server clock. At
-            `now >= expireTime` this assignment must not authorize access, including through an
-            inherited effective view. A direct expired record may remain listable until cleanup.
-            The value must have at most millisecond precision.
-        inheritedFrom:
-          $ref: '#/components/schemas/PermissionResource'
+            `now >= expireTime` this assignment must not authorize access. An expired record may
+            remain listable until cleanup. The value must have at most millisecond precision.
     GrantPermissionRequest:
       type: object
       additionalProperties: false
@@ -603,9 +580,6 @@ components:
       properties:
         resource:
           $ref: '#/components/schemas/PermissionResource'
-        scope:
-          $ref: '#/components/schemas/PermissionScope'
-          default: SELF
         access:
           $ref: '#/components/schemas/PermissionAccess'
         principal:
@@ -624,9 +598,6 @@ components:
       properties:
         resource:
           $ref: '#/components/schemas/PermissionResource'
-        scope:
-          $ref: '#/components/schemas/PermissionScope'
-          default: SELF
         access:
           $ref: '#/components/schemas/PermissionAccess'
         principal:
@@ -643,55 +614,40 @@ components:
         nextPageToken:
           type: string
 
-    ColumnPolicyArgument:
-      type: object
-      additionalProperties: false
-      required: [column]
-      properties:
-        column:
-          type: string
-          minLength: 1
-    ConstantPolicyArgument:
-      type: object
-      additionalProperties: false
-      required: [constant]
-      properties:
-        constant:
-          type: string
-          description: Literal string argument. The empty string is valid.
-    PolicyArgument:
-      oneOf:
-        - $ref: '#/components/schemas/ColumnPolicyArgument'
-        - $ref: '#/components/schemas/ConstantPolicyArgument'
     RowFilter:
       type: object
       additionalProperties: false
-      required: [functionName]
+      required: [predicate]
       properties:
-        functionName:
+        predicate:
           type: string
           minLength: 1
-        functionArguments:
-          type: array
-          default: []
-          items:
-            $ref: '#/components/schemas/PolicyArgument'
+          x-maxUtf8Bytes: 61440
+          contentMediaType: application/json
+          description: |
+            JSON serialization of one Paimon `Predicate`, using the same representation as one
+            entry in `AuthTableQueryResponse.filter`. The UTF-8 representation must not exceed
+            60 KiB. The server must deserialize, validate against the target table schema, and
+            canonicalize it when the policy is created or replaced.
     ColumnMask:
       type: object
       additionalProperties: false
-      required: [functionName, onColumn]
+      required: [onColumn, transform]
       properties:
-        functionName:
+        onColumn:
           type: string
           minLength: 1
-        onColumn:
+        transform:
           type: string
           minLength: 1
-        functionArguments:
-          type: array
-          default: []
-          items:
-            $ref: '#/components/schemas/PolicyArgument'
+          x-maxUtf8Bytes: 61440
+          contentMediaType: application/json
+          description: |
+            JSON serialization of one Paimon `Transform`, using the same representation as the
+            value for `onColumn` in `AuthTableQueryResponse.columnMasking`. The UTF-8
+            representation must not exceed 60 KiB. The server must deserialize it, validate all
+            field references and the output type against the target table schema, and canonicalize
+            it when the policy is created or replaced.
     RowFilterPolicyRequest:
       type: object
       additionalProperties: false
@@ -780,7 +736,7 @@ components:
       description: |
         A policy applies when its principal is effective for the caller. All applicable row filters
         must be combined with logical AND. More than one applicable column mask for the same column
-        must fail closed. An unresolved function, invalid signature, or policy compilation failure
+        must fail closed. An invalid, unsupported, or schema-incompatible predicate or transform
         must also fail closed rather than omit a restriction.
       oneOf:
         - $ref: '#/components/schemas/RowFilterDataPolicy'
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
index 51cbd9f646cb..c2dbadbbdb7b 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ColumnMask.java
@@ -25,50 +25,40 @@
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.annotation.Nullable;
-
 import java.beans.ConstructorProperties;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
+import java.nio.charset.StandardCharsets;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Function, protected column, and positional arguments for a column-mask policy. */
+/** Protected column and serialized Paimon transform for a column-mask policy. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class ColumnMask {
 
-    private static final String FIELD_FUNCTION_NAME = "functionName";
-    private static final String FIELD_ON_COLUMN = "onColumn";
-    private static final String FIELD_FUNCTION_ARGUMENTS = "functionArguments";
+    public static final int MAX_TRANSFORM_BYTES = 60 * 1024;
 
-    @JsonProperty(FIELD_FUNCTION_NAME)
-    private final String functionName;
+    private static final String FIELD_ON_COLUMN = "onColumn";
+    private static final String FIELD_TRANSFORM = "transform";
 
     @JsonProperty(FIELD_ON_COLUMN)
     private final String onColumn;
 
-    @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
-    private final List<PolicyArgument> functionArguments;
+    @JsonProperty(FIELD_TRANSFORM)
+    private final String transform;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_FUNCTION_NAME, FIELD_ON_COLUMN, FIELD_FUNCTION_ARGUMENTS})
+    @ConstructorProperties({FIELD_ON_COLUMN, FIELD_TRANSFORM})
     public ColumnMask(
-            @JsonProperty(FIELD_FUNCTION_NAME) String functionName,
             @JsonProperty(FIELD_ON_COLUMN) String onColumn,
-            @Nullable @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
-                    List<PolicyArgument> functionArguments) {
-        checkArgument(!isBlank(functionName), "functionName cannot be empty.");
+            @JsonProperty(FIELD_TRANSFORM) String transform) {
         checkArgument(!isBlank(onColumn), "onColumn cannot be empty.");
-        this.functionName = functionName;
+        checkArgument(!isBlank(transform), "transform cannot be empty.");
+        checkArgument(
+                transform.getBytes(StandardCharsets.UTF_8).length <= MAX_TRANSFORM_BYTES,
+                "transform must not exceed %s UTF-8 bytes.",
+                MAX_TRANSFORM_BYTES);
         this.onColumn = onColumn;
-        this.functionArguments = immutable(functionArguments);
-    }
-
-    @JsonGetter(FIELD_FUNCTION_NAME)
-    public String getFunctionName() {
-        return functionName;
+        this.transform = transform;
     }
 
     @JsonGetter(FIELD_ON_COLUMN)
@@ -76,19 +66,12 @@ public String getOnColumn() {
         return onColumn;
     }
 
-    @JsonGetter(FIELD_FUNCTION_ARGUMENTS)
-    public List<PolicyArgument> getFunctionArguments() {
-        return functionArguments;
-    }
-
-    private static List<PolicyArgument> immutable(@Nullable List<PolicyArgument> arguments) {
-        List<PolicyArgument> result =
-                arguments == null ? Collections.emptyList() : new ArrayList<>(arguments);
-        checkArgument(!result.contains(null), "functionArguments cannot contain null arguments.");
-        return Collections.unmodifiableList(result);
+    @JsonGetter(FIELD_TRANSFORM)
+    public String getTransform() {
+        return transform;
     }
 
-    private static boolean isBlank(@Nullable String value) {
+    private static boolean isBlank(String value) {
         return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
index 72afd38e035a..08fe3fb0357d 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/DataPolicy.java
@@ -38,8 +38,7 @@
  *
  * <p>A principal has at most one row filter per table and at most one mask per table column. When
  * policies are enforced, applicable row filters are combined with logical AND and multiple
- * effective masks for one column fail closed. Resolution, signature, and compilation failures also
- * fail closed.
+ * effective masks for one column fail closed. Invalid predicates or transforms also fail closed.
  */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
index 7a0059ef9037..3231c2523b2a 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -32,31 +32,22 @@ public class ListPermissionsRequest {
     public static final int MAX_PAGE_SIZE = 1000;
 
     private final PermissionResource resource;
-    @Nullable private final PermissionScope scope;
     @Nullable private final String principal;
     @Nullable private final String access;
-    private final boolean includeInherited;
     @Nullable private final String pageToken;
     @Nullable private final Integer maxResults;
 
     public ListPermissionsRequest(
             ResourceType resourceType,
-            @Nullable PermissionScope scope,
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
             @Nullable String principal,
             @Nullable String access,
-            boolean includeInherited,
             @Nullable String pageToken,
             @Nullable Integer maxResults) {
         this.resource = exactResource(resourceType, database, table, function, view);
-        if (scope == PermissionScope.DESCENDANTS) {
-            checkArgument(
-                    resourceType == ResourceType.CATALOG || resourceType == ResourceType.DATABASE,
-                    "DESCENDANTS scope applies only to CATALOG or DATABASE assignments.");
-        }
         if (!isBlank(principal)) {
             PermissionAssignment.validatePrincipal(principal);
         }
@@ -65,15 +56,8 @@ public ListPermissionsRequest(
                 maxResults == null || maxResults <= MAX_PAGE_SIZE,
                 "maxResults must be at most %s.",
                 MAX_PAGE_SIZE);
-        this.scope = scope;
         this.principal = isBlank(principal) ? null : principal;
-        this.access =
-                isBlank(access)
-                        ? null
-                        : scope == null
-                                ? PermissionAccess.canonicalize(resource, access)
-                                : PermissionAccess.canonicalize(resource, scope, access);
-        this.includeInherited = includeInherited;
+        this.access = isBlank(access) ? null : PermissionAccess.canonicalize(resource, access);
         this.pageToken = isBlank(pageToken) ? null : pageToken;
         this.maxResults = maxResults;
     }
@@ -82,11 +66,6 @@ public ResourceType getResourceType() {
         return resource.getType();
     }
 
-    @Nullable
-    public PermissionScope getScope() {
-        return scope;
-    }
-
     @Nullable
     public String getDatabase() {
         return resource.getDatabase();
@@ -117,10 +96,6 @@ public String getAccess() {
         return access;
     }
 
-    public boolean includeInherited() {
-        return includeInherited;
-    }
-
     @Nullable
     public String getPageToken() {
         return pageToken;
@@ -138,14 +113,12 @@ public PermissionResource resource() {
     public ListPermissionsRequest withPageToken(@Nullable String newPageToken) {
         return new ListPermissionsRequest(
                 resource.getType(),
-                scope,
                 resource.getDatabase(),
                 resource.getTable(),
                 resource.getFunction(),
                 resource.getView(),
                 principal,
                 access,
-                includeInherited,
                 newPageToken,
                 maxResults);
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
index 77b3949d626d..2721f742bcf0 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
@@ -85,38 +85,15 @@ public static String canonicalize(String access) {
                         canonical));
     }
 
-    public static String canonicalize(
-            PermissionResource resource, PermissionScope scope, String access) {
-        String canonical = canonicalize(access);
-        validateScope(resource.getType(), scope);
-        if (EXTENSION_ACCESS.matcher(canonical).matches()) {
-            return canonical;
-        }
-
-        checkArgument(
-                appliesTo(resource.getType(), scope, canonical),
-                "Access '%s' is not valid for %s with %s scope. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
-                canonical,
-                resource.getType(),
-                scope);
-        return canonical;
-    }
-
-    /** Validates an access filter when the query may return either scope. */
     public static String canonicalize(PermissionResource resource, String access) {
         String canonical = canonicalize(access);
         if (EXTENSION_ACCESS.matcher(canonical).matches()) {
             return canonical;
         }
-        boolean applicable = appliesTo(resource.getType(), PermissionScope.SELF, canonical);
-        if (!applicable
-                && (resource.getType() == ResourceType.CATALOG
-                        || resource.getType() == ResourceType.DATABASE)) {
-            applicable = appliesTo(resource.getType(), PermissionScope.DESCENDANTS, canonical);
-        }
+
         checkArgument(
-                applicable,
-                "Access '%s' is not valid for assignments on %s.",
+                BUILT_INS.get(resource.getType()).contains(canonical),
+                "Access '%s' is not valid for %s. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
                 canonical,
                 resource.getType());
         return canonical;
@@ -126,27 +103,6 @@ public static Set<String> builtIns(ResourceType type) {
         return BUILT_INS.get(type);
     }
 
-    private static boolean appliesTo(ResourceType type, PermissionScope scope, String access) {
-        if (scope == PermissionScope.SELF) {
-            return BUILT_INS.get(type).contains(access);
-        }
-        validateScope(type, scope);
-        if (type == ResourceType.CATALOG && BUILT_INS.get(ResourceType.DATABASE).contains(access)) {
-            return true;
-        }
-        return BUILT_INS.get(ResourceType.TABLE).contains(access)
-                || BUILT_INS.get(ResourceType.VIEW).contains(access)
-                || BUILT_INS.get(ResourceType.FUNCTION).contains(access);
-    }
-
-    private static void validateScope(ResourceType type, PermissionScope scope) {
-        checkArgument(
-                scope != PermissionScope.DESCENDANTS
-                        || type == ResourceType.CATALOG
-                        || type == ResourceType.DATABASE,
-                "DESCENDANTS scope is supported only for CATALOG and DATABASE resources.");
-    }
-
     private static Map<ResourceType, Set<String>> builtIns() {
         Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
         accesses.put(
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
index 61049895781c..75bc4ad80126 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
@@ -36,11 +36,11 @@
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
 /**
- * Direct permission assignment or a resource-inherited view of one.
+ * Direct permission assignment on one exact resource.
  *
  * <p>{@code expireTime}, when present, is an exclusive authorization upper bound evaluated against
- * the server clock. At or after that instant, the assignment must not authorize access or produce
- * an effective inherited view, although a direct expired record may remain listable until cleanup.
+ * the server clock. At or after that instant, the assignment must not authorize access, although an
+ * expired record may remain listable until cleanup.
  */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
@@ -50,18 +50,13 @@ public class PermissionAssignment {
     public static final int MAX_PRINCIPAL_LENGTH = 128;
 
     private static final String FIELD_RESOURCE = "resource";
-    private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
     private static final String FIELD_EXPIRE_TIME = "expireTime";
-    private static final String FIELD_INHERITED_FROM = "inheritedFrom";
 
     @JsonProperty(FIELD_RESOURCE)
     private final PermissionResource resource;
 
-    @JsonProperty(FIELD_SCOPE)
-    private final PermissionScope scope;
-
     @JsonProperty(FIELD_ACCESS)
     private final String access;
 
@@ -73,46 +68,15 @@ public class PermissionAssignment {
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private final String expireTime;
 
-    @Nullable
-    @JsonProperty(FIELD_INHERITED_FROM)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final PermissionResource inheritedFrom;
-
     @JsonCreator
-    @ConstructorProperties({
-        FIELD_RESOURCE,
-        FIELD_SCOPE,
-        FIELD_ACCESS,
-        FIELD_PRINCIPAL,
-        FIELD_EXPIRE_TIME,
-        FIELD_INHERITED_FROM
-    })
+    @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL, FIELD_EXPIRE_TIME})
     public PermissionAssignment(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
-            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
-            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime,
-            @Nullable @JsonProperty(FIELD_INHERITED_FROM) PermissionResource inheritedFrom) {
-        this(
-                resource,
-                scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
-                access,
-                principal,
-                expireTime,
-                inheritedFrom);
-    }
-
-    public PermissionAssignment(
-            PermissionResource resource,
-            PermissionScope scope,
-            String access,
-            String principal,
-            @Nullable String expireTime,
-            @Nullable PermissionResource inheritedFrom) {
+            @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
         this.resource = checkNotNull(resource, "resource cannot be null");
-        this.scope = checkNotNull(scope, "scope cannot be null");
-        this.access = PermissionAccess.canonicalize(resource, scope, access);
+        this.access = PermissionAccess.canonicalize(resource, access);
         this.principal = validatePrincipal(principal);
         if (expireTime != null) {
             try {
@@ -125,11 +89,7 @@ public PermissionAssignment(
                         "expireTime must be an ISO-8601 UTC instant.", e);
             }
         }
-        checkArgument(
-                inheritedFrom == null || scope == PermissionScope.SELF,
-                "An inherited assignment view must use SELF scope.");
         this.expireTime = expireTime;
-        this.inheritedFrom = inheritedFrom;
     }
 
     @JsonGetter(FIELD_RESOURCE)
@@ -137,11 +97,6 @@ public PermissionResource getResource() {
         return resource;
     }
 
-    @JsonGetter(FIELD_SCOPE)
-    public PermissionScope getScope() {
-        return scope;
-    }
-
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
         return access;
@@ -168,10 +123,4 @@ static String validatePrincipal(String principal) {
     public String getExpireTime() {
         return expireTime;
     }
-
-    @Nullable
-    @JsonGetter(FIELD_INHERITED_FROM)
-    public PermissionResource getInheritedFrom() {
-        return inheritedFrom;
-    }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
index 214ebef4b51d..eba705a09199 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
@@ -29,35 +29,24 @@
 public class PermissionIdentity {
 
     private final PermissionResource resource;
-    private final PermissionScope scope;
     private final String access;
     private final String principal;
 
-    public PermissionIdentity(
-            PermissionResource resource, PermissionScope scope, String access, String principal) {
+    public PermissionIdentity(PermissionResource resource, String access, String principal) {
         this.resource = checkNotNull(resource, "resource cannot be null");
-        this.scope = checkNotNull(scope, "scope cannot be null");
-        this.access = PermissionAccess.canonicalize(resource, scope, access);
+        this.access = PermissionAccess.canonicalize(resource, access);
         this.principal = PermissionAssignment.validatePrincipal(principal);
     }
 
     public static PermissionIdentity fromAssignment(PermissionAssignment assignment) {
-        PermissionResource inheritedFrom = assignment.getInheritedFrom();
         return new PermissionIdentity(
-                inheritedFrom == null ? assignment.getResource() : inheritedFrom,
-                inheritedFrom == null ? assignment.getScope() : PermissionScope.DESCENDANTS,
-                assignment.getAccess(),
-                assignment.getPrincipal());
+                assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
     }
 
     public PermissionResource getResource() {
         return resource;
     }
 
-    public PermissionScope getScope() {
-        return scope;
-    }
-
     public String getAccess() {
         return access;
     }
@@ -76,13 +65,12 @@ public boolean equals(Object o) {
         }
         PermissionIdentity that = (PermissionIdentity) o;
         return resource.equals(that.resource)
-                && scope == that.scope
                 && access.equals(that.access)
                 && principal.equals(that.principal);
     }
 
     @Override
     public int hashCode() {
-        return Objects.hash(resource, scope, access, principal);
+        return Objects.hash(resource, access, principal);
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
deleted file mode 100644
index 71931ce3ef9d..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionScope.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import javax.annotation.Nullable;
-
-import java.util.Locale;
-
-/** Scope of a permission assignment. */
-@Experimental
-public enum PermissionScope {
-    SELF,
-    DESCENDANTS;
-
-    @Nullable
-    public static PermissionScope fromString(@Nullable String value) {
-        return value == null ? null : valueOf(value.toUpperCase(Locale.ROOT));
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
deleted file mode 100644
index 872dfb894852..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyArgument.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
-import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
-
-import javax.annotation.Nullable;
-
-import java.beans.ConstructorProperties;
-
-import static org.apache.paimon.utils.Preconditions.checkArgument;
-
-/** Positional column or constant argument passed to a data policy function. */
-@Experimental
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class PolicyArgument {
-
-    private static final String FIELD_COLUMN = "column";
-    private static final String FIELD_CONSTANT = "constant";
-
-    @Nullable
-    @JsonProperty(FIELD_COLUMN)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String column;
-
-    @Nullable
-    @JsonProperty(FIELD_CONSTANT)
-    @JsonInclude(JsonInclude.Include.NON_NULL)
-    private final String constant;
-
-    @JsonCreator
-    @ConstructorProperties({FIELD_COLUMN, FIELD_CONSTANT})
-    public PolicyArgument(
-            @Nullable @JsonProperty(FIELD_COLUMN) String column,
-            @Nullable @JsonProperty(FIELD_CONSTANT) String constant) {
-        boolean hasColumn = !isBlank(column);
-        boolean hasConstant = constant != null;
-        checkArgument(
-                hasColumn != hasConstant,
-                "A policy argument must contain exactly one of column and constant.");
-        this.column = hasColumn ? column : null;
-        this.constant = hasConstant ? constant : null;
-    }
-
-    public static PolicyArgument column(String column) {
-        return new PolicyArgument(column, null);
-    }
-
-    public static PolicyArgument constant(String constant) {
-        return new PolicyArgument(null, constant);
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_COLUMN)
-    public String getColumn() {
-        return column;
-    }
-
-    @Nullable
-    @JsonGetter(FIELD_CONSTANT)
-    public String getConstant() {
-        return constant;
-    }
-
-    private static boolean isBlank(@Nullable String value) {
-        return value == null || value.trim().isEmpty();
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
index 79a1009449e9..4af32042b593 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/RowFilter.java
@@ -25,58 +25,40 @@
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.annotation.Nullable;
-
 import java.beans.ConstructorProperties;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
+import java.nio.charset.StandardCharsets;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 
-/** Function and positional arguments for a row-filter policy. */
+/** Serialized Paimon predicate for a row-filter policy. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class RowFilter {
 
-    private static final String FIELD_FUNCTION_NAME = "functionName";
-    private static final String FIELD_FUNCTION_ARGUMENTS = "functionArguments";
+    public static final int MAX_PREDICATE_BYTES = 60 * 1024;
 
-    @JsonProperty(FIELD_FUNCTION_NAME)
-    private final String functionName;
+    private static final String FIELD_PREDICATE = "predicate";
 
-    @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
-    private final List<PolicyArgument> functionArguments;
+    @JsonProperty(FIELD_PREDICATE)
+    private final String predicate;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_FUNCTION_NAME, FIELD_FUNCTION_ARGUMENTS})
-    public RowFilter(
-            @JsonProperty(FIELD_FUNCTION_NAME) String functionName,
-            @Nullable @JsonProperty(FIELD_FUNCTION_ARGUMENTS)
-                    List<PolicyArgument> functionArguments) {
-        checkArgument(!isBlank(functionName), "functionName cannot be empty.");
-        this.functionName = functionName;
-        this.functionArguments = immutable(functionArguments);
-    }
-
-    @JsonGetter(FIELD_FUNCTION_NAME)
-    public String getFunctionName() {
-        return functionName;
-    }
-
-    @JsonGetter(FIELD_FUNCTION_ARGUMENTS)
-    public List<PolicyArgument> getFunctionArguments() {
-        return functionArguments;
+    @ConstructorProperties({FIELD_PREDICATE})
+    public RowFilter(@JsonProperty(FIELD_PREDICATE) String predicate) {
+        checkArgument(!isBlank(predicate), "predicate cannot be empty.");
+        checkArgument(
+                predicate.getBytes(StandardCharsets.UTF_8).length <= MAX_PREDICATE_BYTES,
+                "predicate must not exceed %s UTF-8 bytes.",
+                MAX_PREDICATE_BYTES);
+        this.predicate = predicate;
     }
 
-    private static List<PolicyArgument> immutable(@Nullable List<PolicyArgument> arguments) {
-        List<PolicyArgument> result =
-                arguments == null ? Collections.emptyList() : new ArrayList<>(arguments);
-        checkArgument(!result.contains(null), "functionArguments cannot contain null arguments.");
-        return Collections.unmodifiableList(result);
+    @JsonGetter(FIELD_PREDICATE)
+    public String getPredicate() {
+        return predicate;
     }
 
-    private static boolean isBlank(@Nullable String value) {
+    private static boolean isBlank(String value) {
         return value == null || value.trim().isEmpty();
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index cc6f838204ff..e2363444f036 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -851,18 +851,12 @@ public AuthTableQueryResponse authTableQuery(
     public ListPermissionsResponse listPermissions(ListPermissionsRequest request) {
         Map<String, String> queryParams = Maps.newHashMap();
         putQueryParameter(queryParams, "resourceType", request.getResourceType().name());
-        if (request.getScope() != null) {
-            putQueryParameter(queryParams, "scope", request.getScope().name());
-        }
         putQueryParameter(queryParams, "database", request.getDatabase());
         putQueryParameter(queryParams, "table", request.getTable());
         putQueryParameter(queryParams, "function", request.getFunction());
         putQueryParameter(queryParams, "view", request.getView());
         putQueryParameter(queryParams, "principal", request.getPrincipal());
         putQueryParameter(queryParams, "access", request.getAccess());
-        if (request.includeInherited()) {
-            queryParams.put("includeInherited", "true");
-        }
         if (request.getMaxResults() != null) {
             queryParams.put(MAX_RESULTS, request.getMaxResults().toString());
         }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
index 8b9e389e541b..0488777d7800 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
@@ -21,7 +21,6 @@
 import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
@@ -34,15 +33,12 @@
 
 import java.beans.ConstructorProperties;
 
-import static org.apache.paimon.utils.Preconditions.checkArgument;
-
 /** Request for granting or replacing a permission assignment. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class GrantPermissionRequest implements RESTRequest {
 
     private static final String FIELD_RESOURCE = "resource";
-    private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
     private static final String FIELD_EXPIRE_TIME = "expireTime";
@@ -50,34 +46,17 @@ public class GrantPermissionRequest implements RESTRequest {
     private final PermissionAssignment assignment;
 
     public GrantPermissionRequest(PermissionAssignment assignment) {
-        checkArgument(
-                assignment.getInheritedFrom() == null,
-                "An inherited permission view cannot be granted directly.");
         this.assignment = assignment;
     }
 
     @JsonCreator
-    @ConstructorProperties({
-        FIELD_RESOURCE,
-        FIELD_SCOPE,
-        FIELD_ACCESS,
-        FIELD_PRINCIPAL,
-        FIELD_EXPIRE_TIME
-    })
+    @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL, FIELD_EXPIRE_TIME})
     public GrantPermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
-            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
-        this.assignment =
-                new PermissionAssignment(
-                        resource,
-                        scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
-                        access,
-                        principal,
-                        expireTime,
-                        null);
+        this.assignment = new PermissionAssignment(resource, access, principal, expireTime);
     }
 
     public PermissionAssignment assignment() {
@@ -89,11 +68,6 @@ public PermissionResource getResource() {
         return assignment.getResource();
     }
 
-    @JsonGetter(FIELD_SCOPE)
-    public PermissionScope getScope() {
-        return assignment.getScope();
-    }
-
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
         return assignment.getAccess();
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
index 7100a7871d8a..656cade18c6c 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
@@ -21,7 +21,6 @@
 import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.rest.RESTRequest;
 
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
@@ -29,8 +28,6 @@
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.annotation.Nullable;
-
 import java.beans.ConstructorProperties;
 
 /** Idempotent request for revoking a permission assignment by identity. */
@@ -39,7 +36,6 @@
 public class RevokePermissionRequest implements RESTRequest {
 
     private static final String FIELD_RESOURCE = "resource";
-    private static final String FIELD_SCOPE = "scope";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
 
@@ -50,18 +46,12 @@ public RevokePermissionRequest(PermissionIdentity identity) {
     }
 
     @JsonCreator
-    @ConstructorProperties({FIELD_RESOURCE, FIELD_SCOPE, FIELD_ACCESS, FIELD_PRINCIPAL})
+    @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL})
     public RevokePermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
-            @Nullable @JsonProperty(FIELD_SCOPE) String scope,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal) {
-        this.identity =
-                new PermissionIdentity(
-                        resource,
-                        scope == null ? PermissionScope.SELF : PermissionScope.fromString(scope),
-                        access,
-                        principal);
+        this.identity = new PermissionIdentity(resource, access, principal);
     }
 
     @JsonGetter(FIELD_RESOURCE)
@@ -69,11 +59,6 @@ public PermissionResource getResource() {
         return identity.getResource();
     }
 
-    @JsonGetter(FIELD_SCOPE)
-    public PermissionScope getScope() {
-        return identity.getScope();
-    }
-
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
         return identity.getAccess();
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index 2b390b52e2a5..d5aaf4f9b56b 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -26,7 +26,6 @@
 
 import org.junit.jupiter.api.Test;
 
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 
@@ -36,9 +35,17 @@
 /** JSON and validation tests for permission and data-policy management contracts. */
 public class PermissionManagementJsonTest {
 
+    private static final String PREDICATE_JSON =
+            "{\"kind\":\"LEAF\",\"transform\":{\"name\":\"FIELD_REF\","
+                    + "\"fieldRef\":{\"index\":0,\"name\":\"region\",\"type\":\"STRING\"}},"
+                    + "\"function\":\"EQUAL\",\"literals\":[\"APAC\"]}";
+    private static final String TRANSFORM_JSON =
+            "{\"name\":\"CONCAT\",\"inputs\":[{\"index\":0,\"name\":\"region\","
+                    + "\"type\":\"STRING\"},\"****\"]}";
+
     private static final String ASSIGNMENT_JSON =
             "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
-                    + "\"table\":\"orders\"},\"scope\":\"SELF\",\"access\":\"select\","
+                    + "\"table\":\"orders\"},\"access\":\"select\","
                     + "\"principal\":\"analyst\","
                     + "\"expireTime\":\"2027-01-01T00:00:00Z\"}";
 
@@ -51,9 +58,8 @@ void testAssignmentDeserializesWithShadedAndExternalJackson() throws Exception {
     }
 
     @Test
-    void testAssignmentDeserializesLowerCaseDiscriminators() throws Exception {
-        String lowerCaseJson =
-                ASSIGNMENT_JSON.replace("\"TABLE\"", "\"table\"").replace("\"SELF\"", "\"self\"");
+    void testAssignmentDeserializesLowerCaseResourceType() throws Exception {
+        String lowerCaseJson = ASSIGNMENT_JSON.replace("\"TABLE\"", "\"table\"");
 
         assertAssignment(RESTApi.fromJson(lowerCaseJson, PermissionAssignment.class));
         assertAssignment(
@@ -68,12 +74,10 @@ void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
         Map<?, ?> grant =
                 RESTApi.fromJson(RESTApi.toJson(new GrantPermissionRequest(assignment)), Map.class);
 
-        assertThat(grant.get("scope")).isEqualTo("SELF");
         assertThat(grant.get("access")).isEqualTo("SELECT");
         assertThat(grant.containsKey("columns")).isFalse();
         assertThat(grant.containsKey("policy")).isFalse();
         assertThat(grant.containsKey("grantOption")).isFalse();
-        assertThat(grant.containsKey("inheritedFrom")).isFalse();
 
         Map<?, ?> revoke =
                 RESTApi.fromJson(
@@ -81,7 +85,6 @@ void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
                                 new RevokePermissionRequest(
                                         PermissionIdentity.fromAssignment(assignment))),
                         Map.class);
-        assertThat(revoke.get("scope")).isEqualTo("SELF");
         assertThat(revoke.get("access")).isEqualTo("SELECT");
         assertThat(revoke.containsKey("columns")).isFalse();
         assertThat(revoke.containsKey("policy")).isFalse();
@@ -91,50 +94,47 @@ void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
     }
 
     @Test
-    void testOptionalRequestFieldsUseDocumentedDefaults() throws Exception {
+    void testPermissionRequestWithoutExpiry() throws Exception {
         String permissionJson =
                 "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
                         + "\"table\":\"orders\"},\"access\":\"select\","
                         + "\"principal\":\"analyst\"}";
 
-        assertThat(RESTApi.fromJson(permissionJson, GrantPermissionRequest.class).getScope())
-                .isEqualTo(PermissionScope.SELF);
-        assertThat(RESTApi.fromJson(permissionJson, RevokePermissionRequest.class).getScope())
-                .isEqualTo(PermissionScope.SELF);
+        assertThat(RESTApi.fromJson(permissionJson, GrantPermissionRequest.class).getExpireTime())
+                .isNull();
+        assertThat(RESTApi.fromJson(permissionJson, RevokePermissionRequest.class).getAccess())
+                .isEqualTo("SELECT");
 
         String policyJson =
-                "{\"rowFilter\":{\"functionName\":\"security.filter\"},"
-                        + "\"principal\":\"analyst\"}";
+                RESTApi.toJson(
+                        new PolicyRequest(
+                                DataPolicy.rowFilter(
+                                        tableResource(),
+                                        new RowFilter(PREDICATE_JSON),
+                                        "analyst")));
         DataPolicy policy =
                 RESTApi.fromJson(policyJson, PolicyRequest.class).policy(tableResource());
-        assertThat(policy.getRowFilter().getFunctionArguments()).isEmpty();
+        assertThat(policy.getRowFilter().getPredicate()).isEqualTo(PREDICATE_JSON);
     }
 
     @Test
-    void testPoliciesArePrincipalScopedFunctionBasedResources() throws Exception {
+    void testPoliciesArePrincipalScopedPaimonDefinitions() throws Exception {
         String json =
-                "{\"resource\":{\"type\":\"TABLE\",\"database\":\"sales\","
-                        + "\"table\":\"orders\"},"
-                        + "\"columnMask\":{\"functionName\":\"security.mask_email\","
-                        + "\"onColumn\":\"email\",\"functionArguments\":[{\"column\":\"region\"},"
-                        + "{\"constant\":\"CN\"}]},\"principal\":\"analysts\"}";
+                RESTApi.toJson(
+                        DataPolicy.columnMask(
+                                tableResource(),
+                                new ColumnMask("email", TRANSFORM_JSON),
+                                "analysts"));
 
         DataPolicy policy = RESTApi.fromJson(json, DataPolicy.class);
         DataPolicy externalPolicy =
                 new com.fasterxml.jackson.databind.ObjectMapper().readValue(json, DataPolicy.class);
         assertThat(policy.type()).isEqualTo(PolicyType.COLUMN_MASKING);
         assertThat(policy.getRowFilter()).isNull();
-        assertThat(policy.getColumnMask().getFunctionName()).isEqualTo("security.mask_email");
         assertThat(policy.getColumnMask().getOnColumn()).isEqualTo("email");
-        assertThat(policy.getColumnMask().getFunctionArguments().get(0).getColumn())
-                .isEqualTo("region");
-        assertThat(policy.getColumnMask().getFunctionArguments().get(1).getConstant())
-                .isEqualTo("CN");
+        assertThat(policy.getColumnMask().getTransform()).isEqualTo(TRANSFORM_JSON);
         assertThat(policy.getPrincipal()).isEqualTo("analysts");
-        assertThat(externalPolicy.getColumnMask().getFunctionName())
-                .isEqualTo("security.mask_email");
-        assertThat(externalPolicy.getColumnMask().getFunctionArguments().get(1).getConstant())
-                .isEqualTo("CN");
+        assertThat(externalPolicy.getColumnMask().getTransform()).isEqualTo(TRANSFORM_JSON);
 
         PolicyRequest policyRequest = new PolicyRequest(policy);
         assertThat(policyRequest.isRetrySafe()).isFalse();
@@ -142,7 +142,6 @@ void testPoliciesArePrincipalScopedFunctionBasedResources() throws Exception {
         assertThat(request.containsKey("resource")).isFalse();
         assertThat(request.get("principal")).isEqualTo("analysts");
         assertThat(request.containsKey("type")).isFalse();
-        assertThat(request.containsKey("scope")).isFalse();
         assertThat(request.get("columnMask")).isInstanceOf(Map.class);
         Map<?, ?> external =
                 new com.fasterxml.jackson.databind.ObjectMapper()
@@ -151,6 +150,8 @@ void testPoliciesArePrincipalScopedFunctionBasedResources() throws Exception {
                                         .writeValueAsString(policy),
                                 Map.class);
         assertThat(external.containsKey("type")).isFalse();
+        assertThat(((Map<?, ?>) external.get("columnMask")).keySet())
+                .containsExactlyInAnyOrder("onColumn", "transform");
     }
 
     @Test
@@ -158,43 +159,18 @@ void testAccessAndPolicyValidation() {
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
-                                        tableResource(),
-                                        PermissionScope.DESCENDANTS,
-                                        "SELECT",
-                                        "analyst",
-                                        null,
-                                        null))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("DESCENDANTS");
-        assertThatThrownBy(
-                        () ->
-                                new PermissionAssignment(
-                                        catalogResource(),
-                                        PermissionScope.SELF,
-                                        "SELECT",
-                                        "analyst",
-                                        null,
-                                        null))
+                                        catalogResource(), "SELECT", "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("not valid");
         assertThatThrownBy(
-                        () ->
-                                new PermissionAssignment(
-                                        catalogResource(),
-                                        PermissionScope.SELF,
-                                        "ALL",
-                                        "analyst",
-                                        null,
-                                        null))
+                        () -> new PermissionAssignment(catalogResource(), "ALL", "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("Unknown access");
         assertThat(
                         new PermissionAssignment(
                                         tableResource(),
-                                        PermissionScope.SELF,
                                         "vendor.example/read_sensitive",
                                         "analyst",
-                                        null,
                                         null)
                                 .getAccess())
                 .isEqualTo("VENDOR.EXAMPLE/READ_SENSITIVE");
@@ -202,56 +178,38 @@ void testAccessAndPolicyValidation() {
                         () ->
                                 new PermissionAssignment(
                                         tableResource(),
-                                        PermissionScope.DESCENDANTS,
-                                        "vendor.example/read_sensitive",
-                                        "analyst",
-                                        null,
-                                        null))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("DESCENDANTS");
-        assertThatThrownBy(
-                        () ->
-                                new PermissionAssignment(
-                                        tableResource(),
-                                        PermissionScope.SELF,
                                         repeat('A', PermissionAccess.MAX_LENGTH + 1),
                                         "analyst",
-                                        null,
                                         null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("32");
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
-                                        tableResource(),
-                                        PermissionScope.SELF,
-                                        "a/" + repeat('ß', 16),
-                                        "analyst",
-                                        null,
-                                        null))
+                                        tableResource(), "a/" + repeat('ß', 16), "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("after canonicalization");
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
                                         tableResource(),
-                                        PermissionScope.SELF,
                                         "SELECT",
                                         repeat('p', PermissionAssignment.MAX_PRINCIPAL_LENGTH + 1),
-                                        null,
                                         null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("128");
-        assertThatThrownBy(() -> new PolicyArgument("region", "CN"))
+        assertThatThrownBy(() -> new RowFilter(" "))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("exactly one");
-        assertThat(PolicyArgument.constant("").getConstant()).isEmpty();
+                .hasMessageContaining("predicate");
+        assertThatThrownBy(() -> new ColumnMask("email", " "))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("transform");
         assertThatThrownBy(
                         () ->
                                 new DataPolicy(
                                         tableResource(),
-                                        new RowFilter("security.filter", null),
-                                        new ColumnMask("security.mask", "region", null),
+                                        new RowFilter(PREDICATE_JSON),
+                                        new ColumnMask("region", TRANSFORM_JSON),
                                         "analyst"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("exactly one");
@@ -260,7 +218,7 @@ void testAccessAndPolicyValidation() {
                                 new DataPolicy(
                                         catalogResource(),
                                         null,
-                                        new ColumnMask("security.mask", "email", null),
+                                        new ColumnMask("email", TRANSFORM_JSON),
                                         "analyst"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("TABLE");
@@ -268,11 +226,9 @@ void testAccessAndPolicyValidation() {
                         () ->
                                 new PermissionAssignment(
                                         tableResource(),
-                                        PermissionScope.SELF,
                                         "SELECT",
                                         "analyst",
-                                        "2027-01-01T00:00:00.000001Z",
-                                        null))
+                                        "2027-01-01T00:00:00.000001Z"))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("millisecond");
     }
@@ -283,14 +239,12 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                         () ->
                                 new ListPermissionsRequest(
                                         ResourceType.TABLE,
-                                        null,
                                         "sales",
                                         null,
                                         null,
                                         null,
                                         null,
                                         null,
-                                        false,
                                         null,
                                         25))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -306,13 +260,11 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                                         null,
                                         null,
                                         null,
-                                        false,
-                                        null,
                                         1001))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("at most 1000");
 
-        ListPermissionsRequest descendantsAccess =
+        ListPermissionsRequest catalogAccess =
                 new ListPermissionsRequest(
                         ResourceType.CATALOG,
                         null,
@@ -320,42 +272,37 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                         null,
                         null,
                         null,
-                        null,
-                        "select",
-                        false,
+                        "use_catalog",
                         null,
                         25);
-        assertThat(descendantsAccess.getAccess()).isEqualTo("SELECT");
+        assertThat(catalogAccess.getAccess()).isEqualTo("USE_CATALOG");
         assertThatThrownBy(
                         () ->
                                 new ListPermissionsRequest(
                                         ResourceType.DATABASE,
-                                        null,
                                         "sales",
                                         null,
                                         null,
                                         null,
                                         null,
                                         "USE_CATALOG",
-                                        false,
                                         null,
                                         25))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("not valid for assignments on DATABASE");
+                .hasMessageContaining("not valid for DATABASE");
     }
 
     @Test
-    void testPolicyDefensivelyCopiesFunctionArguments() {
-        ArrayList<PolicyArgument> arguments =
-                new ArrayList<>(Arrays.asList(PolicyArgument.column("region")));
-        DataPolicy policy =
-                DataPolicy.rowFilter(
-                        tableResource(), new RowFilter("security.filter", arguments), "analyst");
-
-        arguments.add(PolicyArgument.constant("CN"));
-
-        assertThat(policy.getPrincipal()).isEqualTo("analyst");
-        assertThat(policy.getRowFilter().getFunctionArguments()).hasSize(1);
+    void testPolicyDefinitionsBoundUtf8PayloadSize() {
+        assertThatThrownBy(() -> new RowFilter(repeat('p', RowFilter.MAX_PREDICATE_BYTES + 1)))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("UTF-8 bytes");
+        assertThatThrownBy(
+                        () ->
+                                new ColumnMask(
+                                        "email", repeat('t', ColumnMask.MAX_TRANSFORM_BYTES + 1)))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("UTF-8 bytes");
     }
 
     @Test
@@ -381,19 +328,6 @@ void testPolicyIdentityAndDropRequestRoundTrip() throws Exception {
                 .hasMessageContaining("column is required");
     }
 
-    @Test
-    void testInheritedAssignmentIdentityUsesAttachmentSource() {
-        PermissionResource database =
-                new PermissionResource(ResourceType.DATABASE, "sales", null, null, null);
-        PermissionAssignment inherited =
-                new PermissionAssignment(
-                        tableResource(), PermissionScope.SELF, "SELECT", "analyst", null, database);
-
-        PermissionIdentity identity = PermissionIdentity.fromAssignment(inherited);
-        assertThat(identity.getResource()).isEqualTo(database);
-        assertThat(identity.getScope()).isEqualTo(PermissionScope.DESCENDANTS);
-    }
-
     @Test
     void testResourceCanonicalizesBlankIrrelevantLocators() throws Exception {
         PermissionResource catalog =
@@ -421,10 +355,8 @@ private static void assertAssignment(PermissionAssignment assignment) {
         assertThat(assignment.getResource().getType()).isEqualTo(ResourceType.TABLE);
         assertThat(assignment.getResource().getDatabase()).isEqualTo("sales");
         assertThat(assignment.getResource().getTable()).isEqualTo("orders");
-        assertThat(assignment.getScope()).isEqualTo(PermissionScope.SELF);
         assertThat(assignment.getAccess()).isEqualTo("SELECT");
         assertThat(assignment.getPrincipal()).isEqualTo("analyst");
         assertThat(assignment.getExpireTime()).isEqualTo("2027-01-01T00:00:00Z");
-        assertThat(assignment.getInheritedFrom()).isNull();
     }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
index 0baf850fa712..ed8196cc0ef9 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
@@ -24,7 +24,6 @@
 import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.rest.exceptions.ForbiddenException;
@@ -80,7 +79,7 @@ void setUp() throws Exception {
                                 200,
                                 "{\"permissions\":[{\"resource\":{\"type\":\"TABLE\","
                                         + "\"database\":\"sales\",\"table\":\"orders\"},"
-                                        + "\"scope\":\"SELF\",\"access\":\"SELECT\","
+                                        + "\"access\":\"SELECT\","
                                         + "\"principal\":\"analyst\"}],"
                                         + "\"nextPageToken\":\"next\"}");
                     } else if ((BASE_PATH + "/grant").equals(path)) {
@@ -122,14 +121,12 @@ void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
                 management.listPermissions(
                         new ListPermissionsRequest(
                                 ResourceType.TABLE,
-                                PermissionScope.SELF,
                                 "sales",
                                 "orders",
                                 null,
                                 null,
                                 "analyst",
                                 null,
-                                true,
                                 "start",
                                 25));
 
@@ -139,10 +136,8 @@ void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
         assertThat(queryParameters(listQuery.get()))
                 .containsEntry("principal", "analyst")
                 .containsEntry("resourceType", "TABLE")
-                .containsEntry("scope", "SELF")
                 .containsEntry("database", "sales")
                 .containsEntry("table", "orders")
-                .containsEntry("includeInherited", "true")
                 .containsEntry("maxResults", "25")
                 .containsEntry("pageToken", "start");
         assertThat(authorization.get()).isEqualTo("Bearer secret");
@@ -160,7 +155,6 @@ void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         assertThat(grantResource.get("database")).isEqualTo("sales");
         assertThat(grantResource.get("table")).isEqualTo("orders");
         assertThat(grant.get("principal")).isEqualTo("analyst");
-        assertThat(grant.get("scope")).isEqualTo("SELF");
         assertThat(grant.containsKey("columns")).isFalse();
         assertThat(grant.containsKey("policy")).isFalse();
         assertThat(grant.containsKey("grantOption")).isFalse();
@@ -172,7 +166,6 @@ void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         assertThat(revokeResource.get("database")).isEqualTo("sales");
         assertThat(revokeResource.get("table")).isEqualTo("orders");
         assertThat(revoke.get("principal")).isEqualTo("analyst");
-        assertThat(revoke.get("scope")).isEqualTo("SELF");
         assertThat(revoke.containsKey("expireTime")).isFalse();
         assertThat(revoke.containsKey("grantOption")).isFalse();
     }
@@ -197,10 +190,8 @@ void testRepeatedRevokeIsIdempotent() {
     private static PermissionAssignment assignment(String principal) {
         return new PermissionAssignment(
                 new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null),
-                PermissionScope.SELF,
                 "SELECT",
                 principal,
-                null,
                 null);
     }
 
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
index 6ae735248338..8ffcd87d515e 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
@@ -23,7 +23,6 @@
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyArgument;
 import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyManagement;
 import org.apache.paimon.management.PolicyType;
@@ -42,7 +41,6 @@
 import java.io.OutputStream;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
-import java.util.Collections;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.atomic.AtomicReference;
 
@@ -146,7 +144,6 @@ void testCreateUpdateAndDropUseCrudMethods() {
         assertThat(createBody.get()).contains("\"principal\":\"analyst\"");
         assertThat(createBody.get()).doesNotContain("\"resource\"");
         assertThat(updateBody.get()).contains("\"columnMask\"");
-        assertThat(updateBody.get()).doesNotContain("\"scope\"");
         assertThat(deleteBody.get())
                 .contains("\"type\":\"COLUMN_MASKING\"")
                 .contains("\"column\":\"email\"");
@@ -175,9 +172,9 @@ private static DataPolicy policy() {
         return DataPolicy.columnMask(
                 tableResource(),
                 new ColumnMask(
-                        "security.mask_email",
                         "email",
-                        Collections.singletonList(PolicyArgument.column("region"))),
+                        "{\"name\":\"FIELD_REF\",\"fieldRef\":{\"index\":0,"
+                                + "\"name\":\"region\",\"type\":\"STRING\"}}"),
                 "analyst");
     }
 
diff --git a/paimon-core/src/main/java/org/apache/paimon/catalog/TableQueryAuthResult.java b/paimon-core/src/main/java/org/apache/paimon/catalog/TableQueryAuthResult.java
index 0524eea1b07c..6d381078c739 100644
--- a/paimon-core/src/main/java/org/apache/paimon/catalog/TableQueryAuthResult.java
+++ b/paimon-core/src/main/java/org/apache/paimon/catalog/TableQueryAuthResult.java
@@ -48,6 +48,8 @@
 import java.util.TreeMap;
 import java.util.stream.Collectors;
 
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
 /** Auth result for table query, including row level filter and optional column masking rules. */
 public class TableQueryAuthResult implements Serializable {
 
@@ -89,13 +91,10 @@ public Predicate extractPredicate() {
         if (filter != null && !filter.isEmpty()) {
             List<Predicate> predicates = new ArrayList<>();
             for (String json : filter) {
-                if (StringUtils.isEmpty(json)) {
-                    continue;
-                }
+                checkArgument(!StringUtils.isEmpty(json), "Row filter cannot be empty.");
                 Predicate predicate = JsonSerdeUtil.fromJson(json, Predicate.class);
-                if (predicate != null) {
-                    predicates.add(predicate);
-                }
+                checkArgument(predicate != null, "Row filter cannot be JSON null.");
+                predicates.add(predicate);
             }
             if (predicates.size() == 1) {
                 rowFilter = predicates.get(0);
@@ -122,13 +121,10 @@ public Map<String, Transform> extractColumnMasking() {
             for (Map.Entry<String, String> e : columnMasking.entrySet()) {
                 String column = e.getKey();
                 String json = e.getValue();
-                if (StringUtils.isEmpty(column) || StringUtils.isEmpty(json)) {
-                    continue;
-                }
+                checkArgument(!StringUtils.isEmpty(column), "Column mask target cannot be empty.");
+                checkArgument(!StringUtils.isEmpty(json), "Column mask transform cannot be empty.");
                 Transform transform = JsonSerdeUtil.fromJson(json, Transform.class);
-                if (transform == null) {
-                    continue;
-                }
+                checkArgument(transform != null, "Column mask transform cannot be JSON null.");
                 result.put(column, transform);
             }
         }
@@ -184,14 +180,15 @@ private static Map<Integer, Transform> transformRemapping(
         for (Map.Entry<String, Transform> e : masking.entrySet()) {
             String targetColumn = e.getKey();
             Transform transform = e.getValue();
-            if (targetColumn == null || transform == null) {
-                continue;
-            }
+            checkArgument(targetColumn != null, "Column mask target cannot be null.");
+            checkArgument(transform != null, "Column mask transform cannot be null.");
 
             int targetIndex = outputRowType.getFieldIndex(targetColumn);
-            if (targetIndex < 0) {
-                continue;
-            }
+            checkArgument(
+                    targetIndex >= 0,
+                    "Column mask target '%s' is not present in output row type %s.",
+                    targetColumn,
+                    outputRowType);
 
             List<Object> newInputs = new ArrayList<>();
             for (Object input : transform.inputs()) {
@@ -234,7 +231,7 @@ public Predicate visit(LeafPredicate predicate) {
                     String fieldName = ref.name();
                     int newIndex = outputRowType.getFieldIndex(fieldName);
                     if (newIndex < 0) {
-                        throw new RuntimeException(
+                        throw new IllegalArgumentException(
                                 String.format(
                                         "Unable to read data without column %s when row filter enabled.",
                                         fieldName));
@@ -250,15 +247,20 @@ public Predicate visit(LeafPredicate predicate) {
 
         @Override
         public Predicate visit(CompoundPredicate predicate) {
+            checkArgument(
+                    predicate.function() != null, "Compound row filter function cannot be null.");
+            checkArgument(
+                    predicate.children() != null, "Compound row filter children cannot be null.");
             List<Predicate> remappedChildren = new ArrayList<>();
             for (Predicate child : predicate.children()) {
+                checkArgument(child != null, "Compound row filter child cannot be null.");
                 Predicate remapped = child.visit(this);
                 if (remapped != null) {
                     remappedChildren.add(remapped);
                 }
             }
             if (remappedChildren.isEmpty()) {
-                return null;
+                throw new IllegalArgumentException("Compound row filter must contain a predicate.");
             }
             if (remappedChildren.size() == 1) {
                 return remappedChildren.get(0);
diff --git a/paimon-core/src/main/java/org/apache/paimon/table/source/AbstractDataTableRead.java b/paimon-core/src/main/java/org/apache/paimon/table/source/AbstractDataTableRead.java
index 59e8cc0666ee..6d6f572d2b12 100644
--- a/paimon-core/src/main/java/org/apache/paimon/table/source/AbstractDataTableRead.java
+++ b/paimon-core/src/main/java/org/apache/paimon/table/source/AbstractDataTableRead.java
@@ -21,8 +21,10 @@
 import org.apache.paimon.catalog.TableQueryAuthResult;
 import org.apache.paimon.data.InternalRow;
 import org.apache.paimon.disk.IOManager;
+import org.apache.paimon.predicate.FieldRef;
 import org.apache.paimon.predicate.Predicate;
 import org.apache.paimon.predicate.PredicateProjectionConverter;
+import org.apache.paimon.predicate.Transform;
 import org.apache.paimon.reader.RecordReader;
 import org.apache.paimon.schema.TableSchema;
 import org.apache.paimon.types.RowType;
@@ -35,6 +37,7 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 
@@ -138,9 +141,21 @@ private RecordReader<InternalRow> authedReader(Split split, TableQueryAuthResult
         RowType tableType = schema.logicalRowType();
         RowType readType = this.readType == null ? tableType : this.readType;
         Predicate authPredicate = authResult.extractPredicate();
+        Map<String, Transform> columnMasking = authResult.extractColumnMasking();
         ProjectedRow backRow = null;
+        Set<String> authFields = new HashSet<>();
         if (authPredicate != null) {
-            Set<String> authFields = collectFieldNames(authPredicate);
+            authFields.addAll(collectFieldNames(authPredicate));
+        }
+        for (Map.Entry<String, Transform> mask : columnMasking.entrySet()) {
+            authFields.add(mask.getKey());
+            for (Object input : mask.getValue().inputs()) {
+                if (input instanceof FieldRef) {
+                    authFields.add(((FieldRef) input).name());
+                }
+            }
+        }
+        if (!authFields.isEmpty()) {
             List<String> readFields = readType.getFieldNames();
             List<String> authAddNames = new ArrayList<>();
             Set<String> readFieldSet = new HashSet<>(readFields);
@@ -151,7 +166,7 @@ private RecordReader<InternalRow> authedReader(Split split, TableQueryAuthResult
             }
             if (!authAddNames.isEmpty()) {
                 readType = tableType.project(ListUtils.union(readFields, authAddNames));
-                withReadType(readType);
+                applyReadType(readType);
                 backRow = ProjectedRow.from(readType.projectIndexes(readFields));
             }
         }
diff --git a/paimon-core/src/test/java/org/apache/paimon/catalog/TableQueryAuthResultTest.java b/paimon-core/src/test/java/org/apache/paimon/catalog/TableQueryAuthResultTest.java
new file mode 100644
index 000000000000..3d45924871f1
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/catalog/TableQueryAuthResultTest.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.catalog;
+
+import org.apache.paimon.predicate.Predicate;
+import org.apache.paimon.types.RowType;
+import org.apache.paimon.utils.JsonSerdeUtil;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/** Tests that malformed query-authorization definitions cannot be silently ignored. */
+public class TableQueryAuthResultTest {
+
+    @Test
+    void testInvalidRowFilterFailsClosed() {
+        assertThatThrownBy(
+                        () ->
+                                new TableQueryAuthResult(Collections.singletonList(""), null)
+                                        .extractPredicate())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("cannot be empty");
+        assertThatThrownBy(
+                        () ->
+                                new TableQueryAuthResult(Collections.singletonList("null"), null)
+                                        .extractPredicate())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("JSON null");
+
+        Predicate emptyCompound =
+                JsonSerdeUtil.fromJson(
+                        "{\"kind\":\"COMPOUND\",\"function\":\"AND\",\"children\":[]}",
+                        Predicate.class);
+        assertThatThrownBy(() -> TableQueryAuthResult.remapPredicate(emptyCompound, RowType.of()))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("must contain a predicate");
+
+        Predicate missingFunction =
+                JsonSerdeUtil.fromJson(
+                        "{\"kind\":\"COMPOUND\",\"function\":null,\"children\":["
+                                + "{\"kind\":\"LEAF\",\"transform\":{\"name\":\"NULL\"},"
+                                + "\"function\":\"TRUE\",\"literals\":[]},"
+                                + "{\"kind\":\"LEAF\",\"transform\":{\"name\":\"NULL\"},"
+                                + "\"function\":\"TRUE\",\"literals\":[]}]}",
+                        Predicate.class);
+        assertThatThrownBy(() -> TableQueryAuthResult.remapPredicate(missingFunction, RowType.of()))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("function cannot be null");
+    }
+
+    @Test
+    void testInvalidColumnMaskFailsClosed() {
+        assertThatThrownBy(
+                        () ->
+                                new TableQueryAuthResult(
+                                                null, Collections.singletonMap("email", ""))
+                                        .extractColumnMasking())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("cannot be empty");
+        assertThatThrownBy(
+                        () ->
+                                new TableQueryAuthResult(
+                                                null, Collections.singletonMap("email", "null"))
+                                        .extractColumnMasking())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("JSON null");
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java
index ab205b3c1f26..027736ded674 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKeyTest.java
@@ -39,11 +39,13 @@ void testOrderingDoesNotFlattenOpaquePrincipalAndColumn() {
         PolicyKey first =
                 new PolicyKey(
                         "table-id",
-                        DataPolicy.columnMask(resource, new ColumnMask("mask", "c", null), "a:b"));
+                        DataPolicy.columnMask(
+                                resource, new ColumnMask("c", "{\"name\":\"NULL\"}"), "a:b"));
         PolicyKey second =
                 new PolicyKey(
                         "table-id",
-                        DataPolicy.columnMask(resource, new ColumnMask("mask", "b:c", null), "a"));
+                        DataPolicy.columnMask(
+                                resource, new ColumnMask("b:c", "{\"name\":\"NULL\"}"), "a"));
 
         TreeSet<PolicyKey> sorted = new TreeSet<>();
         sorted.add(first);
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 42f1d553c09f..688815366d5e 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -53,6 +53,7 @@
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
 import org.apache.paimon.partition.PartitionUtils;
+import org.apache.paimon.predicate.FieldRef;
 import org.apache.paimon.predicate.Predicate;
 import org.apache.paimon.predicate.Transform;
 import org.apache.paimon.rest.auth.AuthProvider;
@@ -177,7 +178,6 @@
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
-import java.util.function.BiFunction;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
@@ -226,10 +226,6 @@ public class RESTCatalogServer {
     private final TableLifecycleLocks tableLifecycleLocks = new TableLifecycleLocks();
     private final Set<String> managementPrincipals = new HashSet<>();
     private final Set<String> queryPrincipals = new HashSet<>();
-    private final Map<String, BiFunction<TableSchema, RowFilter, Predicate>>
-            rowFilterPolicyFunctions = new HashMap<>();
-    private final Map<String, BiFunction<TableSchema, ColumnMask, Transform>>
-            columnMaskPolicyFunctions = new HashMap<>();
     private final Set<PermissionResource> noManagementPermissionResources =
             ConcurrentHashMap.newKeySet();
 
@@ -387,24 +383,6 @@ public void setQueryPrincipals(Set<String> principals) {
         queryPrincipals.addAll(principals);
     }
 
-    public void registerRowFilterPolicyFunction(String name, Predicate predicate) {
-        rowFilterPolicyFunctions.put(name, (schema, rowFilter) -> predicate);
-    }
-
-    public void registerColumnMaskPolicyFunction(String name, Transform transform) {
-        columnMaskPolicyFunctions.put(name, (schema, columnMask) -> transform);
-    }
-
-    public void registerRowFilterPolicyCompiler(
-            String name, BiFunction<TableSchema, RowFilter, Predicate> compiler) {
-        rowFilterPolicyFunctions.put(name, compiler);
-    }
-
-    public void registerColumnMaskPolicyCompiler(
-            String name, BiFunction<TableSchema, ColumnMask, Transform> compiler) {
-        columnMaskPolicyFunctions.put(name, compiler);
-    }
-
     public void denyManagementPermission(PermissionResource resource) {
         noManagementPermissionResources.add(resource);
     }
@@ -1077,6 +1055,17 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
         if (metadata == null) {
             throw new Catalog.TableNotExistException(identifier);
         }
+        synchronized (policyLock(metadata.uuid())) {
+            TableMetadata current = tableMetadataStore.get(identifier.getFullName());
+            if (current == null || !current.uuid().equals(metadata.uuid())) {
+                throw new Catalog.TableNotExistException(identifier);
+            }
+            return authTable(identifier, requestBody, current);
+        }
+    }
+
+    private MockResponse authTable(
+            Identifier identifier, AuthTableQueryRequest requestBody, TableMetadata metadata) {
         List<String> columnAuth = columnAuthHandler.get(identifier.getFullName());
         if (columnAuth != null) {
             List<String> select = requestBody.select();
@@ -1108,7 +1097,7 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
             if (rowFilter != null) {
                 Predicate predicate;
                 try {
-                    predicate = compileRowFilter(metadata.schema(), rowFilter);
+                    predicate = parseRowFilter(metadata.schema(), rowFilter);
                 } catch (RuntimeException e) {
                     throw new Catalog.TableNoPermissionException(identifier);
                 }
@@ -1121,7 +1110,7 @@ private MockResponse authTable(Identifier identifier, String data) throws Except
             ColumnMask columnMask = policy.getColumnMask();
             Transform transform;
             try {
-                transform = compileColumnMask(metadata.schema(), columnMask);
+                transform = parseColumnMask(metadata.schema(), columnMask);
             } catch (RuntimeException e) {
                 throw new Catalog.TableNoPermissionException(identifier);
             }
@@ -3295,7 +3284,6 @@ private MockResponse permissionsApiHandler(
             String method, String resourcePath, String data, Map<String, String> parameters)
             throws JsonProcessingException {
         if ("GET".equals(method) && permissionUri.equals(resourcePath)) {
-            boolean includeInherited = Boolean.parseBoolean(parameters.get("includeInherited"));
             PermissionResource target = permissionResource(parameters);
             MockResponse authorization = validateManagementPermission(target);
             if (authorization != null) {
@@ -3305,8 +3293,7 @@ private MockResponse permissionsApiHandler(
             if (validation != null) {
                 return validation;
             }
-            List<PermissionAssignment> filtered =
-                    permissionStore.list(target, parameters, includeInherited);
+            List<PermissionAssignment> filtered = permissionStore.list(target, parameters);
             int start =
                     parameters.containsKey(PAGE_TOKEN)
                             ? Integer.parseInt(parameters.get(PAGE_TOKEN))
@@ -3541,6 +3528,7 @@ private MockResponse policiesApiHandler(
                 if (validation != null) {
                     return validation;
                 }
+                policy = canonicalizePolicy(policy);
                 PolicyKey key = new PolicyKey(tableUuid, policy);
                 if (policyStore.putIfAbsent(key, policy) != null) {
                     return mockResponse(
@@ -3566,6 +3554,7 @@ private MockResponse policiesApiHandler(
                 if (validation != null) {
                     return validation;
                 }
+                policy = canonicalizePolicy(policy);
                 policyStore.put(new PolicyKey(tableUuid, policy), policy);
             }
             return new MockResponse().setResponseCode(200);
@@ -3618,53 +3607,29 @@ private MockResponse validatePolicy(DataPolicy policy) {
         }
 
         RowFilter rowFilter = policy.getRowFilter();
-        String functionName =
-                rowFilter == null
-                        ? policy.getColumnMask().getFunctionName()
-                        : rowFilter.getFunctionName();
-        boolean functionExists =
-                rowFilter == null
-                        ? columnMaskPolicyFunctions.containsKey(functionName)
-                        : rowFilterPolicyFunctions.containsKey(functionName);
-        if (!functionExists) {
+        try {
+            Set<String> columns = new HashSet<>(metadata.schema().fieldNames());
+            ColumnMask columnMask = policy.getColumnMask();
+            if (columnMask != null) {
+                checkArgument(
+                        columns.contains(columnMask.getOnColumn()),
+                        "Policy column %s does not exist in table %s.",
+                        columnMask.getOnColumn(),
+                        identifier.getFullName());
+            }
+            if (rowFilter == null) {
+                parseColumnMask(metadata.schema(), columnMask);
+            } else {
+                parseRowFilter(metadata.schema(), rowFilter);
+            }
+        } catch (RuntimeException e) {
             return mockResponse(
                     new ErrorResponse(
-                            ErrorResponse.RESOURCE_TYPE_FUNCTION,
-                            functionName,
-                            "Policy function does not exist.",
-                            404),
-                    404);
-        }
-
-        Set<String> columns = new HashSet<>(metadata.schema().fieldNames());
-        ColumnMask columnMask = policy.getColumnMask();
-        if (columnMask != null) {
-            checkArgument(
-                    columns.contains(columnMask.getOnColumn()),
-                    "Policy column %s does not exist in table %s.",
-                    columnMask.getOnColumn(),
-                    identifier.getFullName());
-        }
-        (rowFilter == null ? columnMask.getFunctionArguments() : rowFilter.getFunctionArguments())
-                .stream()
-                        .filter(argument -> argument.getColumn() != null)
-                        .forEach(
-                                argument ->
-                                        checkArgument(
-                                                columns.contains(argument.getColumn()),
-                                                "Policy argument column %s does not exist in table %s.",
-                                                argument.getColumn(),
-                                                identifier.getFullName()));
-        if (rowFilter == null) {
-            checkArgument(
-                    compileColumnMask(metadata.schema(), columnMask) != null,
-                    "Policy function %s returned no column transform.",
-                    functionName);
-        } else {
-            checkArgument(
-                    compileRowFilter(metadata.schema(), rowFilter) != null,
-                    "Policy function %s returned no row predicate.",
-                    functionName);
+                            ErrorResponse.RESOURCE_TYPE_POLICY,
+                            PolicyIdentity.fromPolicy(policy).resourceName(),
+                            e.getMessage(),
+                            400),
+                    400);
         }
         return null;
     }
@@ -3704,16 +3669,65 @@ private static DataPolicy withResource(DataPolicy policy, PermissionResource res
                 : DataPolicy.rowFilter(resource, policy.getRowFilter(), policy.getPrincipal());
     }
 
-    private Predicate compileRowFilter(TableSchema schema, RowFilter rowFilter) {
-        BiFunction<TableSchema, RowFilter, Predicate> compiler =
-                rowFilterPolicyFunctions.get(rowFilter.getFunctionName());
-        return compiler == null ? null : compiler.apply(schema, rowFilter);
-    }
-
-    private Transform compileColumnMask(TableSchema schema, ColumnMask columnMask) {
-        BiFunction<TableSchema, ColumnMask, Transform> compiler =
-                columnMaskPolicyFunctions.get(columnMask.getFunctionName());
-        return compiler == null ? null : compiler.apply(schema, columnMask);
+    private DataPolicy canonicalizePolicy(DataPolicy policy) {
+        Identifier identifier =
+                Identifier.create(
+                        policy.getResource().getDatabase(), policy.getResource().getTable());
+        TableSchema schema = tableMetadataStore.get(identifier.getFullName()).schema();
+        if (policy.getRowFilter() != null) {
+            String predicate =
+                    JsonSerdeUtil.toFlatJson(parseRowFilter(schema, policy.getRowFilter()));
+            return DataPolicy.rowFilter(
+                    policy.getResource(), new RowFilter(predicate), policy.getPrincipal());
+        }
+        ColumnMask columnMask = policy.getColumnMask();
+        String transform = JsonSerdeUtil.toFlatJson(parseColumnMask(schema, columnMask));
+        return DataPolicy.columnMask(
+                policy.getResource(),
+                new ColumnMask(columnMask.getOnColumn(), transform),
+                policy.getPrincipal());
+    }
+
+    private static Predicate parseRowFilter(TableSchema schema, RowFilter rowFilter) {
+        Predicate predicate = JsonSerdeUtil.fromJson(rowFilter.getPredicate(), Predicate.class);
+        checkArgument(predicate != null, "Row filter predicate cannot be JSON null.");
+        Predicate remapped =
+                TableQueryAuthResult.remapPredicate(predicate, schema.logicalRowType());
+        checkArgument(remapped != null, "Row filter predicate cannot be empty.");
+        return remapped;
+    }
+
+    private static Transform parseColumnMask(TableSchema schema, ColumnMask columnMask) {
+        Transform transform = JsonSerdeUtil.fromJson(columnMask.getTransform(), Transform.class);
+        checkArgument(transform != null, "Column mask transform cannot be JSON null.");
+        RowType rowType = schema.logicalRowType();
+        List<Object> remappedInputs = new ArrayList<>();
+        for (Object input : transform.inputs()) {
+            if (input instanceof FieldRef) {
+                FieldRef ref = (FieldRef) input;
+                int index = rowType.getFieldIndex(ref.name());
+                checkArgument(
+                        index >= 0,
+                        "Column masking refers to field '%s' which is not present in table schema.",
+                        ref.name());
+                remappedInputs.add(new FieldRef(index, ref.name(), rowType.getTypeAt(index)));
+            } else {
+                remappedInputs.add(input);
+            }
+        }
+        Transform remapped = transform.copyWithNewInputs(remappedInputs);
+        int targetIndex = rowType.getFieldIndex(columnMask.getOnColumn());
+        checkArgument(
+                targetIndex >= 0,
+                "Policy column %s does not exist in table schema.",
+                columnMask.getOnColumn());
+        checkArgument(
+                rowType.getTypeAt(targetIndex).equals(remapped.outputType()),
+                "Column mask output type %s does not match target column %s type %s.",
+                remapped.outputType(),
+                columnMask.getOnColumn(),
+                rowType.getTypeAt(targetIndex));
+        return remapped;
     }
 
     private void removePolicies(@Nullable String tableUuid) {
@@ -3750,28 +3764,10 @@ private void validatePoliciesForSchema(
                         columnMask.getOnColumn(),
                         identifier.getFullName());
             }
-            (policy.getRowFilter() == null
-                            ? columnMask.getFunctionArguments()
-                            : policy.getRowFilter().getFunctionArguments())
-                    .stream()
-                            .filter(argument -> argument.getColumn() != null)
-                            .forEach(
-                                    argument ->
-                                            checkArgument(
-                                                    columns.contains(argument.getColumn()),
-                                                    "Cannot remove or rename policy argument column %s from table %s.",
-                                                    argument.getColumn(),
-                                                    identifier.getFullName()));
             if (policy.getRowFilter() == null) {
-                checkArgument(
-                        compileColumnMask(schema, columnMask) != null,
-                        "Column mask function %s is invalid for the changed schema.",
-                        columnMask.getFunctionName());
+                parseColumnMask(schema, columnMask);
             } else {
-                checkArgument(
-                        compileRowFilter(schema, policy.getRowFilter()) != null,
-                        "Row filter function %s is invalid for the changed schema.",
-                        policy.getRowFilter().getFunctionName());
+                parseRowFilter(schema, policy.getRowFilter());
             }
         }
     }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
index e74a0b6cd4c2..287e5abda236 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
@@ -18,17 +18,13 @@
 
 package org.apache.paimon.rest;
 
-import org.apache.paimon.management.PermissionAccess;
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
-import org.apache.paimon.management.ResourceType;
 
 import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
 
@@ -46,89 +42,21 @@ void remove(PermissionIdentity identity) {
         assignments.remove(identity);
     }
 
-    List<PermissionAssignment> list(
-            PermissionResource target, Map<String, String> parameters, boolean includeInherited) {
+    List<PermissionAssignment> list(PermissionResource target, Map<String, String> parameters) {
         return assignments.values().stream()
-                .filter(assignment -> matchesSource(assignment, parameters, includeInherited))
-                .filter(assignment -> !includeInherited || isEffectiveOn(assignment, target))
-                .map(
-                        assignment ->
-                                includeInherited
-                                        ? effectiveAssignment(assignment, target)
-                                        : assignment)
-                .filter(assignment -> matches(parameters, "scope", assignment.getScope().name()))
+                .filter(assignment -> assignment.getResource().equals(target))
+                .filter(assignment -> matches(parameters, "principal", assignment.getPrincipal()))
+                .filter(assignment -> matches(parameters, "access", assignment.getAccess()))
                 .sorted(Comparator.comparing(RESTPermissionStore::sortKey))
                 .collect(Collectors.toList());
     }
 
-    private static boolean matchesSource(
-            PermissionAssignment assignment,
-            Map<String, String> parameters,
-            boolean includeInherited) {
-        PermissionResource resource = assignment.getResource();
-        return matches(parameters, "principal", assignment.getPrincipal())
-                && matches(parameters, "access", assignment.getAccess())
-                && (includeInherited
-                        || (matches(parameters, "resourceType", resource.getType().name())
-                                && matches(parameters, "database", resource.getDatabase())
-                                && matches(parameters, "table", resource.getTable())
-                                && matches(parameters, "function", resource.getFunction())
-                                && matches(parameters, "view", resource.getView())));
-    }
-
-    private static boolean isEffectiveOn(
-            PermissionAssignment assignment, PermissionResource target) {
-        PermissionResource source = assignment.getResource();
-        if (source.equals(target)) {
-            return true;
-        }
-        if (!isAccessApplicableToTarget(assignment.getAccess(), target)) {
-            return false;
-        }
-        if (assignment.getScope() == PermissionScope.SELF) {
-            return false;
-        }
-        if (source.getType() == ResourceType.CATALOG) {
-            return target.getType() != ResourceType.CATALOG;
-        }
-        return source.getType() == ResourceType.DATABASE
-                && target.getType() != ResourceType.CATALOG
-                && target.getType() != ResourceType.DATABASE
-                && Objects.equals(source.getDatabase(), target.getDatabase());
-    }
-
-    private static boolean isAccessApplicableToTarget(String access, PermissionResource target) {
-        try {
-            PermissionAccess.canonicalize(target, PermissionScope.SELF, access);
-            return true;
-        } catch (IllegalArgumentException e) {
-            return false;
-        }
-    }
-
-    private static PermissionAssignment effectiveAssignment(
-            PermissionAssignment assignment, PermissionResource target) {
-        if (assignment.getResource().equals(target)) {
-            return assignment;
-        }
-        return new PermissionAssignment(
-                target,
-                PermissionScope.SELF,
-                assignment.getAccess(),
-                assignment.getPrincipal(),
-                assignment.getExpireTime(),
-                assignment.getResource());
-    }
-
     private static boolean matches(Map<String, String> parameters, String key, String value) {
-        return !parameters.containsKey(key) || Objects.equals(parameters.get(key), value);
+        return !parameters.containsKey(key) || parameters.get(key).equals(value);
     }
 
     private static String sortKey(PermissionAssignment assignment) {
-        PermissionResource source =
-                assignment.getInheritedFrom() == null
-                        ? assignment.getResource()
-                        : assignment.getInheritedFrom();
+        PermissionResource source = assignment.getResource();
         return source.getType().name()
                 + '\0'
                 + value(source.getDatabase())
@@ -139,8 +67,6 @@ private static String sortKey(PermissionAssignment assignment) {
                 + '\0'
                 + value(source.getView())
                 + '\0'
-                + assignment.getScope().name()
-                + '\0'
                 + assignment.getAccess()
                 + '\0'
                 + assignment.getPrincipal();
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
index 40f4f1154c43..cf7d7ff01bc4 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
@@ -20,20 +20,18 @@
 
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.management.ResourceType;
 
 import org.junit.jupiter.api.Test;
 
 import java.time.Instant;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.stream.IntStream;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
-/** Tests atomic replacement and effective-view filtering in {@link RESTPermissionStore}. */
+/** Tests atomic replacement and exact-resource filtering in {@link RESTPermissionStore}. */
 class RESTPermissionStoreTest {
 
     private static final String ANALYST = "analyst";
@@ -50,49 +48,25 @@ void testConcurrentGrantReplacesTheSameIdentity() {
                                 store.put(
                                         new PermissionAssignment(
                                                 table,
-                                                PermissionScope.SELF,
                                                 "SELECT",
                                                 ANALYST,
-                                                Instant.ofEpochSecond(i).toString(),
-                                                null)));
+                                                Instant.ofEpochSecond(i).toString())));
 
-        assertThat(store.list(table, tableParameters(), false)).hasSize(1);
+        assertThat(store.list(table, tableParameters())).hasSize(1);
     }
 
     @Test
-    void testScopeFilterAppliesToInheritedEffectiveView() {
+    void testListReturnsOnlyTheExactTarget() {
         RESTPermissionStore store = new RESTPermissionStore();
         PermissionResource catalog =
                 new PermissionResource(ResourceType.CATALOG, null, null, null, null);
-        store.put(
-                new PermissionAssignment(
-                        catalog, PermissionScope.DESCENDANTS, "SELECT", ANALYST, null, null));
-        Map<String, String> parameters = tableParameters();
-        parameters.put("scope", "SELF");
+        store.put(new PermissionAssignment(catalog, "USE_CATALOG", ANALYST, null));
+        store.put(new PermissionAssignment(tableResource(), "SELECT", ANALYST, null));
 
-        List<PermissionAssignment> assignments = store.list(tableResource(), parameters, true);
-
-        assertThat(assignments).hasSize(1);
-        assertThat(assignments.get(0).getScope()).isEqualTo(PermissionScope.SELF);
-        assertThat(assignments.get(0).getInheritedFrom()).isEqualTo(catalog);
-    }
-
-    @Test
-    void testIncludingInheritedAlsoKeepsDirectDescendantsAssignment() {
-        RESTPermissionStore store = new RESTPermissionStore();
-        PermissionResource catalog =
-                new PermissionResource(ResourceType.CATALOG, null, null, null, null);
-        store.put(
-                new PermissionAssignment(
-                        catalog, PermissionScope.DESCENDANTS, "SELECT", ANALYST, null, null));
-        Map<String, String> parameters = new HashMap<>();
-        parameters.put("resourceType", "CATALOG");
-
-        List<PermissionAssignment> assignments = store.list(catalog, parameters, true);
-
-        assertThat(assignments).hasSize(1);
-        assertThat(assignments.get(0).getScope()).isEqualTo(PermissionScope.DESCENDANTS);
-        assertThat(assignments.get(0).getInheritedFrom()).isNull();
+        assertThat(store.list(tableResource(), tableParameters()))
+                .singleElement()
+                .extracting(PermissionAssignment::getAccess)
+                .isEqualTo("SELECT");
     }
 
     private static PermissionResource tableResource() {
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
index edc533287245..a161d34c5cd1 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
@@ -24,7 +24,6 @@
 import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.management.PolicyManagement;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.rest.RESTCatalog;
@@ -76,15 +75,12 @@ protected static PermissionAssignment assignment(
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
-            @Nullable String scope,
             @Nullable String expireTime) {
         return new PermissionAssignment(
                 resource(resourceType, database, table, function, view),
-                scope(scope),
                 access,
                 principal,
-                emptyToNull(expireTime),
-                null);
+                emptyToNull(expireTime));
     }
 
     protected static PermissionIdentity identity(
@@ -94,13 +90,9 @@ protected static PermissionIdentity identity(
             @Nullable String database,
             @Nullable String table,
             @Nullable String function,
-            @Nullable String view,
-            @Nullable String scope) {
+            @Nullable String view) {
         return new PermissionIdentity(
-                resource(resourceType, database, table, function, view),
-                scope(scope),
-                access,
-                principal);
+                resource(resourceType, database, table, function, view), access, principal);
     }
 
     protected static PermissionResource resource(
@@ -117,12 +109,6 @@ protected static PermissionResource resource(
                 emptyToNull(view));
     }
 
-    protected static PermissionScope scope(@Nullable String value) {
-        return isBlank(value)
-                ? PermissionScope.SELF
-                : enumValue(value, PermissionScope.class, "scope");
-    }
-
     protected static <E extends Enum<E>> E enumValue(
             String value, Class<E> enumClass, String argument) {
         checkArgument(!isBlank(value), "%s cannot be empty.", argument);
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
index b87c5b7fb9b6..b9dc78537309 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
@@ -21,25 +21,16 @@
 import org.apache.paimon.management.ColumnMask;
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyArgument;
 import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.management.RowFilter;
 
-import org.apache.spark.sql.catalyst.util.ArrayData;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
-import org.apache.spark.sql.types.DataTypes;
-import org.apache.spark.unsafe.types.UTF8String;
 
 import javax.annotation.Nullable;
 
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
 import static org.apache.paimon.utils.Preconditions.checkArgument;
-import static org.apache.spark.sql.types.DataTypes.StringType;
 
 /** Shared typed argument conversion for table policy procedures. */
 abstract class BasePolicyProcedure extends BasePermissionProcedure {
@@ -48,27 +39,22 @@ protected BasePolicyProcedure(TableCatalog tableCatalog) {
         super(tableCatalog);
     }
 
-    protected static org.apache.spark.sql.types.DataType functionArgumentArrayType() {
-        return DataTypes.createArrayType(StringType);
-    }
-
     protected static DataPolicy policy(
             String database,
             String table,
             PolicyType policyType,
             String principal,
-            String functionName,
+            @Nullable String predicate,
             @Nullable String onColumn,
-            @Nullable ArrayData functionArguments) {
+            @Nullable String transform) {
         PermissionResource resource = tableResource(database, table);
-        List<PolicyArgument> arguments = arguments(functionArguments);
         if (policyType == PolicyType.ROW_FILTER) {
             checkArgument(isBlank(onColumn), "ROW_FILTER policy cannot specify on_column.");
-            return DataPolicy.rowFilter(
-                    resource, new RowFilter(functionName, arguments), principal);
+            checkArgument(isBlank(transform), "ROW_FILTER policy cannot specify transform.");
+            return DataPolicy.rowFilter(resource, new RowFilter(predicate), principal);
         }
-        return DataPolicy.columnMask(
-                resource, new ColumnMask(functionName, onColumn, arguments), principal);
+        checkArgument(isBlank(predicate), "COLUMN_MASKING policy cannot specify predicate.");
+        return DataPolicy.columnMask(resource, new ColumnMask(onColumn, transform), principal);
     }
 
     protected static PolicyIdentity policyIdentity(
@@ -83,44 +69,4 @@ protected static PolicyIdentity policyIdentity(
     protected static PermissionResource tableResource(String database, String table) {
         return resource(ResourceType.TABLE, database, table, null, null);
     }
-
-    private static List<PolicyArgument> arguments(@Nullable ArrayData data) {
-        if (data == null) {
-            return Collections.emptyList();
-        }
-        List<PolicyArgument> arguments = new ArrayList<>(data.numElements());
-        for (int i = 0; i < data.numElements(); i++) {
-            checkArgument(!data.isNullAt(i), "function_arguments cannot contain null.");
-            UTF8String value = data.getUTF8String(i);
-            String encoded = value.toString();
-            boolean constant = encoded.regionMatches(true, 0, "constant:", 0, "constant:".length());
-            String[] argument =
-                    split(
-                            encoded,
-                            "function_arguments",
-                            "column:value or constant:value",
-                            constant);
-            if ("column".equalsIgnoreCase(argument[0])) {
-                arguments.add(PolicyArgument.column(argument[1]));
-            } else {
-                checkArgument(
-                        "constant".equalsIgnoreCase(argument[0]),
-                        "function_arguments entries must start with column: or constant:.");
-                arguments.add(PolicyArgument.constant(argument[1]));
-            }
-        }
-        return arguments;
-    }
-
-    private static String[] split(
-            String encoded, String argument, String expected, boolean allowEmptyValue) {
-        int delimiter = encoded.indexOf(':');
-        checkArgument(
-                delimiter > 0 && (allowEmptyValue || delimiter < encoded.length() - 1),
-                "%s entry '%s' must use %s.",
-                argument,
-                encoded,
-                expected);
-        return new String[] {encoded.substring(0, delimiter), encoded.substring(delimiter + 1)};
-    }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
index 4f4b40368b43..a8e63b31c36d 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
@@ -39,9 +39,9 @@ abstract class CreateOrReplacePolicyBaseProcedure extends BasePolicyProcedure {
                 ProcedureParameter.required("table", StringType),
                 ProcedureParameter.required("policy_type", StringType),
                 ProcedureParameter.required("principal", StringType),
-                ProcedureParameter.required("function_name", StringType),
+                ProcedureParameter.optional("predicate_json", StringType),
                 ProcedureParameter.optional("on_column", StringType),
-                ProcedureParameter.optional("function_arguments", functionArgumentArrayType())
+                ProcedureParameter.optional("transform_json", StringType)
             };
 
     private static final StructType OUTPUT_TYPE =
@@ -72,9 +72,9 @@ public InternalRow[] call(InternalRow args) {
                         args.getString(1),
                         enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
                         args.getString(3),
-                        args.getString(4),
+                        args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
-                        args.isNullAt(6) ? null : args.getArray(6));
+                        args.isNullAt(6) ? null : args.getString(6));
         writePolicy(policy);
         return new InternalRow[] {newInternalRow(true)};
     }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
index 720af70eaf10..45693c8b6781 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
@@ -41,7 +41,6 @@ public class GrantPermissionProcedure extends BasePermissionProcedure {
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
-                ProcedureParameter.optional("scope", StringType),
                 ProcedureParameter.optional("expire_time", StringType)
             };
 
@@ -82,8 +81,7 @@ public InternalRow[] call(InternalRow args) {
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6),
-                        args.isNullAt(7) ? null : args.getString(7),
-                        args.isNullAt(8) ? null : args.getString(8));
+                        args.isNullAt(7) ? null : args.getString(7));
 
         permissionManagement().grantPermission(assignment);
         return new InternalRow[] {newInternalRow(true)};
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
index fd6994511cfb..066fa4f88e1d 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
@@ -21,9 +21,7 @@
 import org.apache.paimon.PagedList;
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionScope;
 import org.apache.paimon.management.ResourceType;
-import org.apache.paimon.utils.JsonSerdeUtil;
 
 import org.apache.spark.sql.catalyst.InternalRow;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
@@ -34,24 +32,21 @@
 
 import java.util.List;
 
-import static org.apache.spark.sql.types.DataTypes.BooleanType;
 import static org.apache.spark.sql.types.DataTypes.IntegerType;
 import static org.apache.spark.sql.types.DataTypes.StringType;
 
-/** Lists direct and optionally resource-inherited permissions on an exact target. */
+/** Lists direct permissions on an exact target. */
 public class ListPermissionsProcedure extends BasePermissionProcedure {
 
     private static final ProcedureParameter[] PARAMETERS =
             new ProcedureParameter[] {
                 ProcedureParameter.required("resource_type", StringType),
-                ProcedureParameter.optional("scope", StringType),
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
                 ProcedureParameter.optional("principal", StringType),
                 ProcedureParameter.optional("access", StringType),
-                ProcedureParameter.optional("include_inherited", BooleanType),
                 ProcedureParameter.optional("max_results", IntegerType),
                 ProcedureParameter.optional("page_token", StringType)
             };
@@ -60,7 +55,6 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
             new StructType(
                     new StructField[] {
                         field("resource_type", StringType, false),
-                        field("scope", StringType, false),
                         field("database", StringType, true),
                         field("table", StringType, true),
                         field("function", StringType, true),
@@ -68,7 +62,6 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
                         field("access", StringType, false),
                         field("principal", StringType, false),
                         field("expire_time", StringType, true),
-                        field("inherited_from_json", StringType, true),
                         field("next_page_token", StringType, true)
                     });
 
@@ -90,22 +83,17 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        Integer maxResults = args.isNullAt(9) ? null : args.getInt(9);
+        Integer maxResults = args.isNullAt(7) ? null : args.getInt(7);
         ListPermissionsRequest request =
                 new ListPermissionsRequest(
                         resourceType,
-                        optionalEnum(
-                                args.isNullAt(1) ? null : args.getString(1),
-                                PermissionScope.class,
-                                PARAMETERS[1].name()),
+                        args.isNullAt(1) ? null : emptyToNull(args.getString(1)),
                         args.isNullAt(2) ? null : emptyToNull(args.getString(2)),
                         args.isNullAt(3) ? null : emptyToNull(args.getString(3)),
                         args.isNullAt(4) ? null : emptyToNull(args.getString(4)),
                         args.isNullAt(5) ? null : emptyToNull(args.getString(5)),
                         args.isNullAt(6) ? null : emptyToNull(args.getString(6)),
-                        args.isNullAt(7) ? null : emptyToNull(args.getString(7)),
-                        !args.isNullAt(8) && args.getBoolean(8),
-                        args.isNullAt(10) ? null : emptyToNull(args.getString(10)),
+                        args.isNullAt(8) ? null : emptyToNull(args.getString(8)),
                         maxResults);
         PagedList<PermissionAssignment> page = permissionManagement().listPermissions(request);
         List<PermissionAssignment> assignments = page.getElements();
@@ -119,7 +107,6 @@ public InternalRow[] call(InternalRow args) {
             rows[i] =
                     newInternalRow(
                             string(assignment.getResource().getType().name()),
-                            string(assignment.getScope().name()),
                             string(assignment.getResource().getDatabase()),
                             string(assignment.getResource().getTable()),
                             string(assignment.getResource().getFunction()),
@@ -127,7 +114,6 @@ public InternalRow[] call(InternalRow args) {
                             string(assignment.getAccess()),
                             string(assignment.getPrincipal()),
                             string(assignment.getExpireTime()),
-                            json(assignment.getInheritedFrom()),
                             string(page.getNextPageToken()));
         }
         return rows;
@@ -142,10 +128,6 @@ private static UTF8String string(String value) {
         return value == null ? null : UTF8String.fromString(value);
     }
 
-    private static UTF8String json(Object value) {
-        return value == null ? null : string(JsonSerdeUtil.toFlatJson(value));
-    }
-
     public static ProcedureBuilder builder() {
         return new Builder<ListPermissionsProcedure>() {
             @Override
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
index 7d826614ae5a..fa4d8a244fff 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPoliciesProcedure.java
@@ -24,7 +24,6 @@
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.management.RowFilter;
-import org.apache.paimon.utils.JsonSerdeUtil;
 
 import org.apache.spark.sql.catalyst.InternalRow;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
@@ -59,9 +58,9 @@ public class ListPoliciesProcedure extends BasePolicyProcedure {
                         field("table", StringType, false),
                         field("policy_type", StringType, false),
                         field("principal", StringType, false),
-                        field("function_name", StringType, false),
+                        field("predicate_json", StringType, true),
                         field("on_column", StringType, true),
-                        field("function_arguments_json", StringType, false),
+                        field("transform_json", StringType, true),
                         field("next_page_token", StringType, true)
                     });
 
@@ -108,15 +107,9 @@ public InternalRow[] call(InternalRow args) {
                             string(policy.getResource().getTable()),
                             string(policy.type().name()),
                             string(policy.getPrincipal()),
-                            string(
-                                    rowFilter == null
-                                            ? columnMask.getFunctionName()
-                                            : rowFilter.getFunctionName()),
+                            string(rowFilter == null ? null : rowFilter.getPredicate()),
                             string(columnMask == null ? null : columnMask.getOnColumn()),
-                            json(
-                                    rowFilter == null
-                                            ? columnMask.getFunctionArguments()
-                                            : rowFilter.getFunctionArguments()),
+                            string(columnMask == null ? null : columnMask.getTransform()),
                             string(page.getNextPageToken()));
         }
         return rows;
@@ -131,10 +124,6 @@ private static UTF8String string(String value) {
         return value == null ? null : UTF8String.fromString(value);
     }
 
-    private static UTF8String json(Object value) {
-        return string(JsonSerdeUtil.toFlatJson(value));
-    }
-
     public static ProcedureBuilder builder() {
         return new Builder<ListPoliciesProcedure>() {
             @Override
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
index 0b383633c3de..cf3238692dd3 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
@@ -41,8 +41,7 @@ public class RevokePermissionProcedure extends BasePermissionProcedure {
                 ProcedureParameter.optional("database", StringType),
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
-                ProcedureParameter.optional("view", StringType),
-                ProcedureParameter.optional("scope", StringType)
+                ProcedureParameter.optional("view", StringType)
             };
 
     private static final StructType OUTPUT_TYPE =
@@ -77,8 +76,7 @@ public InternalRow[] call(InternalRow args) {
                         args.isNullAt(3) ? null : args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
-                        args.isNullAt(6) ? null : args.getString(6),
-                        args.isNullAt(7) ? null : args.getString(7));
+                        args.isNullAt(6) ? null : args.getString(6));
 
         permissionManagement().revokePermission(identity);
         return new InternalRow[] {newInternalRow(true)};
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index 02274632cd82..d68b874164b0 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -20,17 +20,16 @@ package org.apache.paimon.spark.procedure
 
 import org.apache.paimon.catalog.Identifier
 import org.apache.paimon.data.BinaryString
-import org.apache.paimon.management.{ColumnMask, PermissionResource, ResourceType, RowFilter}
-import org.apache.paimon.predicate.{ConcatTransform, Equal, FieldRef, FieldTransform, LeafPredicate, Predicate, Transform}
-import org.apache.paimon.schema.TableSchema
+import org.apache.paimon.management.{PermissionResource, ResourceType}
+import org.apache.paimon.predicate.{ConcatTransform, Equal, FieldRef, FieldTransform, LeafPredicate}
 import org.apache.paimon.spark.{PaimonSparkTestBase, PaimonSparkTestWithRestCatalogBase}
 import org.apache.paimon.types.DataTypes
+import org.apache.paimon.utils.JsonSerdeUtil
 
 import org.apache.spark.sql.Row
 import org.assertj.core.api.Assertions.assertThat
 
-import java.util.Collections
-import java.util.function.BiFunction
+import java.util.{Arrays, Collections}
 
 /** End-to-end tests for permission and policy management procedures. */
 class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
@@ -60,25 +59,32 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       Row(true)
     )
 
-    val assignments = spark
-      .sql("""CALL sys.list_permissions(
-             |  resource_type => 'TABLE',
-             |  database => 'sales',
-             |  table => 'orders',
-             |  principal => 'analyst')
-             |""".stripMargin)
-      .collect()
+    val listed = spark.sql("""CALL sys.list_permissions(
+                             |  resource_type => 'TABLE',
+                             |  database => 'sales',
+                             |  table => 'orders',
+                             |  principal => 'analyst')
+                             |""".stripMargin)
+    assertThat(listed.columns).containsExactly(
+      "resource_type",
+      "database",
+      "table",
+      "function",
+      "view",
+      "access",
+      "principal",
+      "expire_time",
+      "next_page_token")
+    val assignments = listed.collect()
     assertThat(assignments).hasSize(1)
     val assignment = assignments.head
     assertThat(assignment.getString(0)).isEqualTo("TABLE")
-    assertThat(assignment.getString(1)).isEqualTo("SELF")
-    assertThat(assignment.getString(2)).isEqualTo("sales")
-    assertThat(assignment.getString(3)).isEqualTo("orders")
-    assertThat(assignment.getString(6)).isEqualTo("SELECT")
-    assertThat(assignment.getString(7)).isEqualTo("analyst")
-    assertThat(assignment.getString(8)).isEqualTo("2028-01-01T00:00:00Z")
-    assertThat(assignment.isNullAt(9)).isTrue
-    assertThat(assignment.isNullAt(10)).isTrue
+    assertThat(assignment.getString(1)).isEqualTo("sales")
+    assertThat(assignment.getString(2)).isEqualTo("orders")
+    assertThat(assignment.getString(5)).isEqualTo("SELECT")
+    assertThat(assignment.getString(6)).isEqualTo("analyst")
+    assertThat(assignment.getString(7)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.isNullAt(8)).isTrue
 
     val revoke = """CALL sys.revoke_permission(
                    |  resource_type => 'TABLE',
@@ -107,68 +113,73 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     val first = spark
       .sql("CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1)")
       .head()
-    assertThat(first.getString(7)).isEqualTo("first")
-    assertThat(first.getString(10)).isEqualTo("1")
+    assertThat(first.getString(6)).isEqualTo("first")
+    assertThat(first.getString(8)).isEqualTo("1")
 
     val second = spark
       .sql(
         "CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1, page_token => '1')"
       )
       .head()
-    assertThat(second.getString(7)).isEqualTo("second")
-    assertThat(second.isNullAt(10)).isTrue
+    assertThat(second.getString(6)).isEqualTo("second")
+    assertThat(second.isNullAt(8)).isTrue
   }
 
   test("create, replace, apply and idempotently drop table data policies") {
-    restCatalogServer.registerRowFilterPolicyCompiler("security.filter_region", rowFilterCompiler)
-    restCatalogServer.registerRowFilterPolicyCompiler(
-      "security.filter_region_v2",
-      rowFilterCompiler)
-    restCatalogServer.registerColumnMaskPolicyCompiler("security.mask_email", columnMaskCompiler)
     restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
     spark.sql(
       "INSERT OVERWRITE paimon.sales.orders VALUES " +
         "(1, 'APAC', 'apac@example.com'), (2, 'EMEA', 'emea@example.com')")
 
+    val apacFilter = stringEqualsPredicate(1, "region", "APAC")
+    val emeaFilter = stringEqualsPredicate(1, "region", "EMEA")
+    val emailMask = concatFieldTransform(1, "region", "-masked")
+
     checkAnswer(
-      spark.sql("""CALL sys.create_policy(
-                  |  database => 'sales',
-                  |  table => 'orders',
-                  |  policy_type => 'ROW_FILTER',
-                  |  principal => 'analyst',
-                  |  function_name => 'security.filter_region',
-                  |  function_arguments => array('column:region', 'constant:APAC'))
-                  |""".stripMargin),
+      spark.sql(s"""CALL sys.create_policy(
+                   |  database => 'sales',
+                   |  table => 'orders',
+                   |  policy_type => 'ROW_FILTER',
+                   |  principal => 'analyst',
+                   |  predicate_json => ${sqlLiteral(apacFilter)})
+                   |""".stripMargin),
       Row(true)
     )
 
-    val direct = spark
-      .sql("""CALL sys.list_policies(
-             |  database => 'sales',
-             |  table => 'orders',
-             |  policy_type => 'ROW_FILTER',
-             |  principal => 'analyst')
-             |""".stripMargin)
-      .head()
+    val listed = spark.sql("""CALL sys.list_policies(
+                             |  database => 'sales',
+                             |  table => 'orders',
+                             |  policy_type => 'ROW_FILTER',
+                             |  principal => 'analyst')
+                             |""".stripMargin)
+    assertThat(listed.columns).containsExactly(
+      "database",
+      "table",
+      "policy_type",
+      "principal",
+      "predicate_json",
+      "on_column",
+      "transform_json",
+      "next_page_token")
+    val direct = listed.head()
     assertThat(direct.getString(2)).isEqualTo("ROW_FILTER")
     assertThat(direct.getString(3)).isEqualTo("analyst")
-    assertThat(direct.getString(4)).isEqualTo("security.filter_region")
+    assertThat(direct.getString(4)).contains("\"name\":\"region\"")
     assertThat(direct.isNullAt(5)).isTrue
-    assertThat(direct.getString(6)).contains("\"column\":\"region\"")
+    assertThat(direct.isNullAt(6)).isTrue
     checkAnswer(
       spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
       Row(1, "APAC", "apac@example.com")
     )
 
     checkAnswer(
-      spark.sql("""CALL sys.create_or_replace_policy(
-                  |  database => 'sales',
-                  |  table => 'orders',
-                  |  policy_type => 'ROW_FILTER',
-                  |  principal => 'analyst',
-                  |  function_name => 'security.filter_region_v2',
-                  |  function_arguments => array('column:region', 'constant:EMEA'))
-                  |""".stripMargin),
+      spark.sql(s"""CALL sys.create_or_replace_policy(
+                   |  database => 'sales',
+                   |  table => 'orders',
+                   |  policy_type => 'ROW_FILTER',
+                   |  principal => 'analyst',
+                   |  predicate_json => ${sqlLiteral(emeaFilter)})
+                   |""".stripMargin),
       Row(true)
     )
     val replaced = spark
@@ -179,18 +190,17 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
              |  principal => 'analyst')
              |""".stripMargin)
       .head()
-    assertThat(replaced.getString(4)).isEqualTo("security.filter_region_v2")
+    assertThat(replaced.getString(4)).contains("EMEA")
 
     checkAnswer(
-      spark.sql("""CALL sys.create_policy(
-                  |  database => 'sales',
-                  |  table => 'orders',
-                  |  policy_type => 'COLUMN_MASKING',
-                  |  principal => 'analyst',
-                  |  function_name => 'security.mask_email',
-                  |  on_column => 'email',
-                  |  function_arguments => array('constant:****'))
-                  |""".stripMargin),
+      spark.sql(s"""CALL sys.create_policy(
+                   |  database => 'sales',
+                   |  table => 'orders',
+                   |  policy_type => 'COLUMN_MASKING',
+                   |  principal => 'analyst',
+                   |  on_column => 'email',
+                   |  transform_json => ${sqlLiteral(emailMask)})
+                   |""".stripMargin),
       Row(true)
     )
 
@@ -203,12 +213,17 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       .head()
     assertThat(mask.getString(2)).isEqualTo("COLUMN_MASKING")
     assertThat(mask.getString(3)).isEqualTo("analyst")
+    assertThat(mask.isNullAt(4)).isTrue
     assertThat(mask.getString(5)).isEqualTo("email")
-    assertThat(mask.getString(6)).contains("\"constant\":\"****\"")
+    assertThat(mask.getString(6)).contains("-masked")
 
     checkAnswer(
       spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
-      Row(2, "EMEA", "****")
+      Row(2, "EMEA", "EMEA-masked")
+    )
+    checkAnswer(
+      spark.sql("SELECT email FROM paimon.sales.orders"),
+      Row("EMEA-masked")
     )
     checkAnswer(
       spark.sql("""CALL sys.drop_policy(
@@ -245,66 +260,117 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
         "principal => 'analyst', column => 'email', if_exists => true)")
   }
 
-  test("policy creation validates query authorization, functions and columns") {
-    restCatalogServer.registerRowFilterPolicyFunction(
-      "security.valid_filter",
-      LeafPredicate.of(
-        new FieldTransform(new FieldRef(0, "id", DataTypes.INT())),
-        Equal.INSTANCE,
-        Collections.singletonList(Integer.valueOf(1)))
-    )
+  test("policy creation validates query authorization, JSON and columns") {
+    val validFilter = intEqualsPredicate(0, "id", 1)
     spark.sql("CREATE TABLE paimon.sales.disabled_orders (id INT)")
 
     val disabled = intercept[Exception] {
       spark
-        .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'disabled_orders',
-               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
-               |  principal => 'analyst')
-               |""".stripMargin)
+        .sql(s"""CALL sys.create_policy(
+                |  database => 'sales', table => 'disabled_orders',
+                |  policy_type => 'ROW_FILTER', predicate_json => ${sqlLiteral(validFilter)},
+                |  principal => 'analyst')
+                |""".stripMargin)
         .collect()
     }
     assertThat(disabled.getMessage).contains("query-auth.enabled=true")
 
-    val missingFunction = intercept[Exception] {
+    val malformed = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
                |  database => 'sales', table => 'orders',
-               |  policy_type => 'ROW_FILTER', function_name => 'security.missing',
+               |  policy_type => 'ROW_FILTER', predicate_json => '{bad',
                |  principal => 'analyst')
                |""".stripMargin)
         .collect()
     }
-    assertThat(missingFunction.getMessage).contains("does not exist")
+    assertThat(malformed.getMessage).contains("Unexpected character")
 
+    val unknownColumnFilter = stringEqualsPredicate(0, "unknown", "APAC")
     val missingColumn = intercept[Exception] {
       spark
-        .sql("""CALL sys.create_policy(
-               |  database => 'sales', table => 'orders',
-               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
-               |  function_arguments => array('column:unknown'),
-               |  principal => 'analyst')
-               |""".stripMargin)
+        .sql(s"""CALL sys.create_policy(
+                |  database => 'sales', table => 'orders',
+                |  policy_type => 'ROW_FILTER', predicate_json => ${sqlLiteral(unknownColumnFilter)},
+                |  principal => 'analyst')
+                |""".stripMargin)
         .collect()
     }
-    assertThat(missingColumn.getMessage).contains("does not exist")
+    assertThat(missingColumn.getMessage).contains("column unknown")
 
     val missingPrincipal = intercept[Exception] {
+      spark
+        .sql(s"""CALL sys.create_policy(
+                |  database => 'sales', table => 'orders',
+                |  policy_type => 'ROW_FILTER', predicate_json => ${sqlLiteral(validFilter)},
+                |  principal => 'missing')
+                |""".stripMargin)
+        .collect()
+    }
+    assertThat(missingPrincipal.getMessage).contains("principal does not exist")
+
+    val jsonNull = intercept[Exception] {
       spark
         .sql("""CALL sys.create_policy(
                |  database => 'sales', table => 'orders',
-               |  policy_type => 'ROW_FILTER', function_name => 'security.valid_filter',
-               |  principal => 'missing')
+               |  policy_type => 'ROW_FILTER', predicate_json => 'null',
+               |  principal => 'analyst')
                |""".stripMargin)
         .collect()
     }
-    assertThat(missingPrincipal.getMessage).contains("principal does not exist")
+    assertThat(jsonNull.getMessage).contains("JSON null")
+
+    val mixedDefinition = intercept[Exception] {
+      spark
+        .sql(s"""CALL sys.create_policy(
+                |  database => 'sales', table => 'orders',
+                |  policy_type => 'ROW_FILTER', predicate_json => ${sqlLiteral(validFilter)},
+                |  transform_json => ${sqlLiteral(constantStringTransform("****"))},
+                |  principal => 'analyst')
+                |""".stripMargin)
+        .collect()
+    }
+    assertThat(mixedDefinition.getMessage).contains("cannot specify transform")
+  }
+
+  test("list policies supports opaque pagination tokens") {
+    val filter = intEqualsPredicate(0, "id", 1)
+    Seq("first", "second").foreach {
+      principal =>
+        checkAnswer(
+          spark.sql(s"""CALL sys.create_policy(
+                       |  database => 'sales', table => 'orders',
+                       |  policy_type => 'ROW_FILTER', principal => '$principal',
+                       |  predicate_json => ${sqlLiteral(filter)})
+                       |""".stripMargin),
+          Row(true)
+        )
+    }
+    try {
+      val first = spark
+        .sql("CALL sys.list_policies(database => 'sales', table => 'orders', max_results => 1)")
+        .head()
+      assertThat(first.getString(3)).isEqualTo("first")
+      assertThat(first.getString(7)).isEqualTo("1")
+
+      val second = spark
+        .sql(
+          "CALL sys.list_policies(database => 'sales', table => 'orders', " +
+            "max_results => 1, page_token => '1')")
+        .head()
+      assertThat(second.getString(3)).isEqualTo("second")
+      assertThat(second.isNullAt(7)).isTrue
+    } finally {
+      Seq("first", "second").foreach {
+        principal =>
+          spark.sql(
+            "CALL sys.drop_policy(database => 'sales', table => 'orders', " +
+              s"policy_type => 'ROW_FILTER', principal => '$principal', if_exists => true)")
+      }
+    }
   }
 
   test("table lifecycle preserves policy enforcement and rejects unsafe schema changes") {
-    restCatalogServer.registerRowFilterPolicyCompiler(
-      "security.lifecycle_filter",
-      rowFilterCompiler)
     restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
     spark.sql("""CREATE TABLE paimon.sales.lifecycle_orders (
                 |  id INT,
@@ -312,13 +378,13 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
                 |TBLPROPERTIES ('query-auth.enabled' = 'true')
                 |""".stripMargin)
     spark.sql("INSERT INTO paimon.sales.lifecycle_orders VALUES (1, 'APAC'), (2, 'EMEA')")
+    val lifecycleFilter = stringEqualsPredicate(1, "region", "APAC")
     checkAnswer(
-      spark.sql("""CALL sys.create_policy(
-                  |  database => 'sales', table => 'lifecycle_orders',
-                  |  policy_type => 'ROW_FILTER', function_name => 'security.lifecycle_filter',
-                  |  function_arguments => array('column:region', 'constant:APAC'),
-                  |  principal => 'analyst')
-                  |""".stripMargin),
+      spark.sql(s"""CALL sys.create_policy(
+                   |  database => 'sales', table => 'lifecycle_orders',
+                   |  policy_type => 'ROW_FILTER', predicate_json => ${sqlLiteral(lifecycleFilter)},
+                   |  principal => 'analyst')
+                   |""".stripMargin),
       Row(true)
     )
 
@@ -347,7 +413,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
         .sql("ALTER TABLE paimon.sales.renamed_orders RENAME COLUMN region TO area")
         .collect()
     }
-    assertThat(renameColumn.getMessage).contains("policy argument column region")
+    assertThat(renameColumn.getMessage).contains("column region")
 
     spark.sql("DROP TABLE paimon.sales.renamed_orders")
     spark.sql("""CREATE TABLE paimon.sales.renamed_orders (
@@ -399,92 +465,46 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     }
   }
 
-  test("include inherited permissions resolves only resource ancestry") {
-    grantCatalogPermission("reader")
-
-    checkAnswer(
-      spark.sql("""CALL sys.grant_permission(
-                  |  resource_type => 'CATALOG',
-                  |  scope => 'DESCENDANTS',
-                  |  access => 'EXECUTE',
-                  |  principal => 'function_reader')
-                  |""".stripMargin),
-      Row(true)
-    )
-
-    checkAnswer(
-      spark.sql("""CALL sys.list_permissions(
-                  |  resource_type => 'TABLE',
-                  |  database => 'sales',
-                  |  table => 'orders',
-                  |  principal => 'reader')
-                  |""".stripMargin),
-      Nil
-    )
-
-    val inherited = spark
-      .sql("""CALL sys.list_permissions(
-             |  resource_type => 'TABLE',
-             |  database => 'sales',
-             |  table => 'orders',
-             |  scope => 'SELF',
-             |  principal => 'reader',
-             |  include_inherited => true)
-             |""".stripMargin)
-      .head()
-    assertThat(inherited.getString(0)).isEqualTo("TABLE")
-    assertThat(inherited.getString(1)).isEqualTo("SELF")
-    assertThat(inherited.getString(9)).contains("\"type\":\"CATALOG\"")
-
-    checkAnswer(
-      spark.sql("""CALL sys.list_permissions(
-                  |  resource_type => 'TABLE',
-                  |  database => 'sales',
-                  |  table => 'orders',
-                  |  principal => 'function_reader',
-                  |  include_inherited => true)
-                  |""".stripMargin),
-      Nil
-    )
-  }
-
   private def grantCatalogPermission(principal: String): Unit = {
     checkAnswer(
       spark.sql(s"""CALL sys.grant_permission(
                    |  resource_type => 'CATALOG',
-                   |  scope => 'DESCENDANTS',
-                   |  access => 'SELECT',
+                   |  access => 'USE_CATALOG',
                    |  principal => '$principal')
                    |""".stripMargin),
       Row(true)
     )
   }
 
-  private val rowFilterCompiler = new BiFunction[TableSchema, RowFilter, Predicate] {
-    override def apply(schema: TableSchema, filter: RowFilter): Predicate = {
-      val arguments = filter.getFunctionArguments
-      require(arguments.size() == 2)
-      val column = arguments.get(0).getColumn
-      val constant = arguments.get(1).getConstant
-      require(column != null && constant != null)
-      val index = schema.fieldNames().indexOf(column)
-      require(index >= 0)
+  private def stringEqualsPredicate(index: Int, column: String, constant: String): String = {
+    JsonSerdeUtil.toFlatJson(
       LeafPredicate.of(
-        new FieldTransform(new FieldRef(index, column, schema.fields().get(index).`type`())),
+        new FieldTransform(new FieldRef(index, column, DataTypes.STRING())),
         Equal.INSTANCE,
-        Collections.singletonList(BinaryString.fromString(constant))
-      )
-    }
+        Collections.singletonList(BinaryString.fromString(constant))))
   }
 
-  private val columnMaskCompiler = new BiFunction[TableSchema, ColumnMask, Transform] {
-    override def apply(schema: TableSchema, mask: ColumnMask): Transform = {
-      val arguments = mask.getFunctionArguments
-      require(schema.fieldNames().contains(mask.getOnColumn))
-      require(arguments.size() == 1 && arguments.get(0).getConstant != null)
-      new ConcatTransform(
-        Collections.singletonList(BinaryString.fromString(arguments.get(0).getConstant)))
-    }
+  private def intEqualsPredicate(index: Int, column: String, constant: Int): String = {
+    JsonSerdeUtil.toFlatJson(
+      LeafPredicate.of(
+        new FieldTransform(new FieldRef(index, column, DataTypes.INT())),
+        Equal.INSTANCE,
+        Collections.singletonList(Integer.valueOf(constant))))
+  }
+
+  private def constantStringTransform(constant: String): String = {
+    JsonSerdeUtil.toFlatJson(
+      new ConcatTransform(Collections.singletonList(BinaryString.fromString(constant))))
+  }
+
+  private def concatFieldTransform(index: Int, column: String, suffix: String): String = {
+    JsonSerdeUtil.toFlatJson(
+      new ConcatTransform(Arrays
+        .asList(new FieldRef(index, column, DataTypes.STRING()), BinaryString.fromString(suffix))))
+  }
+
+  private def sqlLiteral(value: String): String = {
+    "'" + value.replace("'", "''") + "'"
   }
 }
 

From 06f798d03e4cc22dcc250fdd625a3b0e969401f2 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 23:17:43 +0800
Subject: [PATCH 07/12] [api][spark] Align access model and add column
 permissions

---
 docs/docs/concepts/rest/management-api.md     | 147 ++++++++++--
 docs/scripts/validate-rest-openapi.js         | 117 ++++++---
 docs/static/rest-management-open-api.yaml     | 129 +++++++---
 .../paimon/management/PermissionAccess.java   |  74 +++---
 .../management/PermissionAssignment.java      |  43 +++-
 .../paimon/management/PermissionColumns.java  | 124 ++++++++++
 .../paimon/management/PermissionIdentity.java |  76 ------
 .../management/PermissionManagement.java      |   2 +-
 .../paimon/management/PermissionResource.java |   8 +-
 .../paimon/management/PolicyIdentity.java     |  89 -------
 .../paimon/management/PolicyManagement.java   |   9 +-
 .../paimon/management/ResourceType.java       |   1 +
 .../java/org/apache/paimon/rest/RESTApi.java  |  21 +-
 .../paimon/rest/RESTPermissionManagement.java |   6 +-
 .../paimon/rest/RESTPolicyManagement.java     |  14 +-
 .../rest/requests/DropPolicyRequest.java      |  40 +++-
 .../rest/requests/GrantPermissionRequest.java |  21 +-
 .../requests/RevokePermissionRequest.java     |  25 +-
 .../PermissionManagementJsonTest.java         | 223 +++++++++++++++---
 .../rest/RESTPermissionManagementTest.java    |  35 ++-
 .../paimon/rest/RESTPolicyManagementTest.java |  26 +-
 .../org/apache/paimon/rest/PolicyKey.java     |   8 +-
 .../apache/paimon/rest/RESTCatalogServer.java |  72 +++++-
 .../rest/RESTColumnPermissionSupport.java     | 135 +++++++++++
 .../paimon/rest/RESTPermissionStore.java      |  48 +++-
 .../paimon/rest/RESTPermissionStoreTest.java  |  42 +++-
 .../procedure/BasePermissionProcedure.java    |  16 +-
 .../spark/procedure/BasePolicyProcedure.java  |  10 -
 .../spark/procedure/DropPolicyProcedure.java  |  17 +-
 .../procedure/GrantPermissionProcedure.java   |  38 ++-
 .../procedure/ListPermissionsProcedure.java   |  16 ++
 .../procedure/RevokePermissionProcedure.java  |  10 +-
 .../procedure/PermissionProcedureTest.scala   | 123 +++++++++-
 33 files changed, 1317 insertions(+), 448 deletions(-)
 create mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionColumns.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
 delete mode 100644 paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
 create mode 100644 paimon-core/src/test/java/org/apache/paimon/rest/RESTColumnPermissionSupport.java

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index b63938c067a7..14e170f8e6a6 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -80,6 +80,7 @@ Permission resources are structured objects:
 | `CATALOG` | none | `{"type":"CATALOG"}` |
 | `DATABASE` | `database` | `{"type":"DATABASE","database":"sales"}` |
 | `TABLE` | `database`, `table` | `{"type":"TABLE","database":"sales","table":"orders"}` |
+| `COLUMN` | `database`, `table` | `{"type":"COLUMN","database":"sales","table":"orders"}` |
 | `FUNCTION` | `database`, `function` | `{"type":"FUNCTION","database":"sales","function":"calculate_tax"}` |
 | `VIEW` | `database`, `view` | `{"type":"VIEW","database":"sales","view":"daily_orders"}` |
 
@@ -90,25 +91,84 @@ server responsibilities. Access values are limited to 32 characters and principa
 characters. An implementation may resolve wire locators and principals to different stable
 persistence identifiers; those internal ids are not exposed by this API.
 
-Built-in accesses are resource-specific:
+The built-in accesses use a common data-authorization vocabulary. Creation accesses intentionally
+use their persisted names without underscores:
 
-| Resource | Accesses |
+| Access | Meaning |
 | --- | --- |
-| `CATALOG` | `USE_CATALOG`, `CREATE_DATABASE`, `MANAGE_PERMISSIONS` |
-| `DATABASE` | `USE_DATABASE`, `CREATE_TABLE`, `CREATE_VIEW`, `CREATE_FUNCTION`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
-| `TABLE` | `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
-| `VIEW` | `SELECT`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
-| `FUNCTION` | `EXECUTE`, `ALTER`, `DROP`, `MANAGE_PERMISSIONS` |
+| `ALL` | All accesses applicable to the resource. |
+| `CREATEDATABASE` | Create a database in a catalog. |
+| `DESCRIBE` | Read database metadata or select the current database. |
+| `ALTER` | Modify resource metadata. |
+| `DROP` | Drop the resource. |
+| `CREATETABLE` | Create a table in a database. |
+| `CREATEFUNCTION` | Create a function in a database. |
+| `CREATEVIEW` | Create a view in a database. |
+| `LIST` | List resources in a database. |
+| `SELECT` | Read table or view data, or use a function. |
+| `UPDATE` | Write table data, including insert, update, and delete operations. |
+| `GRANT` | Grant or revoke assignments on the resource. |
 
 Java and Spark helpers accept access names case-insensitively and normalize them before sending.
-The REST wire format uses upper case. Implementations may add namespaced accesses such as
-`VENDOR.EXAMPLE/SOME_ACCESS`; unknown unnamespaced accesses are rejected.
+The REST wire format uses upper case. Built-in accesses are resource-specific:
+
+| Resource | Accesses |
+| --- | --- |
+| `CATALOG` | `ALL`, `ALTER`, `DROP`, `GRANT`, `CREATEDATABASE` |
+| `DATABASE` | `ALL`, `DESCRIBE`, `ALTER`, `DROP`, `GRANT`, `CREATETABLE`, `CREATEVIEW`, `CREATEFUNCTION`, `LIST` |
+| `TABLE` | `ALL`, `SELECT`, `UPDATE`, `ALTER`, `DROP`, `GRANT` |
+| `COLUMN` | `SELECT` |
+| `VIEW` | `ALL`, `SELECT`, `ALTER`, `DROP`, `GRANT` |
+| `FUNCTION` | `ALL`, `SELECT`, `ALTER`, `DROP`, `GRANT` |
 
 An assignment identity is `resource`, `access`, and `principal`. Granting the same identity replaces
 its expiry, and revocation is idempotent. Assignments apply only to the exact referenced resource;
 resource inheritance is not part of this experimental contract. Resolving group membership and role
 inheritance remains a server responsibility.
 
+### Column permissions
+
+A column permission uses a `COLUMN` resource whose locator is the containing table, `SELECT`
+access, and one `columns` object. Exactly one non-empty list is allowed:
+
+- `columnNames` is an allowlist. Only the named top-level columns are readable.
+- `excludedColumnNames` is a denylist. Every current top-level column except the named columns is
+  readable.
+
+For example, this assignment allows only `order_id` and `region`:
+
+```json
+{
+  "resource": {
+    "type": "COLUMN",
+    "database": "sales",
+    "table": "orders"
+  },
+  "access": "SELECT",
+  "principal": "role:analyst",
+  "columns": {
+    "columnNames": ["order_id", "region"]
+  }
+}
+```
+
+The assignment identity remains `(resource, access, principal)`; `columns` is not part of the
+identity. Granting the same identity replaces the entire previous allowlist or denylist rather than
+merging individual names. Revocation therefore omits `columns` and removes the whole column
+assignment.
+
+All named columns must exist when granted, and the table must enforce query authorization. A server
+may enable `query-auth.enabled` atomically with the grant; otherwise it must reject the grant. Column
+names refer only to top-level fields. For every effective caller principal, applicable column ranges
+are intersected. If any applicable range rejects a selected column, the query fails rather than
+silently dropping that column.
+
+Schema evolution keeps the assignment attached to the stable table identity. Renaming a referenced
+column updates its stored name. Dropping a referenced column removes it from the range; if that
+would leave the stored list empty, the assignment is removed. An allowlist denies columns added
+later, while a denylist allows them, so allowlists are safer when new columns may contain sensitive
+data.
+
 `expireTime`, when present, is an exclusive upper bound evaluated against the REST server clock.
 At `now >= expireTime`, the assignment must not authorize access. Expired direct assignments may
 remain visible in listings until server cleanup. Timestamps must not be more precise than
@@ -174,23 +234,23 @@ The following examples assume a Spark catalog named `paimon`. Replace it with th
 
 `grant_permission` returns one row with `result = true` when the server accepts the assignment.
 
-Grant catalog access:
+Grant permission to create databases in the catalog:
 
 ```sql
 CALL paimon.sys.grant_permission(
   resource_type => 'CATALOG',
-  access => 'USE_CATALOG',
+  access => 'CREATEDATABASE',
   principal => 'role:catalog_user'
 );
 ```
 
-Grant a database privilege with an optional expiration time:
+Grant permission to create views in a database with an optional expiration time:
 
 ```sql
 CALL paimon.sys.grant_permission(
   resource_type => 'DATABASE',
   database => 'sales',
-  access => 'CREATE_TABLE',
+  access => 'CREATEVIEW',
   principal => 'role:data_engineer',
   expire_time => '2027-01-01T00:00:00Z'
 );
@@ -211,7 +271,7 @@ CALL paimon.sys.grant_permission(
   resource_type => 'FUNCTION',
   database => 'sales',
   function => 'calculate_tax',
-  access => 'EXECUTE',
+  access => 'SELECT',
   principal => 'role:analyst'
 );
 
@@ -224,6 +284,37 @@ CALL paimon.sys.grant_permission(
 );
 ```
 
+Grant access to selected columns. This requires table query authorization; named arguments are
+recommended because the two column range modes are mutually exclusive:
+
+```sql
+ALTER TABLE paimon.sales.orders
+SET TBLPROPERTIES ('query-auth.enabled' = 'true');
+
+CALL paimon.sys.grant_permission(
+  resource_type => 'COLUMN',
+  database => 'sales',
+  table => 'orders',
+  access => 'SELECT',
+  principal => 'role:analyst',
+  column_names => array('order_id', 'region')
+);
+```
+
+Use `excluded_column_names` for a denylist. Repeating the grant replaces the preceding allowlist in
+one operation:
+
+```sql
+CALL paimon.sys.grant_permission(
+  resource_type => 'COLUMN',
+  database => 'sales',
+  table => 'orders',
+  access => 'SELECT',
+  principal => 'role:analyst',
+  excluded_column_names => array('email', 'phone_number')
+);
+```
+
 ### List permissions
 
 `list_permissions` always addresses one exact resource. Omit optional filters to list every direct
@@ -249,6 +340,20 @@ CALL paimon.sys.list_permissions(
 );
 ```
 
+List the column range attached to a principal. The result exposes `column_names` and
+`excluded_column_names` as `ARRAY<STRING>` columns, with exactly one populated for a `COLUMN`
+assignment:
+
+```sql
+CALL paimon.sys.list_permissions(
+  resource_type => 'COLUMN',
+  database => 'sales',
+  table => 'orders',
+  principal => 'role:analyst',
+  access => 'SELECT'
+);
+```
+
 The `next_page_token` output is opaque; pass it back unchanged with the same filters:
 
 ```sql
@@ -277,6 +382,18 @@ CALL paimon.sys.revoke_permission(
 
 Repeating the same call succeeds even when the assignment is already absent.
 
+Column revocation uses the containing table identity and removes the complete range:
+
+```sql
+CALL paimon.sys.revoke_permission(
+  resource_type => 'COLUMN',
+  database => 'sales',
+  table => 'orders',
+  access => 'SELECT',
+  principal => 'role:analyst'
+);
+```
+
 ### Create row-filter policies
 
 Before attaching any policy, enable table query authorization:
@@ -426,5 +543,5 @@ CALL paimon.sys.drop_policy(
 ```
 
 Creating, replacing, dropping, or inspecting permissions and policies requires the server to
-authorize the caller for `MANAGE_PERMISSIONS` on the relevant resource. Authentication, principal
+authorize the caller for `GRANT` on the relevant resource. Authentication, principal
 membership, policy persistence, schema validation, and audit logging remain REST server concerns.
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index 0276af2d21cc..ca9e984bb5e0 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -351,6 +351,7 @@ function validateManagementOpenApi() {
       '503',
     ]),
   );
+  contract.requireResponses('grantPermission', ['409']);
   ['listTablePolicies', 'createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
     contract.requireResponses(operationId, [
       '200',
@@ -382,13 +383,14 @@ function validateManagementOpenApi() {
     'The management contract must be versioned 1.0 and marked experimental',
   );
 
-  const assignmentFields = ['resource', 'access', 'principal', 'expireTime'];
+  const assignmentFields = ['resource', 'access', 'principal', 'columns', 'expireTime'];
   contract.requireProperties('PermissionAssignment', assignmentFields);
   contract.requireRequiredProperties('PermissionAssignment', ['resource', 'access', 'principal']);
   const grantProperties = contract.requireProperties('GrantPermissionRequest', [
     'resource',
     'access',
     'principal',
+    'columns',
     'expireTime',
   ]);
   contract.requireRequiredProperties('GrantPermissionRequest', [
@@ -396,7 +398,7 @@ function validateManagementOpenApi() {
     'access',
     'principal',
   ]);
-  ['columns', 'policy', 'grantOption'].forEach((field) =>
+  ['policy', 'grantOption'].forEach((field) =>
     contract.checkSpec(
       !grantProperties[field],
       `Schema GrantPermissionRequest must omit field: ${field}`,
@@ -454,45 +456,40 @@ function validateManagementOpenApi() {
       '#/components/schemas/Principal',
     'PrincipalQuery must reference Principal',
   );
-  requireExactEnum(contract, 'ResourceType', ['CATALOG', 'DATABASE', 'TABLE', 'FUNCTION', 'VIEW']);
+  requireExactEnum(contract, 'ResourceType', [
+    'CATALOG',
+    'DATABASE',
+    'TABLE',
+    'COLUMN',
+    'FUNCTION',
+    'VIEW',
+  ]);
   requireExactEnum(contract, 'PolicyType', ['ROW_FILTER', 'COLUMN_MASKING']);
 
-  const accessAlternatives = contract.schema('PermissionAccess').oneOf || [];
-  const builtInAccess = accessAlternatives.find((alternative) => alternative.enum);
-  const extensionAccess = accessAlternatives.find((alternative) => alternative.pattern);
+  const permissionAccess = contract.schema('PermissionAccess');
   const expectedAccesses = [
-    'USE_CATALOG',
-    'CREATE_DATABASE',
-    'USE_DATABASE',
-    'CREATE_TABLE',
-    'CREATE_VIEW',
-    'CREATE_FUNCTION',
-    'SELECT',
-    'INSERT',
-    'UPDATE',
-    'DELETE',
+    'ALL',
+    'CREATEDATABASE',
+    'DESCRIBE',
     'ALTER',
     'DROP',
-    'EXECUTE',
-    'MANAGE_PERMISSIONS',
+    'CREATETABLE',
+    'CREATEFUNCTION',
+    'CREATEVIEW',
+    'LIST',
+    'SELECT',
+    'UPDATE',
+    'GRANT',
   ];
   contract.checkSpec(
-    builtInAccess &&
-      builtInAccess.enum.length === expectedAccesses.length &&
-      expectedAccesses.every((access) => builtInAccess.enum.includes(access)),
-    'PermissionAccess must define the complete built-in access enum',
-  );
-  const extensionPattern = extensionAccess && new RegExp(extensionAccess.pattern);
-  contract.checkSpec(
-    extensionPattern &&
-      extensionPattern.test('VENDOR.EXAMPLE/SOME_ACCESS') &&
-      !extensionPattern.test('UNKNOWN') &&
-      !extensionPattern.test('vendor.example/SOME_ACCESS'),
-    'PermissionAccess must accept only canonical upper-case namespaced extensions',
+    permissionAccess.type === 'string' &&
+      permissionAccess.enum.length === expectedAccesses.length &&
+      expectedAccesses.every((access) => permissionAccess.enum.includes(access)),
+    'PermissionAccess must define the complete data access enum',
   );
   contract.checkSpec(
-    accessAlternatives.every((alternative) => alternative.maxLength === 32),
-    'Every PermissionAccess alternative must fit the 32-character persistence field',
+    permissionAccess.maxLength === 32,
+    'PermissionAccess must fit the 32-character persistence field',
   );
   ['PermissionAssignment', 'GrantPermissionRequest', 'RevokePermissionRequest'].forEach(
     (schemaName) =>
@@ -507,6 +504,62 @@ function validateManagementOpenApi() {
       '#/components/schemas/PermissionAccess',
     'AccessQuery must reference PermissionAccess',
   );
+  contract.requireSchemaReference('PermissionResource', 'oneOf', 'ColumnResource');
+  const columnResource = contract.requireProperties('ColumnResource', [
+    'type',
+    'database',
+    'table',
+  ]);
+  contract.requireRequiredProperties('ColumnResource', ['type', 'database', 'table']);
+  contract.checkSpec(
+    columnResource.type.const === 'COLUMN',
+    'ColumnResource must use the COLUMN discriminator',
+  );
+  const permissionColumns = contract.requireProperties('PermissionColumns', [
+    'columnNames',
+    'excludedColumnNames',
+  ]);
+  const permissionColumnsDescription = contract
+    .schema('PermissionColumns')
+    .description.toLowerCase()
+    .replace(/\s+/g, ' ');
+  ['intersected', 'fails the query', 'query authorization'].forEach((phrase) =>
+    contract.checkSpec(
+      permissionColumnsDescription.includes(phrase),
+      `PermissionColumns semantics are missing: ${phrase}`,
+    ),
+  );
+  ['columnNames', 'excludedColumnNames'].forEach((field) => {
+    const definition = permissionColumns[field];
+    contract.checkSpec(
+      definition.type === 'array' &&
+        definition.minItems === 1 &&
+        definition.uniqueItems === true &&
+        definition.items.type === 'string' &&
+        definition.items.minLength === 1,
+      `PermissionColumns.${field} must be a non-empty unique string array`,
+    );
+  });
+  const columnAlternatives = contract.schema('PermissionColumns').oneOf || [];
+  ['columnNames', 'excludedColumnNames'].forEach((field) =>
+    contract.checkSpec(
+      columnAlternatives.some(
+        (alternative) =>
+          alternative.required &&
+          alternative.required.length === 1 &&
+          alternative.required[0] === field,
+      ),
+      `PermissionColumns must define the ${field} alternative`,
+    ),
+  );
+  ['PermissionAssignment', 'GrantPermissionRequest'].forEach((schemaName) => {
+    const properties = contract.requireProperties(schemaName, ['columns']);
+    contract.checkSpec(
+      properties.columns.$ref === '#/components/schemas/PermissionColumns',
+      `${schemaName}.columns must reference PermissionColumns`,
+    );
+    contract.requireSchemaReference(schemaName, 'allOf', 'ColumnAssignmentConstraint');
+  });
   ['DatabaseQuery', 'TableQuery', 'FunctionQuery', 'ViewQuery'].forEach((parameterName) => {
     const locatorQuery = contract.spec.components.parameters[parameterName];
     contract.checkSpec(
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index 1581b1fdacbb..e94f8e78e69d 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -19,8 +19,9 @@ info:
   title: Paimon REST Management API
   version: "1.0"
   description: |
-    Experimental control-plane extension for permissions, table row filters, and table column
-    masks in one Paimon REST Catalog prefix. A data policy restricts an already-authorized read;
+    Experimental control-plane extension for object and column permissions, table row filters, and
+    table column masks in one Paimon REST Catalog prefix. A data policy restricts an
+    already-authorized read;
     it never grants SELECT by itself. Each policy is attached to one principal: a principal has at
     most one row filter per table and at most one mask per table column. Policy creation and
     replacement are accepted only when the target table exists, has `query-auth.enabled=true`, and
@@ -87,8 +88,9 @@ paths:
       operationId: grantPermission
       description: |
         Creates an assignment or replaces the assignment with the same `resource`, `access`, and
-        `principal`. The referenced resource and principal must exist. Servers bind assignments to
-        the resource lifecycle described by `PermissionResource`.
+        `principal`. For a `COLUMN` assignment this replaces the whole included or excluded column
+        range. The referenced resource, principal, and columns must exist. Servers bind assignments
+        to the resource lifecycle described by `PermissionResource`.
       requestBody:
         required: true
         content:
@@ -106,6 +108,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '409':
+          $ref: '#/components/responses/Conflict'
         '429':
           $ref: '#/components/responses/TooManyRequests'
         '500':
@@ -442,32 +446,28 @@ components:
   schemas:
     ResourceType:
       type: string
-      enum: [CATALOG, DATABASE, TABLE, FUNCTION, VIEW]
+      enum: [CATALOG, DATABASE, TABLE, COLUMN, FUNCTION, VIEW]
     PermissionAccess:
       description: |
-        Canonical access value. The REST wire format uses upper case. Values are either a built-in
-        access or a namespaced server extension.
-      oneOf:
-        - type: string
-          maxLength: 32
-          enum:
-            - USE_CATALOG
-            - CREATE_DATABASE
-            - USE_DATABASE
-            - CREATE_TABLE
-            - CREATE_VIEW
-            - CREATE_FUNCTION
-            - SELECT
-            - INSERT
-            - UPDATE
-            - DELETE
-            - ALTER
-            - DROP
-            - EXECUTE
-            - MANAGE_PERMISSIONS
-        - type: string
-          maxLength: 32
-          pattern: '^[A-Z0-9][A-Z0-9._-]*/[A-Z0-9][A-Z0-9._-]*$'
+        Canonical data access value. The REST wire format uses upper case and creation accesses
+        follow their persisted names without underscores. UPDATE covers table writes, including
+        inserts and deletes. SELECT also covers function use. GRANT allows granting and revoking
+        assignments on the resource. The server validates applicability to the resource type.
+      type: string
+      maxLength: 32
+      enum:
+        - ALL
+        - CREATEDATABASE
+        - DESCRIBE
+        - ALTER
+        - DROP
+        - CREATETABLE
+        - CREATEFUNCTION
+        - CREATEVIEW
+        - LIST
+        - SELECT
+        - UPDATE
+        - GRANT
     PolicyType:
       type: string
       enum: [ROW_FILTER, COLUMN_MASKING]
@@ -489,6 +489,7 @@ components:
         - $ref: '#/components/schemas/CatalogResource'
         - $ref: '#/components/schemas/DatabaseResource'
         - $ref: '#/components/schemas/TableResource'
+        - $ref: '#/components/schemas/ColumnResource'
         - $ref: '#/components/schemas/FunctionResource'
         - $ref: '#/components/schemas/ViewResource'
       discriminator:
@@ -497,6 +498,7 @@ components:
           CATALOG: '#/components/schemas/CatalogResource'
           DATABASE: '#/components/schemas/DatabaseResource'
           TABLE: '#/components/schemas/TableResource'
+          COLUMN: '#/components/schemas/ColumnResource'
           FUNCTION: '#/components/schemas/FunctionResource'
           VIEW: '#/components/schemas/ViewResource'
     CatalogResource:
@@ -529,6 +531,22 @@ components:
         table:
           type: string
           minLength: 1
+    ColumnResource:
+      type: object
+      additionalProperties: false
+      description: |
+        Column permission target. The resource identity is the containing table; the mutable column
+        range is carried by `PermissionAssignment.columns` and is not part of the identity.
+      required: [type, database, table]
+      properties:
+        type:
+          const: COLUMN
+        database:
+          type: string
+          minLength: 1
+        table:
+          type: string
+          minLength: 1
     FunctionResource:
       type: object
       additionalProperties: false
@@ -558,6 +576,10 @@ components:
     PermissionAssignment:
       type: object
       additionalProperties: false
+      description: |
+        Direct assignment identity is `resource`, `access`, and `principal`. `columns` is required
+        only for a COLUMN assignment and is replaced as one value when the same identity is granted
+        again.
       required: [resource, access, principal]
       properties:
         resource:
@@ -566,6 +588,8 @@ components:
           $ref: '#/components/schemas/PermissionAccess'
         principal:
           $ref: '#/components/schemas/Principal'
+        columns:
+          $ref: '#/components/schemas/PermissionColumns'
         expireTime:
           type: string
           format: date-time
@@ -573,6 +597,8 @@ components:
             Exclusive authorization upper bound evaluated using the server clock. At
             `now >= expireTime` this assignment must not authorize access. An expired record may
             remain listable until cleanup. The value must have at most millisecond precision.
+      allOf:
+        - $ref: '#/components/schemas/ColumnAssignmentConstraint'
     GrantPermissionRequest:
       type: object
       additionalProperties: false
@@ -584,6 +610,8 @@ components:
           $ref: '#/components/schemas/PermissionAccess'
         principal:
           $ref: '#/components/schemas/Principal'
+        columns:
+          $ref: '#/components/schemas/PermissionColumns'
         expireTime:
           type: string
           format: date-time
@@ -591,6 +619,51 @@ components:
             Exclusive authorization upper bound evaluated using the server clock. At
             `now >= expireTime` the assignment must not authorize access. The value must have at
             most millisecond precision.
+      allOf:
+        - $ref: '#/components/schemas/ColumnAssignmentConstraint'
+    PermissionColumns:
+      type: object
+      additionalProperties: false
+      description: |
+        Exactly one non-empty list of top-level table column names. `columnNames` is an allowlist;
+        `excludedColumnNames` grants every current table column except the listed denylist. Column
+        names must exist when granted. An allowlist denies columns added later, while a denylist
+        allows columns added later. All applicable column ranges are intersected, and selecting any
+        column outside the effective range fails the query. The target table must enforce query
+        authorization before the grant becomes visible.
+      properties:
+        columnNames:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            type: string
+            minLength: 1
+        excludedColumnNames:
+          type: array
+          minItems: 1
+          uniqueItems: true
+          items:
+            type: string
+            minLength: 1
+      oneOf:
+        - required: [columnNames]
+        - required: [excludedColumnNames]
+    ColumnAssignmentConstraint:
+      if:
+        properties:
+          resource:
+            type: object
+            required: [type]
+            properties:
+              type:
+                const: COLUMN
+        required: [resource]
+      then:
+        required: [columns]
+      else:
+        not:
+          required: [columns]
     RevokePermissionRequest:
       type: object
       additionalProperties: false
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
index 2721f742bcf0..d0c818350b55 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
@@ -27,39 +27,30 @@
 import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
-import java.util.regex.Pattern;
 
 import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/**
- * Built-in access names and validation for permission assignments.
- *
- * <p>Java callers may use any letter case. Values are canonicalized to the upper-case REST wire
- * representation; server extensions must use the namespaced {@code NAMESPACE/ACCESS} form.
- */
+/** Built-in access names and validation for permission assignments. */
 @Experimental
 public final class PermissionAccess {
 
     /** Maximum wire length supported by the portable permission storage contract. */
     public static final int MAX_LENGTH = 32;
 
-    public static final String USE_CATALOG = "USE_CATALOG";
-    public static final String CREATE_DATABASE = "CREATE_DATABASE";
-    public static final String USE_DATABASE = "USE_DATABASE";
-    public static final String CREATE_TABLE = "CREATE_TABLE";
-    public static final String CREATE_VIEW = "CREATE_VIEW";
-    public static final String CREATE_FUNCTION = "CREATE_FUNCTION";
-    public static final String SELECT = "SELECT";
-    public static final String INSERT = "INSERT";
-    public static final String UPDATE = "UPDATE";
-    public static final String DELETE = "DELETE";
+    public static final String ALL = "ALL";
+    public static final String CREATEDATABASE = "CREATEDATABASE";
+    public static final String DESCRIBE = "DESCRIBE";
     public static final String ALTER = "ALTER";
     public static final String DROP = "DROP";
-    public static final String EXECUTE = "EXECUTE";
-    public static final String MANAGE_PERMISSIONS = "MANAGE_PERMISSIONS";
+    public static final String CREATETABLE = "CREATETABLE";
+    public static final String CREATEFUNCTION = "CREATEFUNCTION";
+    public static final String CREATEVIEW = "CREATEVIEW";
+    public static final String LIST = "LIST";
+    public static final String SELECT = "SELECT";
+    public static final String UPDATE = "UPDATE";
+    public static final String GRANT = "GRANT";
 
-    private static final Pattern EXTENSION_ACCESS =
-            Pattern.compile("[A-Z0-9][A-Z0-9._-]*/[A-Z0-9][A-Z0-9._-]*");
     private static final Map<ResourceType, Set<String>> BUILT_INS = builtIns();
 
     private PermissionAccess() {}
@@ -75,53 +66,46 @@ public static String canonicalize(String access) {
                 canonical.length() <= MAX_LENGTH,
                 "access must contain at most %s characters after canonicalization.",
                 MAX_LENGTH);
-        if (EXTENSION_ACCESS.matcher(canonical).matches()
-                || BUILT_INS.values().stream().anyMatch(values -> values.contains(canonical))) {
+        if (BUILT_INS.values().stream().anyMatch(values -> values.contains(canonical))) {
             return canonical;
         }
-        throw new IllegalArgumentException(
-                String.format(
-                        "Unknown access '%s'. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
-                        canonical));
+        throw new IllegalArgumentException(String.format("Unknown access '%s'.", canonical));
     }
 
     public static String canonicalize(PermissionResource resource, String access) {
+        checkNotNull(resource, "resource cannot be null");
         String canonical = canonicalize(access);
-        if (EXTENSION_ACCESS.matcher(canonical).matches()) {
-            return canonical;
-        }
-
         checkArgument(
                 BUILT_INS.get(resource.getType()).contains(canonical),
-                "Access '%s' is not valid for %s. Use a built-in access or a namespaced extension such as vendor.example/SOME_ACCESS.",
+                "Access '%s' is not valid for %s.",
                 canonical,
                 resource.getType());
         return canonical;
     }
 
     public static Set<String> builtIns(ResourceType type) {
-        return BUILT_INS.get(type);
+        return BUILT_INS.get(checkNotNull(type, "resource type cannot be null"));
     }
 
     private static Map<ResourceType, Set<String>> builtIns() {
         Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
-        accesses.put(
-                ResourceType.CATALOG, values(USE_CATALOG, CREATE_DATABASE, MANAGE_PERMISSIONS));
+        accesses.put(ResourceType.CATALOG, values(ALL, ALTER, DROP, GRANT, CREATEDATABASE));
         accesses.put(
                 ResourceType.DATABASE,
                 values(
-                        USE_DATABASE,
-                        CREATE_TABLE,
-                        CREATE_VIEW,
-                        CREATE_FUNCTION,
+                        ALL,
+                        DESCRIBE,
                         ALTER,
                         DROP,
-                        MANAGE_PERMISSIONS));
-        accesses.put(
-                ResourceType.TABLE,
-                values(SELECT, INSERT, UPDATE, DELETE, ALTER, DROP, MANAGE_PERMISSIONS));
-        accesses.put(ResourceType.VIEW, values(SELECT, ALTER, DROP, MANAGE_PERMISSIONS));
-        accesses.put(ResourceType.FUNCTION, values(EXECUTE, ALTER, DROP, MANAGE_PERMISSIONS));
+                        GRANT,
+                        CREATETABLE,
+                        CREATEVIEW,
+                        CREATEFUNCTION,
+                        LIST));
+        accesses.put(ResourceType.TABLE, values(ALL, SELECT, UPDATE, ALTER, DROP, GRANT));
+        accesses.put(ResourceType.COLUMN, values(SELECT));
+        accesses.put(ResourceType.VIEW, values(ALL, SELECT, ALTER, DROP, GRANT));
+        accesses.put(ResourceType.FUNCTION, values(ALL, SELECT, ALTER, DROP, GRANT));
         return Collections.unmodifiableMap(accesses);
     }
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
index 75bc4ad80126..c4e47f11d036 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
@@ -38,6 +38,10 @@
 /**
  * Direct permission assignment on one exact resource.
  *
+ * <p>A {@link ResourceType#COLUMN COLUMN} assignment carries one {@link PermissionColumns} value.
+ * The column range is mutable assignment content rather than identity: granting the same resource,
+ * access, and principal replaces the complete range.
+ *
  * <p>{@code expireTime}, when present, is an exclusive authorization upper bound evaluated against
  * the server clock. At or after that instant, the assignment must not authorize access, although an
  * expired record may remain listable until cleanup.
@@ -52,6 +56,7 @@ public class PermissionAssignment {
     private static final String FIELD_RESOURCE = "resource";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_COLUMNS = "columns";
     private static final String FIELD_EXPIRE_TIME = "expireTime";
 
     @JsonProperty(FIELD_RESOURCE)
@@ -63,21 +68,39 @@ public class PermissionAssignment {
     @JsonProperty(FIELD_PRINCIPAL)
     private final String principal;
 
+    @Nullable
+    @JsonProperty(FIELD_COLUMNS)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final PermissionColumns columns;
+
     @Nullable
     @JsonProperty(FIELD_EXPIRE_TIME)
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private final String expireTime;
 
     @JsonCreator
-    @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL, FIELD_EXPIRE_TIME})
+    @ConstructorProperties({
+        FIELD_RESOURCE,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL,
+        FIELD_COLUMNS,
+        FIELD_EXPIRE_TIME
+    })
     public PermissionAssignment(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @Nullable @JsonProperty(FIELD_COLUMNS) PermissionColumns columns,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
         this.resource = checkNotNull(resource, "resource cannot be null");
         this.access = PermissionAccess.canonicalize(resource, access);
         this.principal = validatePrincipal(principal);
+        checkArgument(
+                resource.getType() == ResourceType.COLUMN ? columns != null : columns == null,
+                resource.getType() == ResourceType.COLUMN
+                        ? "columns is required for COLUMN resource."
+                        : "columns is only valid for COLUMN resource.");
+        this.columns = columns;
         if (expireTime != null) {
             try {
                 Instant instant = Instant.parse(expireTime);
@@ -92,6 +115,14 @@ public PermissionAssignment(
         this.expireTime = expireTime;
     }
 
+    public PermissionAssignment(
+            PermissionResource resource,
+            String access,
+            String principal,
+            @Nullable String expireTime) {
+        this(resource, access, principal, null, expireTime);
+    }
+
     @JsonGetter(FIELD_RESOURCE)
     public PermissionResource getResource() {
         return resource;
@@ -107,7 +138,8 @@ public String getPrincipal() {
         return principal;
     }
 
-    static String validatePrincipal(String principal) {
+    /** Validates and returns an opaque principal identifier. */
+    public static String validatePrincipal(String principal) {
         checkArgument(
                 principal != null && !principal.trim().isEmpty(), "principal cannot be empty.");
         checkArgument(
@@ -117,6 +149,13 @@ static String validatePrincipal(String principal) {
         return principal;
     }
 
+    /** Returns the selected or excluded column range for a COLUMN assignment. */
+    @Nullable
+    @JsonGetter(FIELD_COLUMNS)
+    public PermissionColumns getColumns() {
+        return columns;
+    }
+
     /** Returns the exclusive authorization upper bound, or null for no expiry. */
     @Nullable
     @JsonGetter(FIELD_EXPIRE_TIME)
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionColumns.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionColumns.java
new file mode 100644
index 000000000000..105d4fb57500
--- /dev/null
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionColumns.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.management;
+
+import org.apache.paimon.annotation.Experimental;
+
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonCreator;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonGetter;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonInclude;
+import org.apache.paimon.shade.jackson2.com.fasterxml.jackson.annotation.JsonProperty;
+
+import javax.annotation.Nullable;
+
+import java.beans.ConstructorProperties;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+
+/**
+ * Included or excluded top-level columns of a column-level permission assignment.
+ *
+ * <p>Exactly one list is present. Included names form an allowlist; excluded names form a denylist.
+ */
+@Experimental
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PermissionColumns {
+
+    private static final String FIELD_COLUMN_NAMES = "columnNames";
+    private static final String FIELD_EXCLUDED_COLUMN_NAMES = "excludedColumnNames";
+
+    @Nullable
+    @JsonProperty(FIELD_COLUMN_NAMES)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final List<String> columnNames;
+
+    @Nullable
+    @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private final List<String> excludedColumnNames;
+
+    @JsonCreator
+    @ConstructorProperties({FIELD_COLUMN_NAMES, FIELD_EXCLUDED_COLUMN_NAMES})
+    public PermissionColumns(
+            @Nullable @JsonProperty(FIELD_COLUMN_NAMES) List<String> columnNames,
+            @Nullable @JsonProperty(FIELD_EXCLUDED_COLUMN_NAMES) List<String> excludedColumnNames) {
+        checkArgument(
+                (columnNames == null) != (excludedColumnNames == null),
+                "columns must contain exactly one of columnNames or excludedColumnNames.");
+        this.columnNames = immutableNonEmpty(columnNames, FIELD_COLUMN_NAMES);
+        this.excludedColumnNames =
+                immutableNonEmpty(excludedColumnNames, FIELD_EXCLUDED_COLUMN_NAMES);
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_COLUMN_NAMES)
+    public List<String> getColumnNames() {
+        return columnNames;
+    }
+
+    @Nullable
+    @JsonGetter(FIELD_EXCLUDED_COLUMN_NAMES)
+    public List<String> getExcludedColumnNames() {
+        return excludedColumnNames;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof PermissionColumns)) {
+            return false;
+        }
+        PermissionColumns that = (PermissionColumns) o;
+        return Objects.equals(columnNames, that.columnNames)
+                && Objects.equals(excludedColumnNames, that.excludedColumnNames);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(columnNames, excludedColumnNames);
+    }
+
+    @Nullable
+    private static List<String> immutableNonEmpty(
+            @Nullable List<String> columns, String fieldName) {
+        if (columns == null) {
+            return null;
+        }
+        checkArgument(!columns.isEmpty(), "%s cannot be empty.", fieldName);
+        for (String column : columns) {
+            checkArgument(
+                    column != null && !column.trim().isEmpty(),
+                    "%s cannot contain an empty column name.",
+                    fieldName);
+        }
+        checkArgument(
+                new HashSet<>(columns).size() == columns.size(),
+                "%s cannot contain duplicate column names.",
+                fieldName);
+        return Collections.unmodifiableList(new ArrayList<>(columns));
+    }
+}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
deleted file mode 100644
index eba705a09199..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionIdentity.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import java.util.Objects;
-
-import static org.apache.paimon.utils.Preconditions.checkNotNull;
-
-/** Fields that uniquely identify a permission assignment for revocation. */
-@Experimental
-public class PermissionIdentity {
-
-    private final PermissionResource resource;
-    private final String access;
-    private final String principal;
-
-    public PermissionIdentity(PermissionResource resource, String access, String principal) {
-        this.resource = checkNotNull(resource, "resource cannot be null");
-        this.access = PermissionAccess.canonicalize(resource, access);
-        this.principal = PermissionAssignment.validatePrincipal(principal);
-    }
-
-    public static PermissionIdentity fromAssignment(PermissionAssignment assignment) {
-        return new PermissionIdentity(
-                assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
-    }
-
-    public PermissionResource getResource() {
-        return resource;
-    }
-
-    public String getAccess() {
-        return access;
-    }
-
-    public String getPrincipal() {
-        return principal;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (!(o instanceof PermissionIdentity)) {
-            return false;
-        }
-        PermissionIdentity that = (PermissionIdentity) o;
-        return resource.equals(that.resource)
-                && access.equals(that.access)
-                && principal.equals(that.principal);
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(resource, access, principal);
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
index 49c77d91d058..3eb669c142d8 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionManagement.java
@@ -29,5 +29,5 @@ public interface PermissionManagement {
 
     void grantPermission(PermissionAssignment assignment);
 
-    void revokePermission(PermissionIdentity identity);
+    void revokePermission(PermissionResource resource, String access, String principal);
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
index e2cb630f82f5..433302f125c2 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
@@ -169,11 +169,13 @@ private static void validate(
                         "DATABASE resource cannot contain table, function, or view.");
                 break;
             case TABLE:
-                checkArgument(!isBlank(database), "database is required for TABLE resource.");
-                checkArgument(!isBlank(table), "table is required for TABLE resource.");
+            case COLUMN:
+                checkArgument(!isBlank(database), "database is required for %s resource.", type);
+                checkArgument(!isBlank(table), "table is required for %s resource.", type);
                 checkArgument(
                         isBlank(function) && isBlank(view),
-                        "TABLE resource cannot contain function or view.");
+                        "%s resource cannot contain function or view.",
+                        type);
                 break;
             case FUNCTION:
                 checkArgument(!isBlank(database), "database is required for FUNCTION resource.");
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
deleted file mode 100644
index 3c4003664517..000000000000
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyIdentity.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.management;
-
-import org.apache.paimon.annotation.Experimental;
-
-import javax.annotation.Nullable;
-
-import static org.apache.paimon.utils.Preconditions.checkArgument;
-import static org.apache.paimon.utils.Preconditions.checkNotNull;
-
-/** Resource-scoped identity of one principal's row filter or column mask. */
-@Experimental
-public class PolicyIdentity {
-
-    private final PermissionResource resource;
-    private final PolicyType type;
-    private final String principal;
-    @Nullable private final String column;
-
-    public PolicyIdentity(
-            PermissionResource resource,
-            PolicyType type,
-            String principal,
-            @Nullable String column) {
-        this.resource = checkNotNull(resource, "resource cannot be null");
-        resource.validatePolicyAttachment();
-        this.type = checkNotNull(type, "policy type cannot be null");
-        this.principal = PermissionAssignment.validatePrincipal(principal);
-        if (type == PolicyType.ROW_FILTER) {
-            checkArgument(isBlank(column), "ROW_FILTER identity cannot contain a column.");
-            this.column = null;
-        } else {
-            checkArgument(!isBlank(column), "column is required for COLUMN_MASKING identity.");
-            this.column = column;
-        }
-    }
-
-    public static PolicyIdentity fromPolicy(DataPolicy policy) {
-        ColumnMask columnMask = policy.getColumnMask();
-        return new PolicyIdentity(
-                policy.getResource(),
-                policy.type(),
-                policy.getPrincipal(),
-                columnMask == null ? null : columnMask.getOnColumn());
-    }
-
-    public PermissionResource getResource() {
-        return resource;
-    }
-
-    public PolicyType getType() {
-        return type;
-    }
-
-    public String getPrincipal() {
-        return principal;
-    }
-
-    @Nullable
-    public String getColumn() {
-        return column;
-    }
-
-    /** Stable wire identity used in error responses. */
-    public String resourceName() {
-        return type.name() + ":" + principal + (column == null ? "" : ":" + column);
-    }
-
-    private static boolean isBlank(@Nullable String value) {
-        return value == null || value.trim().isEmpty();
-    }
-}
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
index 2a212316c7ac..6e0ade32f196 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
@@ -21,6 +21,8 @@
 import org.apache.paimon.PagedList;
 import org.apache.paimon.annotation.Experimental;
 
+import javax.annotation.Nullable;
+
 /** Control-plane contract for row-filter and column-masking policies. */
 @Experimental
 public interface PolicyManagement {
@@ -31,5 +33,10 @@ public interface PolicyManagement {
 
     void createOrReplacePolicy(DataPolicy policy);
 
-    void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists);
+    void dropPolicy(
+            PermissionResource resource,
+            PolicyType type,
+            String principal,
+            @Nullable String column,
+            boolean ignoreIfNotExists);
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
index 869a4b971207..8674116a6895 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
@@ -30,6 +30,7 @@ public enum ResourceType {
     CATALOG,
     DATABASE,
     TABLE,
+    COLUMN,
     VIEW,
     FUNCTION;
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index e2363444f036..ca3d957ad90c 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -30,8 +30,8 @@
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionIdentity;
-import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.options.Options;
 import org.apache.paimon.partition.Partition;
 import org.apache.paimon.partition.PartitionStatistics;
@@ -131,6 +131,7 @@
 import static org.apache.paimon.rest.RESTUtil.extractPrefixMap;
 import static org.apache.paimon.rest.auth.AuthProviderFactory.createAuthProvider;
 import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
 /**
  * REST API for REST Catalog.
@@ -879,10 +880,10 @@ public void grantPermission(PermissionAssignment assignment) {
 
     /** Revokes a permission for the configured REST catalog. */
     @Experimental
-    public void revokePermission(PermissionIdentity identity) {
+    public void revokePermission(PermissionResource resource, String access, String principal) {
         client.post(
                 resourcePaths.revokePermission(),
-                new RevokePermissionRequest(identity),
+                new RevokePermissionRequest(resource, access, principal),
                 restAuthFunction);
     }
 
@@ -926,11 +927,17 @@ public void createOrReplacePolicy(DataPolicy policy) {
 
     /** Drops a principal policy from its exact attachment resource. */
     @Experimental
-    public void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists) {
+    public void dropPolicy(
+            PermissionResource resource,
+            PolicyType type,
+            String principal,
+            @Nullable String column,
+            boolean ignoreIfNotExists) {
+        checkNotNull(resource, "resource cannot be null").validatePolicyAttachment();
         try {
             client.delete(
-                    resourcePaths.policies(identity.getResource()),
-                    new DropPolicyRequest(identity),
+                    resourcePaths.policies(resource),
+                    new DropPolicyRequest(type, principal, column),
                     restAuthFunction);
         } catch (NoSuchResourceException e) {
             if (!ignoreIfNotExists
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
index e99aacdf8f21..3091d1ac092a 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPermissionManagement.java
@@ -22,8 +22,8 @@
 import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionManagement;
+import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.rest.responses.ListPermissionsResponse;
 
 /** REST implementation of permission management, bound to the configured REST catalog prefix. */
@@ -48,7 +48,7 @@ public void grantPermission(PermissionAssignment assignment) {
     }
 
     @Override
-    public void revokePermission(PermissionIdentity identity) {
-        api.revokePermission(identity);
+    public void revokePermission(PermissionResource resource, String access, String principal) {
+        api.revokePermission(resource, access, principal);
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
index 2d82739afeb4..7b20000887e7 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
@@ -22,10 +22,13 @@
 import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.ListPoliciesRequest;
-import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.rest.responses.ListPoliciesResponse;
 
+import javax.annotation.Nullable;
+
 /** REST implementation of data policy management for a configured catalog prefix. */
 @Experimental
 public class RESTPolicyManagement implements PolicyManagement {
@@ -53,7 +56,12 @@ public void createOrReplacePolicy(DataPolicy policy) {
     }
 
     @Override
-    public void dropPolicy(PolicyIdentity identity, boolean ignoreIfNotExists) {
-        api.dropPolicy(identity, ignoreIfNotExists);
+    public void dropPolicy(
+            PermissionResource resource,
+            PolicyType type,
+            String principal,
+            @Nullable String column,
+            boolean ignoreIfNotExists) {
+        api.dropPolicy(resource, type, principal, column, ignoreIfNotExists);
     }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
index 997fa38e4713..64b7b83c0ef1 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/DropPolicyRequest.java
@@ -19,8 +19,7 @@
 package org.apache.paimon.rest.requests;
 
 import org.apache.paimon.annotation.Experimental;
-import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.rest.RESTRequest;
 
@@ -34,6 +33,9 @@
 
 import java.beans.ConstructorProperties;
 
+import static org.apache.paimon.utils.Preconditions.checkArgument;
+import static org.apache.paimon.utils.Preconditions.checkNotNull;
+
 /** Request for dropping one principal's row filter or column mask. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
@@ -47,23 +49,21 @@ public class DropPolicyRequest implements RESTRequest {
     private final String principal;
     @Nullable private final String column;
 
-    public DropPolicyRequest(PolicyIdentity identity) {
-        this(identity.getType(), identity.getPrincipal(), identity.getColumn());
-    }
-
     @JsonCreator
     @ConstructorProperties({FIELD_TYPE, FIELD_PRINCIPAL, FIELD_COLUMN})
     public DropPolicyRequest(
             @JsonProperty(FIELD_TYPE) PolicyType type,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
             @Nullable @JsonProperty(FIELD_COLUMN) String column) {
-        this.type = type;
-        this.principal = principal;
-        this.column = column;
-    }
-
-    public PolicyIdentity identity(PermissionResource resource) {
-        return new PolicyIdentity(resource, type, principal, column);
+        this.type = checkNotNull(type, "policy type cannot be null");
+        this.principal = validatePrincipal(principal);
+        if (type == PolicyType.ROW_FILTER) {
+            checkArgument(isBlank(column), "ROW_FILTER identity cannot contain a column.");
+            this.column = null;
+        } else {
+            checkArgument(!isBlank(column), "column is required for COLUMN_MASKING identity.");
+            this.column = column;
+        }
     }
 
     @JsonGetter(FIELD_TYPE)
@@ -82,4 +82,18 @@ public String getPrincipal() {
     public String getColumn() {
         return column;
     }
+
+    private static String validatePrincipal(String principal) {
+        checkArgument(
+                principal != null && !principal.trim().isEmpty(), "principal cannot be empty.");
+        checkArgument(
+                principal.length() <= PermissionAssignment.MAX_PRINCIPAL_LENGTH,
+                "principal must contain at most %s characters.",
+                PermissionAssignment.MAX_PRINCIPAL_LENGTH);
+        return principal;
+    }
+
+    private static boolean isBlank(@Nullable String value) {
+        return value == null || value.trim().isEmpty();
+    }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
index 0488777d7800..377e997adb95 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/GrantPermissionRequest.java
@@ -20,6 +20,7 @@
 
 import org.apache.paimon.annotation.Experimental;
 import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.rest.RESTRequest;
 
@@ -41,6 +42,7 @@ public class GrantPermissionRequest implements RESTRequest {
     private static final String FIELD_RESOURCE = "resource";
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
+    private static final String FIELD_COLUMNS = "columns";
     private static final String FIELD_EXPIRE_TIME = "expireTime";
 
     private final PermissionAssignment assignment;
@@ -50,13 +52,21 @@ public GrantPermissionRequest(PermissionAssignment assignment) {
     }
 
     @JsonCreator
-    @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL, FIELD_EXPIRE_TIME})
+    @ConstructorProperties({
+        FIELD_RESOURCE,
+        FIELD_ACCESS,
+        FIELD_PRINCIPAL,
+        FIELD_COLUMNS,
+        FIELD_EXPIRE_TIME
+    })
     public GrantPermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal,
+            @Nullable @JsonProperty(FIELD_COLUMNS) PermissionColumns columns,
             @Nullable @JsonProperty(FIELD_EXPIRE_TIME) String expireTime) {
-        this.assignment = new PermissionAssignment(resource, access, principal, expireTime);
+        this.assignment =
+                new PermissionAssignment(resource, access, principal, columns, expireTime);
     }
 
     public PermissionAssignment assignment() {
@@ -78,6 +88,13 @@ public String getPrincipal() {
         return assignment.getPrincipal();
     }
 
+    @Nullable
+    @JsonGetter(FIELD_COLUMNS)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public PermissionColumns getColumns() {
+        return assignment.getColumns();
+    }
+
     @Nullable
     @JsonGetter(FIELD_EXPIRE_TIME)
     @JsonInclude(JsonInclude.Include.NON_NULL)
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
index 656cade18c6c..0da87420fdcc 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/RevokePermissionRequest.java
@@ -19,7 +19,7 @@
 package org.apache.paimon.rest.requests;
 
 import org.apache.paimon.annotation.Experimental;
-import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionAccess;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.rest.RESTRequest;
 
@@ -39,11 +39,9 @@ public class RevokePermissionRequest implements RESTRequest {
     private static final String FIELD_ACCESS = "access";
     private static final String FIELD_PRINCIPAL = "principal";
 
-    private final PermissionIdentity identity;
-
-    public RevokePermissionRequest(PermissionIdentity identity) {
-        this.identity = identity;
-    }
+    private final PermissionResource resource;
+    private final String access;
+    private final String principal;
 
     @JsonCreator
     @ConstructorProperties({FIELD_RESOURCE, FIELD_ACCESS, FIELD_PRINCIPAL})
@@ -51,25 +49,24 @@ public RevokePermissionRequest(
             @JsonProperty(FIELD_RESOURCE) PermissionResource resource,
             @JsonProperty(FIELD_ACCESS) String access,
             @JsonProperty(FIELD_PRINCIPAL) String principal) {
-        this.identity = new PermissionIdentity(resource, access, principal);
+        this.resource = resource;
+        this.access = PermissionAccess.canonicalize(resource, access);
+        this.principal =
+                org.apache.paimon.management.PermissionAssignment.validatePrincipal(principal);
     }
 
     @JsonGetter(FIELD_RESOURCE)
     public PermissionResource getResource() {
-        return identity.getResource();
+        return resource;
     }
 
     @JsonGetter(FIELD_ACCESS)
     public String getAccess() {
-        return identity.getAccess();
+        return access;
     }
 
     @JsonGetter(FIELD_PRINCIPAL)
     public String getPrincipal() {
-        return identity.getPrincipal();
-    }
-
-    public PermissionIdentity identity() {
-        return identity;
+        return principal;
     }
 }
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index d5aaf4f9b56b..aaf27f07a0ef 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -26,7 +26,9 @@
 
 import org.junit.jupiter.api.Test;
 
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -49,6 +51,12 @@ public class PermissionManagementJsonTest {
                     + "\"principal\":\"analyst\","
                     + "\"expireTime\":\"2027-01-01T00:00:00Z\"}";
 
+    private static final String COLUMN_ASSIGNMENT_JSON =
+            "{\"resource\":{\"type\":\"COLUMN\",\"database\":\"sales\","
+                    + "\"table\":\"orders\"},\"access\":\"select\","
+                    + "\"principal\":\"analyst\",\"columns\":{"
+                    + "\"columnNames\":[\"id\",\"region\"]}}";
+
     @Test
     void testAssignmentDeserializesWithShadedAndExternalJackson() throws Exception {
         assertAssignment(RESTApi.fromJson(ASSIGNMENT_JSON, PermissionAssignment.class));
@@ -67,6 +75,35 @@ void testAssignmentDeserializesLowerCaseResourceType() throws Exception {
                         .readValue(lowerCaseJson, PermissionAssignment.class));
     }
 
+    @Test
+    void testColumnAssignmentRoundTripsWithShadedAndExternalJackson() throws Exception {
+        PermissionAssignment shaded =
+                RESTApi.fromJson(COLUMN_ASSIGNMENT_JSON, PermissionAssignment.class);
+        PermissionAssignment external =
+                new com.fasterxml.jackson.databind.ObjectMapper()
+                        .readValue(COLUMN_ASSIGNMENT_JSON, PermissionAssignment.class);
+
+        for (PermissionAssignment assignment : Arrays.asList(shaded, external)) {
+            assertThat(assignment.getResource().getType()).isEqualTo(ResourceType.COLUMN);
+            assertThat(assignment.getAccess()).isEqualTo("SELECT");
+            assertThat(assignment.getColumns().getColumnNames()).containsExactly("id", "region");
+            assertThat(assignment.getColumns().getExcludedColumnNames()).isNull();
+        }
+
+        Map<?, ?> wire = RESTApi.fromJson(RESTApi.toJson(shaded), Map.class);
+        assertThat(((Map<?, ?>) wire.get("columns")).get("columnNames"))
+                .isEqualTo(Arrays.asList("id", "region"));
+        Map<?, ?> externalWire =
+                new com.fasterxml.jackson.databind.ObjectMapper()
+                        .readValue(
+                                new com.fasterxml.jackson.databind.ObjectMapper()
+                                        .writeValueAsString(external),
+                                Map.class);
+        Map<?, ?> externalColumns = (Map<?, ?>) externalWire.get("columns");
+        assertThat(externalColumns.get("columnNames")).isEqualTo(Arrays.asList("id", "region"));
+        assertThat(externalColumns.get("excludedColumnNames")).isNull();
+    }
+
     @Test
     void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
         PermissionAssignment assignment =
@@ -83,7 +120,9 @@ void testGrantAndRevokeUsePrivilegeOnlyWireShapes() throws Exception {
                 RESTApi.fromJson(
                         RESTApi.toJson(
                                 new RevokePermissionRequest(
-                                        PermissionIdentity.fromAssignment(assignment))),
+                                        assignment.getResource(),
+                                        assignment.getAccess(),
+                                        assignment.getPrincipal())),
                         Map.class);
         assertThat(revoke.get("access")).isEqualTo("SELECT");
         assertThat(revoke.containsKey("columns")).isFalse();
@@ -150,30 +189,131 @@ void testPoliciesArePrincipalScopedPaimonDefinitions() throws Exception {
                                         .writeValueAsString(policy),
                                 Map.class);
         assertThat(external.containsKey("type")).isFalse();
-        assertThat(((Map<?, ?>) external.get("columnMask")).keySet())
+        assertThat(new ArrayList<Object>(((Map<?, ?>) external.get("columnMask")).keySet()))
                 .containsExactlyInAnyOrder("onColumn", "transform");
     }
 
     @Test
     void testAccessAndPolicyValidation() {
+        assertThat(
+                        new PermissionAssignment(
+                                        catalogResource(), "createdatabase", "analyst", null)
+                                .getAccess())
+                .isEqualTo("CREATEDATABASE");
+        assertThat(
+                        new PermissionAssignment(databaseResource(), "createview", "analyst", null)
+                                .getAccess())
+                .isEqualTo("CREATEVIEW");
+        assertThat(
+                        new PermissionAssignment(functionResource(), "select", "analyst", null)
+                                .getAccess())
+                .isEqualTo("SELECT");
+        assertThat(PermissionAccess.builtIns(ResourceType.CATALOG))
+                .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "GRANT", "CREATEDATABASE");
+        assertThat(PermissionAccess.builtIns(ResourceType.DATABASE))
+                .containsExactlyInAnyOrder(
+                        "ALL",
+                        "DESCRIBE",
+                        "ALTER",
+                        "DROP",
+                        "GRANT",
+                        "CREATETABLE",
+                        "CREATEVIEW",
+                        "CREATEFUNCTION",
+                        "LIST");
+        assertThat(PermissionAccess.builtIns(ResourceType.TABLE))
+                .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "SELECT", "UPDATE", "GRANT");
+        assertThat(PermissionAccess.builtIns(ResourceType.VIEW))
+                .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "SELECT", "GRANT");
+        assertThat(PermissionAccess.builtIns(ResourceType.FUNCTION))
+                .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "SELECT", "GRANT");
+        assertThat(PermissionAccess.builtIns(ResourceType.COLUMN)).containsExactly("SELECT");
+
+        PermissionColumns included = new PermissionColumns(Arrays.asList("id", "region"), null);
+        assertThat(
+                        new PermissionAssignment(
+                                        columnResource(), "select", "analyst", included, null)
+                                .getColumns())
+                .isEqualTo(included);
+
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
                                         catalogResource(), "SELECT", "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("not valid");
+                .hasMessageContaining("not valid for CATALOG");
         assertThatThrownBy(
-                        () -> new PermissionAssignment(catalogResource(), "ALL", "analyst", null))
+                        () ->
+                                new PermissionAssignment(
+                                        databaseResource(), "SELECT", "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Unknown access");
-        assertThat(
-                        new PermissionAssignment(
-                                        tableResource(),
-                                        "vendor.example/read_sensitive",
-                                        "analyst",
-                                        null)
-                                .getAccess())
-                .isEqualTo("VENDOR.EXAMPLE/READ_SENSITIVE");
+                .hasMessageContaining("not valid for DATABASE");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(), "CREATEVIEW", "analyst", null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid for TABLE");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        functionResource(), "UPDATE", "analyst", null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid for FUNCTION");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        columnResource(), "UPDATE", "analyst", included, null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid for COLUMN");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        columnResource(), "SELECT", "analyst", null, null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("columns is required");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        tableResource(), "SELECT", "analyst", included, null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("only valid for COLUMN");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionColumns(
+                                        Collections.singletonList("id"),
+                                        Collections.singletonList("region")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("exactly one");
+        assertThatThrownBy(() -> new PermissionColumns(Collections.emptyList(), null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("cannot be empty");
+        assertThatThrownBy(() -> new PermissionColumns(Arrays.asList("id", "id"), null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("duplicate");
+        assertThatThrownBy(() -> new PermissionColumns(Collections.singletonList(" "), null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("empty");
+        for (String access :
+                Arrays.asList(
+                        "USE_CATALOG",
+                        "CREATE_DATABASE",
+                        "USE_DATABASE",
+                        "CREATE_TABLE",
+                        "CREATE_VIEW",
+                        "CREATE_FUNCTION",
+                        "INSERT",
+                        "DELETE",
+                        "EXECUTE",
+                        "MANAGE_PERMISSIONS",
+                        "vendor.example/read_sensitive")) {
+            assertThatThrownBy(
+                            () ->
+                                    new PermissionAssignment(
+                                            tableResource(), access, "analyst", null))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("Unknown access");
+        }
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
@@ -233,6 +373,17 @@ void testAccessAndPolicyValidation() {
                 .hasMessageContaining("millisecond");
     }
 
+    @Test
+    void testPermissionColumnsDefensivelyCopiesItsRange() {
+        java.util.List<String> source = new ArrayList<>(Arrays.asList("id", "region"));
+        PermissionColumns columns = new PermissionColumns(source, null);
+
+        source.clear();
+        assertThat(columns.getColumnNames()).containsExactly("id", "region");
+        assertThatThrownBy(() -> columns.getColumnNames().add("email"))
+                .isInstanceOf(UnsupportedOperationException.class);
+    }
+
     @Test
     void testPermissionListRequiresExactResourceAndBoundsPageSize() {
         assertThatThrownBy(
@@ -264,18 +415,18 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("at most 1000");
 
-        ListPermissionsRequest catalogAccess =
+        ListPermissionsRequest databaseAccess =
                 new ListPermissionsRequest(
-                        ResourceType.CATALOG,
+                        ResourceType.DATABASE,
+                        "sales",
                         null,
                         null,
                         null,
                         null,
-                        null,
-                        "use_catalog",
+                        "createview",
                         null,
                         25);
-        assertThat(catalogAccess.getAccess()).isEqualTo("USE_CATALOG");
+        assertThat(databaseAccess.getAccess()).isEqualTo("CREATEVIEW");
         assertThatThrownBy(
                         () ->
                                 new ListPermissionsRequest(
@@ -285,7 +436,7 @@ void testPermissionListRequiresExactResourceAndBoundsPageSize() {
                                         null,
                                         null,
                                         null,
-                                        "USE_CATALOG",
+                                        "SELECT",
                                         null,
                                         25))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -306,24 +457,16 @@ void testPolicyDefinitionsBoundUtf8PayloadSize() {
     }
 
     @Test
-    void testPolicyIdentityAndDropRequestRoundTrip() throws Exception {
-        PolicyIdentity identity =
-                new PolicyIdentity(tableResource(), PolicyType.COLUMN_MASKING, "analyst", "email");
-        DropPolicyRequest request = new DropPolicyRequest(identity);
+    void testDropPolicyRequestRoundTrip() throws Exception {
+        DropPolicyRequest request =
+                new DropPolicyRequest(PolicyType.COLUMN_MASKING, "analyst", "email");
         DropPolicyRequest roundTrip =
                 RESTApi.fromJson(RESTApi.toJson(request), DropPolicyRequest.class);
 
-        assertThat(roundTrip.identity(tableResource()).getType())
-                .isEqualTo(PolicyType.COLUMN_MASKING);
-        assertThat(roundTrip.identity(tableResource()).getPrincipal()).isEqualTo("analyst");
-        assertThat(roundTrip.identity(tableResource()).getColumn()).isEqualTo("email");
-        assertThatThrownBy(
-                        () ->
-                                new PolicyIdentity(
-                                        tableResource(),
-                                        PolicyType.COLUMN_MASKING,
-                                        "analyst",
-                                        null))
+        assertThat(roundTrip.getType()).isEqualTo(PolicyType.COLUMN_MASKING);
+        assertThat(roundTrip.getPrincipal()).isEqualTo("analyst");
+        assertThat(roundTrip.getColumn()).isEqualTo("email");
+        assertThatThrownBy(() -> new DropPolicyRequest(PolicyType.COLUMN_MASKING, "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("column is required");
     }
@@ -341,10 +484,22 @@ private static PermissionResource catalogResource() {
         return new PermissionResource(ResourceType.CATALOG, null, null, null, null);
     }
 
+    private static PermissionResource databaseResource() {
+        return new PermissionResource(ResourceType.DATABASE, "sales", null, null, null);
+    }
+
     private static PermissionResource tableResource() {
         return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
     }
 
+    private static PermissionResource columnResource() {
+        return new PermissionResource(ResourceType.COLUMN, "sales", "orders", null, null);
+    }
+
+    private static PermissionResource functionResource() {
+        return new PermissionResource(ResourceType.FUNCTION, "sales", null, "calculate_tax", null);
+    }
+
     private static String repeat(char value, int length) {
         char[] values = new char[length];
         Arrays.fill(values, value);
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
index ed8196cc0ef9..48d19ffa76a6 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPermissionManagementTest.java
@@ -21,7 +21,7 @@
 import org.apache.paimon.PagedList;
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.ResourceType;
@@ -39,6 +39,7 @@
 import java.net.InetSocketAddress;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -147,7 +148,7 @@ void testListUsesEncodedPrefixAndCompleteFilters() throws Exception {
     void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         PermissionAssignment assignment = assignment("analyst");
         management.grantPermission(assignment);
-        management.revokePermission(PermissionIdentity.fromAssignment(assignment));
+        management.revokePermission(assignment.getResource(), "select", assignment.getPrincipal());
 
         Map<?, ?> grant = RESTApi.fromJson(grantBody.get(), Map.class);
         Map<?, ?> grantResource = (Map<?, ?>) grant.get("resource");
@@ -165,6 +166,7 @@ void testGrantAndRevokeUseStructuredWireShapes() throws Exception {
         assertThat(revokeResource.get("type")).isEqualTo("TABLE");
         assertThat(revokeResource.get("database")).isEqualTo("sales");
         assertThat(revokeResource.get("table")).isEqualTo("orders");
+        assertThat(revoke.get("access")).isEqualTo("SELECT");
         assertThat(revoke.get("principal")).isEqualTo("analyst");
         assertThat(revoke.containsKey("expireTime")).isFalse();
         assertThat(revoke.containsKey("grantOption")).isFalse();
@@ -177,12 +179,35 @@ void testForbiddenGrantPreservesRESTErrorTranslation() {
                 .hasMessageContaining("forbidden");
     }
 
+    @Test
+    void testColumnGrantCarriesRangeButRevokeUsesOnlyIdentity() throws Exception {
+        PermissionAssignment assignment =
+                new PermissionAssignment(
+                        new PermissionResource(ResourceType.COLUMN, "sales", "orders", null, null),
+                        "SELECT",
+                        "analyst",
+                        new PermissionColumns(Arrays.asList("id", "region"), null),
+                        null);
+
+        management.grantPermission(assignment);
+        Map<?, ?> grant = RESTApi.fromJson(grantBody.get(), Map.class);
+        assertThat(((Map<?, ?>) grant.get("columns")).get("columnNames"))
+                .isEqualTo(Arrays.asList("id", "region"));
+
+        management.revokePermission(
+                assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
+        Map<?, ?> revoke = RESTApi.fromJson(revokeBody.get(), Map.class);
+        assertThat(((Map<?, ?>) revoke.get("resource")).get("type")).isEqualTo("COLUMN");
+        assertThat(revoke.containsKey("columns")).isFalse();
+    }
+
     @Test
     void testRepeatedRevokeIsIdempotent() {
         PermissionAssignment assignment = assignment("missing");
-        PermissionIdentity identity = PermissionIdentity.fromAssignment(assignment);
-        management.revokePermission(identity);
-        management.revokePermission(identity);
+        management.revokePermission(
+                assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
+        management.revokePermission(
+                assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
 
         assertThat(revokeCalls).hasValue(2);
     }
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
index 8ffcd87d515e..e3ce1c27552e 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
@@ -23,7 +23,6 @@
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyManagement;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.management.ResourceType;
@@ -139,7 +138,12 @@ void testCreateUpdateAndDropUseCrudMethods() {
         DataPolicy policy = policy();
         management.createPolicy(policy);
         management.createOrReplacePolicy(policy);
-        management.dropPolicy(PolicyIdentity.fromPolicy(policy), false);
+        management.dropPolicy(
+                policy.getResource(),
+                policy.type(),
+                policy.getPrincipal(),
+                policy.getColumnMask().getOnColumn(),
+                false);
 
         assertThat(createBody.get()).contains("\"principal\":\"analyst\"");
         assertThat(createBody.get()).doesNotContain("\"resource\"");
@@ -152,18 +156,30 @@ void testCreateUpdateAndDropUseCrudMethods() {
 
     @Test
     void testDropIfExistsOnlyIgnoresMissingPolicy() {
-        PolicyIdentity identity = PolicyIdentity.fromPolicy(policy());
+        DataPolicy policy = policy();
         deleteError.set(
                 "{\"resourceType\":\"POLICY\",\"resourceName\":"
                         + "\"COLUMN_MASKING:analyst:email\","
                         + "\"message\":\"missing\",\"code\":404}");
 
-        management.dropPolicy(identity, true);
+        management.dropPolicy(
+                policy.getResource(),
+                policy.type(),
+                policy.getPrincipal(),
+                policy.getColumnMask().getOnColumn(),
+                true);
 
         deleteError.set(
                 "{\"resourceType\":\"TABLE\",\"resourceName\":\"orders\","
                         + "\"message\":\"missing table\",\"code\":404}");
-        assertThatThrownBy(() -> management.dropPolicy(identity, true))
+        assertThatThrownBy(
+                        () ->
+                                management.dropPolicy(
+                                        policy.getResource(),
+                                        policy.type(),
+                                        policy.getPrincipal(),
+                                        policy.getColumnMask().getOnColumn(),
+                                        true))
                 .isInstanceOf(NoSuchResourceException.class)
                 .hasMessageContaining("missing table");
     }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
index 4b0f31524559..325c1bceb2ad 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/PolicyKey.java
@@ -19,7 +19,6 @@
 package org.apache.paimon.rest;
 
 import org.apache.paimon.management.DataPolicy;
-import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyType;
 
 import javax.annotation.Nullable;
@@ -42,12 +41,7 @@ final class PolicyKey implements Comparable<PolicyKey> {
                 policy.getColumnMask() == null ? null : policy.getColumnMask().getOnColumn());
     }
 
-    PolicyKey(String tableUuid, PolicyIdentity identity) {
-        this(tableUuid, identity.getType(), identity.getPrincipal(), identity.getColumn());
-    }
-
-    private PolicyKey(
-            String tableUuid, PolicyType type, String principal, @Nullable String column) {
+    PolicyKey(String tableUuid, PolicyType type, String principal, @Nullable String column) {
         this.tableUuid = tableUuid;
         this.type = type;
         this.principal = principal;
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 688815366d5e..1f28cb53182d 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -45,7 +45,6 @@
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.management.RowFilter;
 import org.apache.paimon.operation.Lock;
@@ -1079,6 +1078,10 @@ private MockResponse authTable(
                         }
                     });
         }
+        if (!RESTColumnPermissionSupport.canSelect(
+                permissionStore, queryPrincipals, identifier, metadata, requestBody.select())) {
+            throw new Catalog.TableNoPermissionException(identifier);
+        }
         List<Predicate> rowFilters =
                 new ArrayList<>(
                         rowFilterAuthHandler.getOrDefault(
@@ -3317,24 +3320,27 @@ private MockResponse permissionsApiHandler(
             if (validation != null) {
                 return validation;
             }
+            validation = validateColumnAssignment(assignment);
+            if (validation != null) {
+                return validation;
+            }
             permissionStore.put(assignment);
             return new MockResponse().setResponseCode(200);
         }
 
         if ("POST".equals(method) && (permissionUri + "/revoke").equals(resourcePath)) {
             RevokePermissionRequest request = RESTApi.fromJson(data, RevokePermissionRequest.class);
-            MockResponse authorization =
-                    validateManagementPermission(request.identity().getResource());
+            MockResponse authorization = validateManagementPermission(request.getResource());
             if (authorization != null) {
                 return authorization;
             }
             MockResponse validation =
-                    validateResourceAndPrincipal(
-                            request.identity().getResource(), request.identity().getPrincipal());
+                    validateResourceAndPrincipal(request.getResource(), request.getPrincipal());
             if (validation != null) {
                 return validation;
             }
-            permissionStore.remove(request.identity());
+            permissionStore.remove(
+                    request.getResource(), request.getAccess(), request.getPrincipal());
             return new MockResponse().setResponseCode(200);
         }
 
@@ -3358,6 +3364,24 @@ private MockResponse validateResourceAndPrincipal(
         return resourceError == null ? validatePrincipal(principal) : resourceError;
     }
 
+    @Nullable
+    private MockResponse validateColumnAssignment(PermissionAssignment assignment) {
+        if (assignment.getResource().getType() != ResourceType.COLUMN) {
+            return null;
+        }
+        PermissionResource resource = assignment.getResource();
+        Identifier identifier = Identifier.create(resource.getDatabase(), resource.getTable());
+        TableMetadata metadata = tableMetadataStore.get(identifier.getFullName());
+        RESTColumnPermissionSupport.ValidationError error =
+                RESTColumnPermissionSupport.validate(assignment, metadata);
+        return error == null
+                ? null
+                : mockResponse(
+                        new ErrorResponse(
+                                error.resourceType, error.resourceName, error.message, error.code),
+                        error.code);
+    }
+
     @Nullable
     private MockResponse validateResource(PermissionResource resource) {
         boolean exists;
@@ -3369,6 +3393,7 @@ private MockResponse validateResource(PermissionResource resource) {
                 exists = databaseStore.containsKey(resource.getDatabase());
                 break;
             case TABLE:
+            case COLUMN:
                 exists =
                         tableMetadataStore.containsKey(
                                 Identifier.create(resource.getDatabase(), resource.getTable())
@@ -3433,6 +3458,7 @@ private static String resourceName(PermissionResource resource) {
             case DATABASE:
                 return resource.getDatabase();
             case TABLE:
+            case COLUMN:
                 return resource.getDatabase() + "." + resource.getTable();
             case FUNCTION:
                 return resource.getDatabase() + "." + resource.getFunction();
@@ -3518,7 +3544,7 @@ private MockResponse policiesApiHandler(
 
         if ("POST".equals(method)) {
             DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
-            PolicyIdentity identity = PolicyIdentity.fromPolicy(policy);
+            String resourceName = policyResourceName(policy);
             synchronized (policyLock(tableUuid)) {
                 MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
                 if (targetError != null) {
@@ -3534,7 +3560,7 @@ private MockResponse policiesApiHandler(
                     return mockResponse(
                             new ErrorResponse(
                                     ErrorResponse.RESOURCE_TYPE_POLICY,
-                                    identity.resourceName(),
+                                    resourceName,
                                     "Policy already exists.",
                                     409),
                             409);
@@ -3561,21 +3587,26 @@ private MockResponse policiesApiHandler(
         }
 
         if ("DELETE".equals(method)) {
-            PolicyIdentity identity =
-                    RESTApi.fromJson(data, DropPolicyRequest.class).identity(path.resource);
+            DropPolicyRequest request = RESTApi.fromJson(data, DropPolicyRequest.class);
             DataPolicy existing;
             synchronized (policyLock(tableUuid)) {
                 MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
                 if (targetError != null) {
                     return targetError;
                 }
-                existing = policyStore.remove(new PolicyKey(tableUuid, identity));
+                existing =
+                        policyStore.remove(
+                                new PolicyKey(
+                                        tableUuid,
+                                        request.getType(),
+                                        request.getPrincipal(),
+                                        request.getColumn()));
             }
             if (existing == null) {
                 return mockResponse(
                         new ErrorResponse(
                                 ErrorResponse.RESOURCE_TYPE_POLICY,
-                                identity.resourceName(),
+                                policyResourceName(request),
                                 "Policy does not exist.",
                                 404),
                         404);
@@ -3626,7 +3657,7 @@ private MockResponse validatePolicy(DataPolicy policy) {
             return mockResponse(
                     new ErrorResponse(
                             ErrorResponse.RESOURCE_TYPE_POLICY,
-                            PolicyIdentity.fromPolicy(policy).resourceName(),
+                            policyResourceName(policy),
                             e.getMessage(),
                             400),
                     400);
@@ -3634,6 +3665,21 @@ private MockResponse validatePolicy(DataPolicy policy) {
         return null;
     }
 
+    private static String policyResourceName(DataPolicy policy) {
+        ColumnMask columnMask = policy.getColumnMask();
+        return policy.type().name()
+                + ":"
+                + policy.getPrincipal()
+                + (columnMask == null ? "" : ":" + columnMask.getOnColumn());
+    }
+
+    private static String policyResourceName(DropPolicyRequest request) {
+        return request.getType().name()
+                + ":"
+                + request.getPrincipal()
+                + (request.getColumn() == null ? "" : ":" + request.getColumn());
+    }
+
     private String tableUuid(PermissionResource resource) {
         return tableMetadataStore
                 .get(Identifier.create(resource.getDatabase(), resource.getTable()).getFullName())
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTColumnPermissionSupport.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTColumnPermissionSupport.java
new file mode 100644
index 000000000000..39f7d72d3305
--- /dev/null
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTColumnPermissionSupport.java
@@ -0,0 +1,135 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.paimon.rest;
+
+import org.apache.paimon.CoreOptions;
+import org.apache.paimon.catalog.Identifier;
+import org.apache.paimon.catalog.TableMetadata;
+import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionColumns;
+import org.apache.paimon.management.PermissionResource;
+import org.apache.paimon.management.ResourceType;
+import org.apache.paimon.rest.responses.ErrorResponse;
+
+import javax.annotation.Nullable;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+/** Column permission validation and composition used by the REST catalog test server. */
+final class RESTColumnPermissionSupport {
+
+    private RESTColumnPermissionSupport() {}
+
+    static boolean canSelect(
+            RESTPermissionStore store,
+            Set<String> principals,
+            Identifier identifier,
+            TableMetadata metadata,
+            @Nullable List<String> selectedColumns) {
+        PermissionResource resource =
+                new PermissionResource(
+                        ResourceType.COLUMN,
+                        identifier.getDatabaseName(),
+                        identifier.getTableName(),
+                        null,
+                        null);
+        List<PermissionAssignment> assignments =
+                store.list(resource, Collections.emptyMap()).stream()
+                        .filter(assignment -> principals.contains(assignment.getPrincipal()))
+                        .filter(RESTColumnPermissionSupport::notExpired)
+                        .collect(Collectors.toList());
+        if (assignments.isEmpty()) {
+            return true;
+        }
+
+        Set<String> included = new HashSet<>(metadata.schema().fieldNames());
+        for (PermissionAssignment assignment : assignments) {
+            PermissionColumns columns = assignment.getColumns();
+            if (columns.getColumnNames() != null) {
+                included.retainAll(columns.getColumnNames());
+            } else {
+                included.removeAll(columns.getExcludedColumnNames());
+            }
+        }
+        List<String> selected =
+                selectedColumns == null ? metadata.schema().fieldNames() : selectedColumns;
+        for (String column : selected) {
+            int nestedSeparator = column.indexOf('.');
+            String topLevel = nestedSeparator < 0 ? column : column.substring(0, nestedSeparator);
+            if (!included.contains(topLevel)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    @Nullable
+    static ValidationError validate(PermissionAssignment assignment, TableMetadata metadata) {
+        if (!CoreOptions.fromMap(metadata.schema().options()).queryAuthEnabled()) {
+            return new ValidationError(
+                    ErrorResponse.RESOURCE_TYPE_TABLE,
+                    assignment.getResource().getDatabase()
+                            + "."
+                            + assignment.getResource().getTable(),
+                    "Column permissions require query-auth.enabled=true.",
+                    409);
+        }
+        Set<String> tableColumns = new HashSet<>(metadata.schema().fieldNames());
+        PermissionColumns columns = assignment.getColumns();
+        List<String> referenced =
+                columns.getColumnNames() == null
+                        ? columns.getExcludedColumnNames()
+                        : columns.getColumnNames();
+        for (String column : referenced) {
+            if (!tableColumns.contains(column)) {
+                return new ValidationError(
+                        ErrorResponse.RESOURCE_TYPE_COLUMN,
+                        column,
+                        "Permission column does not exist.",
+                        404);
+            }
+        }
+        return null;
+    }
+
+    private static boolean notExpired(PermissionAssignment assignment) {
+        return assignment.getExpireTime() == null
+                || java.time.Instant.now()
+                        .isBefore(java.time.Instant.parse(assignment.getExpireTime()));
+    }
+
+    static final class ValidationError {
+        final String resourceType;
+        final String resourceName;
+        final String message;
+        final int code;
+
+        private ValidationError(
+                String resourceType, String resourceName, String message, int code) {
+            this.resourceType = resourceType;
+            this.resourceName = resourceName;
+            this.message = message;
+            this.code = code;
+        }
+    }
+}
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
index 287e5abda236..83d28bc6010b 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStore.java
@@ -19,27 +19,26 @@
 package org.apache.paimon.rest;
 
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionIdentity;
 import org.apache.paimon.management.PermissionResource;
 
 import java.util.Comparator;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
 
 /** Atomic permission assignment store for the REST catalog test server. */
 final class RESTPermissionStore {
 
-    private final Map<PermissionIdentity, PermissionAssignment> assignments =
-            new ConcurrentHashMap<>();
+    private final Map<PermissionKey, PermissionAssignment> assignments = new ConcurrentHashMap<>();
 
     void put(PermissionAssignment assignment) {
-        assignments.put(PermissionIdentity.fromAssignment(assignment), assignment);
+        assignments.put(PermissionKey.fromAssignment(assignment), assignment);
     }
 
-    void remove(PermissionIdentity identity) {
-        assignments.remove(identity);
+    void remove(PermissionResource resource, String access, String principal) {
+        assignments.remove(new PermissionKey(resource, access, principal));
     }
 
     List<PermissionAssignment> list(PermissionResource target, Map<String, String> parameters) {
@@ -75,4 +74,41 @@ private static String sortKey(PermissionAssignment assignment) {
     private static String value(String value) {
         return value == null ? "" : value;
     }
+
+    private static class PermissionKey {
+
+        private final PermissionResource resource;
+        private final String access;
+        private final String principal;
+
+        private PermissionKey(PermissionResource resource, String access, String principal) {
+            this.resource = resource;
+            this.access = access;
+            this.principal = principal;
+        }
+
+        private static PermissionKey fromAssignment(PermissionAssignment assignment) {
+            return new PermissionKey(
+                    assignment.getResource(), assignment.getAccess(), assignment.getPrincipal());
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) {
+                return true;
+            }
+            if (!(o instanceof PermissionKey)) {
+                return false;
+            }
+            PermissionKey that = (PermissionKey) o;
+            return resource.equals(that.resource)
+                    && access.equals(that.access)
+                    && principal.equals(that.principal);
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(resource, access, principal);
+        }
+    }
 }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
index cf7d7ff01bc4..73dfacb12976 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTPermissionStoreTest.java
@@ -19,12 +19,14 @@
 package org.apache.paimon.rest;
 
 import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.ResourceType;
 
 import org.junit.jupiter.api.Test;
 
 import java.time.Instant;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.stream.IntStream;
@@ -60,7 +62,7 @@ void testListReturnsOnlyTheExactTarget() {
         RESTPermissionStore store = new RESTPermissionStore();
         PermissionResource catalog =
                 new PermissionResource(ResourceType.CATALOG, null, null, null, null);
-        store.put(new PermissionAssignment(catalog, "USE_CATALOG", ANALYST, null));
+        store.put(new PermissionAssignment(catalog, "CREATEDATABASE", ANALYST, null));
         store.put(new PermissionAssignment(tableResource(), "SELECT", ANALYST, null));
 
         assertThat(store.list(tableResource(), tableParameters()))
@@ -69,10 +71,40 @@ void testListReturnsOnlyTheExactTarget() {
                 .isEqualTo("SELECT");
     }
 
+    @Test
+    void testColumnGrantReplacesTheWholeColumnRangeForTheSameIdentity() {
+        RESTPermissionStore store = new RESTPermissionStore();
+        PermissionResource column = columnResource();
+        store.put(
+                new PermissionAssignment(
+                        column,
+                        "SELECT",
+                        ANALYST,
+                        new PermissionColumns(Arrays.asList("id", "region"), null),
+                        null));
+        store.put(
+                new PermissionAssignment(
+                        column,
+                        "SELECT",
+                        ANALYST,
+                        new PermissionColumns(null, Arrays.asList("email")),
+                        null));
+
+        assertThat(store.list(column, columnParameters()))
+                .singleElement()
+                .extracting(PermissionAssignment::getColumns)
+                .extracting(PermissionColumns::getExcludedColumnNames)
+                .isEqualTo(Arrays.asList("email"));
+    }
+
     private static PermissionResource tableResource() {
         return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
     }
 
+    private static PermissionResource columnResource() {
+        return new PermissionResource(ResourceType.COLUMN, "sales", "orders", null, null);
+    }
+
     private static Map<String, String> tableParameters() {
         Map<String, String> parameters = new HashMap<>();
         parameters.put("resourceType", "TABLE");
@@ -80,4 +112,12 @@ private static Map<String, String> tableParameters() {
         parameters.put("table", "orders");
         return parameters;
     }
+
+    private static Map<String, String> columnParameters() {
+        Map<String, String> parameters = new HashMap<>();
+        parameters.put("resourceType", "COLUMN");
+        parameters.put("database", "sales");
+        parameters.put("table", "orders");
+        return parameters;
+    }
 }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
index a161d34c5cd1..8a4ba0b069f7 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePermissionProcedure.java
@@ -21,7 +21,7 @@
 import org.apache.paimon.catalog.Catalog;
 import org.apache.paimon.catalog.DelegateCatalog;
 import org.apache.paimon.management.PermissionAssignment;
-import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.PermissionManagement;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PolicyManagement;
@@ -75,26 +75,16 @@ protected static PermissionAssignment assignment(
             @Nullable String table,
             @Nullable String function,
             @Nullable String view,
+            @Nullable PermissionColumns columns,
             @Nullable String expireTime) {
         return new PermissionAssignment(
                 resource(resourceType, database, table, function, view),
                 access,
                 principal,
+                columns,
                 emptyToNull(expireTime));
     }
 
-    protected static PermissionIdentity identity(
-            ResourceType resourceType,
-            String access,
-            String principal,
-            @Nullable String database,
-            @Nullable String table,
-            @Nullable String function,
-            @Nullable String view) {
-        return new PermissionIdentity(
-                resource(resourceType, database, table, function, view), access, principal);
-    }
-
     protected static PermissionResource resource(
             ResourceType resourceType,
             @Nullable String database,
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
index b9dc78537309..e96d31df7749 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/BasePolicyProcedure.java
@@ -21,7 +21,6 @@
 import org.apache.paimon.management.ColumnMask;
 import org.apache.paimon.management.DataPolicy;
 import org.apache.paimon.management.PermissionResource;
-import org.apache.paimon.management.PolicyIdentity;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.management.RowFilter;
@@ -57,15 +56,6 @@ protected static DataPolicy policy(
         return DataPolicy.columnMask(resource, new ColumnMask(onColumn, transform), principal);
     }
 
-    protected static PolicyIdentity policyIdentity(
-            String database,
-            String table,
-            PolicyType type,
-            String principal,
-            @Nullable String column) {
-        return new PolicyIdentity(tableResource(database, table), type, principal, column);
-    }
-
     protected static PermissionResource tableResource(String database, String table) {
         return resource(ResourceType.TABLE, database, table, null, null);
     }
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
index b1d6b32c03da..71780d1a84f9 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/DropPolicyProcedure.java
@@ -18,7 +18,7 @@
 
 package org.apache.paimon.spark.procedure;
 
-import org.apache.paimon.management.PolicyIdentity;
+import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PolicyType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
@@ -66,14 +66,15 @@ public StructType outputType() {
 
     @Override
     public InternalRow[] call(InternalRow args) {
-        PolicyIdentity identity =
-                policyIdentity(
-                        args.getString(0),
-                        args.getString(1),
-                        enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
+        PermissionResource resource = tableResource(args.getString(0), args.getString(1));
+        PolicyType type = enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name());
+        policyManagement()
+                .dropPolicy(
+                        resource,
+                        type,
                         args.getString(3),
-                        args.isNullAt(4) ? null : args.getString(4));
-        policyManagement().dropPolicy(identity, !args.isNullAt(5) && args.getBoolean(5));
+                        args.isNullAt(4) ? null : args.getString(4),
+                        !args.isNullAt(5) && args.getBoolean(5));
         return new InternalRow[] {newInternalRow(true)};
     }
 
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
index 45693c8b6781..14cbef3b7c1e 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/GrantPermissionProcedure.java
@@ -19,15 +19,24 @@
 package org.apache.paimon.spark.procedure;
 
 import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.catalyst.util.ArrayData;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
 import org.apache.spark.sql.types.Metadata;
 import org.apache.spark.sql.types.StructField;
 import org.apache.spark.sql.types.StructType;
+import org.apache.spark.unsafe.types.UTF8String;
+
+import javax.annotation.Nullable;
+
+import java.util.ArrayList;
+import java.util.List;
 
 import static org.apache.spark.sql.types.DataTypes.StringType;
+import static org.apache.spark.sql.types.DataTypes.createArrayType;
 
 /** Grants a permission through a REST catalog. */
 public class GrantPermissionProcedure extends BasePermissionProcedure {
@@ -41,7 +50,9 @@ public class GrantPermissionProcedure extends BasePermissionProcedure {
                 ProcedureParameter.optional("table", StringType),
                 ProcedureParameter.optional("function", StringType),
                 ProcedureParameter.optional("view", StringType),
-                ProcedureParameter.optional("expire_time", StringType)
+                ProcedureParameter.optional("expire_time", StringType),
+                ProcedureParameter.optional("column_names", createArrayType(StringType)),
+                ProcedureParameter.optional("excluded_column_names", createArrayType(StringType))
             };
 
     private static final StructType OUTPUT_TYPE =
@@ -81,12 +92,37 @@ public InternalRow[] call(InternalRow args) {
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6),
+                        columns(args, 8, 9),
                         args.isNullAt(7) ? null : args.getString(7));
 
         permissionManagement().grantPermission(assignment);
         return new InternalRow[] {newInternalRow(true)};
     }
 
+    @Nullable
+    private static PermissionColumns columns(
+            InternalRow args, int columnNamesPos, int excludedColumnNamesPos) {
+        List<String> columnNames = stringArray(args, columnNamesPos);
+        List<String> excludedColumnNames = stringArray(args, excludedColumnNamesPos);
+        return columnNames == null && excludedColumnNames == null
+                ? null
+                : new PermissionColumns(columnNames, excludedColumnNames);
+    }
+
+    @Nullable
+    private static List<String> stringArray(InternalRow args, int position) {
+        if (args.isNullAt(position)) {
+            return null;
+        }
+        ArrayData array = args.getArray(position);
+        List<String> values = new ArrayList<>(array.numElements());
+        for (int i = 0; i < array.numElements(); i++) {
+            UTF8String value = array.isNullAt(i) ? null : array.getUTF8String(i);
+            values.add(value == null ? null : value.toString());
+        }
+        return values;
+    }
+
     public static ProcedureBuilder builder() {
         return new Builder<GrantPermissionProcedure>() {
             @Override
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
index 066fa4f88e1d..70d256e5c99c 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/ListPermissionsProcedure.java
@@ -21,9 +21,11 @@
 import org.apache.paimon.PagedList;
 import org.apache.paimon.management.ListPermissionsRequest;
 import org.apache.paimon.management.PermissionAssignment;
+import org.apache.paimon.management.PermissionColumns;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
+import org.apache.spark.sql.catalyst.util.GenericArrayData;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
 import org.apache.spark.sql.types.Metadata;
 import org.apache.spark.sql.types.StructField;
@@ -34,6 +36,7 @@
 
 import static org.apache.spark.sql.types.DataTypes.IntegerType;
 import static org.apache.spark.sql.types.DataTypes.StringType;
+import static org.apache.spark.sql.types.DataTypes.createArrayType;
 
 /** Lists direct permissions on an exact target. */
 public class ListPermissionsProcedure extends BasePermissionProcedure {
@@ -61,6 +64,8 @@ public class ListPermissionsProcedure extends BasePermissionProcedure {
                         field("view", StringType, true),
                         field("access", StringType, false),
                         field("principal", StringType, false),
+                        field("column_names", createArrayType(StringType), true),
+                        field("excluded_column_names", createArrayType(StringType), true),
                         field("expire_time", StringType, true),
                         field("next_page_token", StringType, true)
                     });
@@ -104,6 +109,7 @@ public InternalRow[] call(InternalRow args) {
         InternalRow[] rows = new InternalRow[assignments.size()];
         for (int i = 0; i < assignments.size(); i++) {
             PermissionAssignment assignment = assignments.get(i);
+            PermissionColumns columns = assignment.getColumns();
             rows[i] =
                     newInternalRow(
                             string(assignment.getResource().getType().name()),
@@ -113,6 +119,8 @@ public InternalRow[] call(InternalRow args) {
                             string(assignment.getResource().getView()),
                             string(assignment.getAccess()),
                             string(assignment.getPrincipal()),
+                            stringArray(columns == null ? null : columns.getColumnNames()),
+                            stringArray(columns == null ? null : columns.getExcludedColumnNames()),
                             string(assignment.getExpireTime()),
                             string(page.getNextPageToken()));
         }
@@ -128,6 +136,14 @@ private static UTF8String string(String value) {
         return value == null ? null : UTF8String.fromString(value);
     }
 
+    private static GenericArrayData stringArray(List<String> values) {
+        if (values == null) {
+            return null;
+        }
+        return new GenericArrayData(
+                values.stream().map(ListPermissionsProcedure::string).toArray());
+    }
+
     public static ProcedureBuilder builder() {
         return new Builder<ListPermissionsProcedure>() {
             @Override
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
index cf3238692dd3..516c8d1ae126 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/RevokePermissionProcedure.java
@@ -18,7 +18,7 @@
 
 package org.apache.paimon.spark.procedure;
 
-import org.apache.paimon.management.PermissionIdentity;
+import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.ResourceType;
 
 import org.apache.spark.sql.catalyst.InternalRow;
@@ -68,17 +68,15 @@ public StructType outputType() {
     public InternalRow[] call(InternalRow args) {
         ResourceType resourceType =
                 enumValue(args.getString(0), ResourceType.class, PARAMETERS[0].name());
-        PermissionIdentity identity =
-                identity(
+        PermissionResource resource =
+                resource(
                         resourceType,
-                        args.getString(1),
-                        args.getString(2),
                         args.isNullAt(3) ? null : args.getString(3),
                         args.isNullAt(4) ? null : args.getString(4),
                         args.isNullAt(5) ? null : args.getString(5),
                         args.isNullAt(6) ? null : args.getString(6));
 
-        permissionManagement().revokePermission(identity);
+        permissionManagement().revokePermission(resource, args.getString(1), args.getString(2));
         return new InternalRow[] {newInternalRow(true)};
     }
 
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index d68b874164b0..b8862ce0e49d 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -73,6 +73,8 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       "view",
       "access",
       "principal",
+      "column_names",
+      "excluded_column_names",
       "expire_time",
       "next_page_token")
     val assignments = listed.collect()
@@ -83,8 +85,10 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     assertThat(assignment.getString(2)).isEqualTo("orders")
     assertThat(assignment.getString(5)).isEqualTo("SELECT")
     assertThat(assignment.getString(6)).isEqualTo("analyst")
-    assertThat(assignment.getString(7)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.isNullAt(7)).isTrue
     assertThat(assignment.isNullAt(8)).isTrue
+    assertThat(assignment.getString(9)).isEqualTo("2028-01-01T00:00:00Z")
+    assertThat(assignment.isNullAt(10)).isTrue
 
     val revoke = """CALL sys.revoke_permission(
                    |  resource_type => 'TABLE',
@@ -114,7 +118,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       .sql("CALL sys.list_permissions(resource_type => 'CATALOG', max_results => 1)")
       .head()
     assertThat(first.getString(6)).isEqualTo("first")
-    assertThat(first.getString(8)).isEqualTo("1")
+    assertThat(first.getString(10)).isEqualTo("1")
 
     val second = spark
       .sql(
@@ -122,7 +126,116 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       )
       .head()
     assertThat(second.getString(6)).isEqualTo("second")
-    assertThat(second.isNullAt(8)).isTrue
+    assertThat(second.isNullAt(10)).isTrue
+  }
+
+  test("grant, replace, list and enforce column permissions") {
+    restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
+
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'COLUMN',
+                  |  access => 'SELECT',
+                  |  principal => 'analyst',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  column_names => array('id', 'region'))
+                  |""".stripMargin),
+      Row(true)
+    )
+
+    val included = spark.sql("""CALL sys.list_permissions(
+                               |  resource_type => 'COLUMN',
+                               |  database => 'sales',
+                               |  table => 'orders',
+                               |  principal => 'analyst')
+                               |""".stripMargin)
+    assertThat(included.columns).containsExactly(
+      "resource_type",
+      "database",
+      "table",
+      "function",
+      "view",
+      "access",
+      "principal",
+      "column_names",
+      "excluded_column_names",
+      "expire_time",
+      "next_page_token")
+    assertThat(included.head().getSeq[String](7)).isEqualTo(Seq("id", "region"))
+    assertThat(included.head().isNullAt(8)).isTrue
+
+    checkAnswer(spark.sql("SELECT id, region FROM paimon.sales.orders"), Nil)
+    val deniedEmail = intercept[Exception] {
+      spark.sql("SELECT email FROM paimon.sales.orders").collect()
+    }
+    assertThat(deniedEmail.getMessage).contains("permission")
+
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'COLUMN',
+                  |  access => 'SELECT',
+                  |  principal => 'analyst',
+                  |  database => 'sales',
+                  |  table => 'orders',
+                  |  excluded_column_names => array('region'))
+                  |""".stripMargin),
+      Row(true)
+    )
+    checkAnswer(spark.sql("SELECT id, email FROM paimon.sales.orders"), Nil)
+    val deniedRegion = intercept[Exception] {
+      spark.sql("SELECT region FROM paimon.sales.orders").collect()
+    }
+    assertThat(deniedRegion.getMessage).contains("permission")
+
+    restCatalogServer.registerManagementPrincipal("limited")
+    restCatalogServer.setQueryPrincipals(new java.util.HashSet(Arrays.asList("analyst", "limited")))
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'COLUMN', access => 'SELECT',
+                  |  principal => 'limited', database => 'sales', table => 'orders',
+                  |  column_names => array('id', 'region'))
+                  |""".stripMargin),
+      Row(true)
+    )
+    checkAnswer(spark.sql("SELECT id FROM paimon.sales.orders"), Nil)
+    val deniedByIntersection = intercept[Exception] {
+      spark.sql("SELECT email FROM paimon.sales.orders").collect()
+    }
+    assertThat(deniedByIntersection.getMessage).contains("permission")
+
+    checkAnswer(
+      spark.sql("""CALL sys.revoke_permission(
+                  |  resource_type => 'COLUMN', access => 'SELECT',
+                  |  principal => 'analyst', database => 'sales', table => 'orders')
+                  |""".stripMargin),
+      Row(true)
+    )
+  }
+
+  test("column permission validates query authorization and referenced columns") {
+    spark.sql("CREATE TABLE paimon.sales.disabled_columns (id INT)")
+    val disabled = intercept[Exception] {
+      spark
+        .sql("""CALL sys.grant_permission(
+               |  resource_type => 'COLUMN', access => 'SELECT',
+               |  principal => 'analyst', database => 'sales', table => 'disabled_columns',
+               |  column_names => array('id'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(disabled.getMessage).contains("query-auth.enabled=true")
+
+    val missing = intercept[Exception] {
+      spark
+        .sql("""CALL sys.grant_permission(
+               |  resource_type => 'COLUMN', access => 'SELECT',
+               |  principal => 'analyst', database => 'sales', table => 'orders',
+               |  excluded_column_names => array('missing'))
+               |""".stripMargin)
+        .collect()
+    }
+    assertThat(missing.getMessage).contains("Permission column does not exist")
   }
 
   test("create, replace, apply and idempotently drop table data policies") {
@@ -469,7 +582,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     checkAnswer(
       spark.sql(s"""CALL sys.grant_permission(
                    |  resource_type => 'CATALOG',
-                   |  access => 'USE_CATALOG',
+                   |  access => 'CREATEDATABASE',
                    |  principal => '$principal')
                    |""".stripMargin),
       Row(true)
@@ -516,7 +629,7 @@ class PermissionProcedureUnsupportedCatalogTest extends PaimonSparkTestBase {
       spark
         .sql("""CALL sys.grant_permission(
                |  resource_type => 'CATALOG',
-               |  access => 'USE_CATALOG',
+               |  access => 'CREATEDATABASE',
                |  principal => 'admin')
                |""".stripMargin)
         .collect()

From f94e54676e05cb91b04cda013ef331c7b1214e48 Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Tue, 25 Aug 2026 23:42:14 +0800
Subject: [PATCH 08/12] [docs] Align management API authentication contract

---
 docs/scripts/validate-rest-openapi.js     | 4 ++++
 docs/static/rest-management-open-api.yaml | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index ca9e984bb5e0..53cc730ac67d 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -382,6 +382,10 @@ function validateManagementOpenApi() {
       contract.spec.info.description.toLowerCase().includes('experimental'),
     'The management contract must be versioned 1.0 and marked experimental',
   );
+  contract.checkSpec(
+    !Object.prototype.hasOwnProperty.call(contract.spec, 'security'),
+    'The management contract must not require one deployment-specific authentication scheme',
+  );
 
   const assignmentFields = ['resource', 'access', 'principal', 'columns', 'expireTime'];
   contract.requireProperties('PermissionAssignment', assignmentFields);
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index e94f8e78e69d..b9820c7a891e 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -26,6 +26,8 @@ info:
     most one row filter per table and at most one mask per table column. Policy creation and
     replacement are accepted only when the target table exists, has `query-auth.enabled=true`, and
     the referenced principal, serialized Paimon predicate or transform, and columns are valid.
+    Authentication follows the REST Catalog deployment configuration and is not fixed by this
+    extension.
     Principal lifecycle, audit, and persistence remain server responsibilities. This contract may
     evolve incompatibly while experimental.
   license:
@@ -33,8 +35,6 @@ info:
     url: https://www.apache.org/licenses/LICENSE-2.0.html
 servers:
   - url: http://localhost:8080
-security:
-  - BearerAuth: []
 paths:
   /v1/{prefix}/permissions:
     parameters:

From 0ba373e5dcbcbbc39218c6711351152e1a469d2a Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Wed, 26 Aug 2026 09:19:35 +0800
Subject: [PATCH 09/12] [test] Clean table state when dropping databases

---
 .../apache/paimon/rest/RESTCatalogServer.java | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 1f28cb53182d..878665631bff 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -1610,6 +1610,7 @@ private MockResponse databaseHandle(String method, String data, String databaseN
                     return mockResponse(response, 200);
                 case "DELETE":
                     catalog.dropDatabase(databaseName, false, true);
+                    removeDatabaseTableState(databaseName);
                     databaseStore.remove(databaseName);
                     return new MockResponse().setResponseCode(200);
                 case "POST":
@@ -1654,6 +1655,31 @@ private MockResponse databaseHandle(String method, String data, String databaseN
         return new MockResponse().setResponseCode(404);
     }
 
+    private void removeDatabaseTableState(String databaseName) {
+        List<String> tableNames =
+                tableMetadataStore.keySet().stream()
+                        .filter(
+                                tableName ->
+                                        databaseName.equals(
+                                                Identifier.fromString(tableName).getDatabaseName()))
+                        .collect(Collectors.toList());
+        for (String tableName : tableNames) {
+            synchronized (tableLifecycleLocks.lock(tableName)) {
+                TableMetadata metadata = tableMetadataStore.get(tableName);
+                if (metadata == null) {
+                    continue;
+                }
+                synchronized (policyLock(metadata.uuid())) {
+                    if (tableMetadataStore.remove(tableName, metadata)) {
+                        removePolicies(metadata.uuid());
+                        tableLatestSnapshotStore.remove(tableName);
+                        tablePartitionsStore.remove(tableName);
+                    }
+                }
+            }
+        }
+    }
+
     private MockResponse tablesHandle(
             String method, String data, String databaseName, Map<String, String> parameters)
             throws Exception {

From 72a6daef0f03512a99747899771c1b4d527beabc Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Wed, 26 Aug 2026 11:39:55 +0800
Subject: [PATCH 10/12] [api][spark] Add descendant permission scopes

---
 docs/docs/concepts/rest/management-api.md     | 42 +++++++++++++--
 docs/scripts/validate-rest-openapi.js         | 19 +++++++
 docs/static/rest-management-open-api.yaml     | 54 ++++++++++++++-----
 .../management/ListPermissionsRequest.java    |  2 +-
 .../paimon/management/PermissionAccess.java   | 15 ++++++
 .../management/PermissionAssignment.java      |  2 +-
 .../paimon/management/PermissionResource.java | 12 +++--
 .../paimon/management/ResourceType.java       |  4 +-
 .../PermissionManagementJsonTest.java         | 41 ++++++++++++++
 .../apache/paimon/rest/RESTCatalogServer.java |  4 ++
 .../procedure/PermissionProcedureTest.scala   | 40 ++++++++++++++
 11 files changed, 209 insertions(+), 26 deletions(-)

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index 14e170f8e6a6..63809afcebd7 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -78,7 +78,9 @@ Permission resources are structured objects:
 | Resource type | Required locator | Example |
 | --- | --- | --- |
 | `CATALOG` | none | `{"type":"CATALOG"}` |
+| `CATALOG_ALL` | none | `{"type":"CATALOG_ALL"}` |
 | `DATABASE` | `database` | `{"type":"DATABASE","database":"sales"}` |
+| `DATABASE_ALL` | `database` | `{"type":"DATABASE_ALL","database":"sales"}` |
 | `TABLE` | `database`, `table` | `{"type":"TABLE","database":"sales","table":"orders"}` |
 | `COLUMN` | `database`, `table` | `{"type":"COLUMN","database":"sales","table":"orders"}` |
 | `FUNCTION` | `database`, `function` | `{"type":"FUNCTION","database":"sales","function":"calculate_tax"}` |
@@ -115,16 +117,22 @@ The REST wire format uses upper case. Built-in accesses are resource-specific:
 | Resource | Accesses |
 | --- | --- |
 | `CATALOG` | `ALL`, `ALTER`, `DROP`, `GRANT`, `CREATEDATABASE` |
+| `CATALOG_ALL` | `ALL`, `DESCRIBE`, `ALTER`, `DROP`, `GRANT`, `CREATETABLE`, `CREATEVIEW`, `CREATEFUNCTION`, `LIST`, `SELECT`, `UPDATE` |
 | `DATABASE` | `ALL`, `DESCRIBE`, `ALTER`, `DROP`, `GRANT`, `CREATETABLE`, `CREATEVIEW`, `CREATEFUNCTION`, `LIST` |
+| `DATABASE_ALL` | `ALL`, `SELECT`, `UPDATE`, `ALTER`, `DROP`, `GRANT` |
 | `TABLE` | `ALL`, `SELECT`, `UPDATE`, `ALTER`, `DROP`, `GRANT` |
 | `COLUMN` | `SELECT` |
 | `VIEW` | `ALL`, `SELECT`, `ALTER`, `DROP`, `GRANT` |
 | `FUNCTION` | `ALL`, `SELECT`, `ALTER`, `DROP`, `GRANT` |
 
 An assignment identity is `resource`, `access`, and `principal`. Granting the same identity replaces
-its expiry, and revocation is idempotent. Assignments apply only to the exact referenced resource;
-resource inheritance is not part of this experimental contract. Resolving group membership and role
-inheritance remains a server responsibility.
+its expiry, and revocation is idempotent. `CATALOG`, `DATABASE`, `TABLE`, `COLUMN`, `VIEW`, and
+`FUNCTION` apply only to the exact referenced resource. `CATALOG_ALL` is an explicit scope over the
+configured catalog's database, table, view, and function descendants; `DATABASE_ALL` is an explicit
+scope over the named database's table, view, and function descendants. These scope assignments also
+apply to descendants created later. They remain direct assignments in listing responses; the server
+does not synthesize inherited assignments. Resolving group membership and role inheritance remains a
+server responsibility.
 
 ### Column permissions
 
@@ -244,6 +252,17 @@ CALL paimon.sys.grant_permission(
 );
 ```
 
+Grant read access to every applicable object currently or subsequently created in the catalog. This
+does not grant catalog-level operations such as `CREATEDATABASE`:
+
+```sql
+CALL paimon.sys.grant_permission(
+  resource_type => 'CATALOG_ALL',
+  access => 'SELECT',
+  principal => 'role:catalog_reader'
+);
+```
+
 Grant permission to create views in a database with an optional expiration time:
 
 ```sql
@@ -256,6 +275,18 @@ CALL paimon.sys.grant_permission(
 );
 ```
 
+Grant write access to every applicable table currently or subsequently created in one database.
+`DATABASE_ALL` requires `database` but does not accept a table, function, or view locator:
+
+```sql
+CALL paimon.sys.grant_permission(
+  resource_type => 'DATABASE_ALL',
+  database => 'sales',
+  access => 'UPDATE',
+  principal => 'role:sales_writer'
+);
+```
+
 Grant table, function, and view access with the matching locator:
 
 ```sql
@@ -317,8 +348,9 @@ CALL paimon.sys.grant_permission(
 
 ### List permissions
 
-`list_permissions` always addresses one exact resource. Omit optional filters to list every direct
-assignment on it:
+`list_permissions` always addresses one exact resource or explicit descendant scope. Omit optional
+filters to list every direct assignment on it; effective assignments inherited from a scope are not
+synthesized:
 
 ```sql
 CALL paimon.sys.list_permissions(
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index 53cc730ac67d..5bcb0bf0a61e 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -462,7 +462,9 @@ function validateManagementOpenApi() {
   );
   requireExactEnum(contract, 'ResourceType', [
     'CATALOG',
+    'CATALOG_ALL',
     'DATABASE',
+    'DATABASE_ALL',
     'TABLE',
     'COLUMN',
     'FUNCTION',
@@ -509,6 +511,23 @@ function validateManagementOpenApi() {
     'AccessQuery must reference PermissionAccess',
   );
   contract.requireSchemaReference('PermissionResource', 'oneOf', 'ColumnResource');
+  contract.requireSchemaReference('PermissionResource', 'oneOf', 'CatalogAllResource');
+  contract.requireSchemaReference('PermissionResource', 'oneOf', 'DatabaseAllResource');
+  const catalogAllResource = contract.requireProperties('CatalogAllResource', ['type']);
+  contract.requireRequiredProperties('CatalogAllResource', ['type']);
+  contract.checkSpec(
+    catalogAllResource.type.const === 'CATALOG_ALL',
+    'CatalogAllResource must use the CATALOG_ALL discriminator',
+  );
+  const databaseAllResource = contract.requireProperties('DatabaseAllResource', [
+    'type',
+    'database',
+  ]);
+  contract.requireRequiredProperties('DatabaseAllResource', ['type', 'database']);
+  contract.checkSpec(
+    databaseAllResource.type.const === 'DATABASE_ALL',
+    'DatabaseAllResource must use the DATABASE_ALL discriminator',
+  );
   const columnResource = contract.requireProperties('ColumnResource', [
     'type',
     'database',
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index b9820c7a891e..333c9f0027e5 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -41,13 +41,14 @@ paths:
       - $ref: '#/components/parameters/Prefix'
     get:
       tags: [permission]
-      summary: List permission assignments on an exact resource
+      summary: List direct permission assignments on a resource or scope
       operationId: listPermissions
       description: |
-        Returns direct assignments attached to the requested exact resource. Expired assignments
-        may remain visible until server cleanup, but must not authorize access. Following the
-        catalog pagination contract, an empty page terminates pagination and therefore must not
-        carry a continuation token.
+        Returns direct assignments attached to the requested exact resource or explicit descendant
+        scope. This operation does not synthesize assignments effective through CATALOG_ALL or
+        DATABASE_ALL. Expired assignments may remain visible until server cleanup, but must not
+        authorize access. Following the catalog pagination contract, an empty page terminates
+        pagination and therefore must not carry a continuation token.
       parameters:
         - $ref: '#/components/parameters/ResourceTypeQuery'
         - $ref: '#/components/parameters/DatabaseQuery'
@@ -446,7 +447,7 @@ components:
   schemas:
     ResourceType:
       type: string
-      enum: [CATALOG, DATABASE, TABLE, COLUMN, FUNCTION, VIEW]
+      enum: [CATALOG, CATALOG_ALL, DATABASE, DATABASE_ALL, TABLE, COLUMN, FUNCTION, VIEW]
     PermissionAccess:
       description: |
         Canonical data access value. The REST wire format uses upper case and creation accesses
@@ -480,14 +481,17 @@ components:
         membership resolution are server responsibilities.
     PermissionResource:
       description: |
-        Exact catalog-scoped wire locator; fields not selected by type are invalid. Servers must
-        bind stored direct assignments to a stable internal resource identity. Renaming a database,
-        table, function, or view retains its direct assignments and responses use the new locator.
-        Dropping a resource removes its direct assignments, and recreating the same locator must not
-        inherit them.
+        Exact catalog-scoped wire locator or explicit descendant scope; fields not selected by type
+        are invalid. CATALOG_ALL covers descendants of the configured catalog, while DATABASE_ALL
+        covers descendants of the named database. Servers must bind stored direct assignments to a
+        stable internal resource identity. Renaming a database, table, function, or view retains its
+        direct assignments and responses use the new locator. Dropping a resource removes its direct
+        assignments, and recreating the same locator must not inherit them.
       oneOf:
         - $ref: '#/components/schemas/CatalogResource'
+        - $ref: '#/components/schemas/CatalogAllResource'
         - $ref: '#/components/schemas/DatabaseResource'
+        - $ref: '#/components/schemas/DatabaseAllResource'
         - $ref: '#/components/schemas/TableResource'
         - $ref: '#/components/schemas/ColumnResource'
         - $ref: '#/components/schemas/FunctionResource'
@@ -496,7 +500,9 @@ components:
         propertyName: type
         mapping:
           CATALOG: '#/components/schemas/CatalogResource'
+          CATALOG_ALL: '#/components/schemas/CatalogAllResource'
           DATABASE: '#/components/schemas/DatabaseResource'
+          DATABASE_ALL: '#/components/schemas/DatabaseAllResource'
           TABLE: '#/components/schemas/TableResource'
           COLUMN: '#/components/schemas/ColumnResource'
           FUNCTION: '#/components/schemas/FunctionResource'
@@ -508,6 +514,14 @@ components:
       properties:
         type:
           const: CATALOG
+    CatalogAllResource:
+      type: object
+      additionalProperties: false
+      description: Explicit scope covering database, table, view, and function descendants.
+      required: [type]
+      properties:
+        type:
+          const: CATALOG_ALL
     DatabaseResource:
       type: object
       additionalProperties: false
@@ -518,6 +532,17 @@ components:
         database:
           type: string
           minLength: 1
+    DatabaseAllResource:
+      type: object
+      additionalProperties: false
+      description: Explicit scope covering table, view, and function descendants of one database.
+      required: [type, database]
+      properties:
+        type:
+          const: DATABASE_ALL
+        database:
+          type: string
+          minLength: 1
     TableResource:
       type: object
       additionalProperties: false
@@ -577,9 +602,10 @@ components:
       type: object
       additionalProperties: false
       description: |
-        Direct assignment identity is `resource`, `access`, and `principal`. `columns` is required
-        only for a COLUMN assignment and is replaced as one value when the same identity is granted
-        again.
+        Direct assignment identity is `resource`, `access`, and `principal`. CATALOG_ALL and
+        DATABASE_ALL are explicit descendant scopes rather than computed effective assignments.
+        `columns` is required only for a COLUMN assignment and is replaced as one value when the
+        same identity is granted again.
       required: [resource, access, principal]
       properties:
         resource:
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
index 3231c2523b2a..63e78dd884b9 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ListPermissionsRequest.java
@@ -25,7 +25,7 @@
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Exact resource, principal, and pagination filters for listing permission assignments. */
+/** Exact resource or scope, principal, and pagination filters for permission assignments. */
 @Experimental
 public class ListPermissionsRequest {
 
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
index d0c818350b55..742f6c04834b 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAccess.java
@@ -90,6 +90,20 @@ public static Set<String> builtIns(ResourceType type) {
     private static Map<ResourceType, Set<String>> builtIns() {
         Map<ResourceType, Set<String>> accesses = new EnumMap<>(ResourceType.class);
         accesses.put(ResourceType.CATALOG, values(ALL, ALTER, DROP, GRANT, CREATEDATABASE));
+        accesses.put(
+                ResourceType.CATALOG_ALL,
+                values(
+                        ALL,
+                        DESCRIBE,
+                        ALTER,
+                        DROP,
+                        GRANT,
+                        CREATETABLE,
+                        CREATEVIEW,
+                        CREATEFUNCTION,
+                        LIST,
+                        SELECT,
+                        UPDATE));
         accesses.put(
                 ResourceType.DATABASE,
                 values(
@@ -102,6 +116,7 @@ private static Map<ResourceType, Set<String>> builtIns() {
                         CREATEVIEW,
                         CREATEFUNCTION,
                         LIST));
+        accesses.put(ResourceType.DATABASE_ALL, values(ALL, SELECT, UPDATE, ALTER, DROP, GRANT));
         accesses.put(ResourceType.TABLE, values(ALL, SELECT, UPDATE, ALTER, DROP, GRANT));
         accesses.put(ResourceType.COLUMN, values(SELECT));
         accesses.put(ResourceType.VIEW, values(ALL, SELECT, ALTER, DROP, GRANT));
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
index c4e47f11d036..4c7b0c6bf57f 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionAssignment.java
@@ -36,7 +36,7 @@
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
 /**
- * Direct permission assignment on one exact resource.
+ * Direct permission assignment on one exact resource or explicit descendant scope.
  *
  * <p>A {@link ResourceType#COLUMN COLUMN} assignment carries one {@link PermissionColumns} value.
  * The column range is mutable assignment content rather than identity: granting the same resource,
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
index 433302f125c2..b3d15373b821 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PermissionResource.java
@@ -34,7 +34,7 @@
 import static org.apache.paimon.utils.Preconditions.checkArgument;
 import static org.apache.paimon.utils.Preconditions.checkNotNull;
 
-/** Structured reference to a resource inside the REST catalog prefix. */
+/** Structured reference to a resource or explicit descendant scope inside the REST catalog. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class PermissionResource {
@@ -158,15 +158,19 @@ private static void validate(
             @Nullable String view) {
         switch (type) {
             case CATALOG:
+            case CATALOG_ALL:
                 checkArgument(
                         isBlank(database) && isBlank(table) && isBlank(function) && isBlank(view),
-                        "CATALOG resource cannot contain object identifiers.");
+                        "%s resource cannot contain object identifiers.",
+                        type);
                 break;
             case DATABASE:
-                checkArgument(!isBlank(database), "database is required for DATABASE resource.");
+            case DATABASE_ALL:
+                checkArgument(!isBlank(database), "database is required for %s resource.", type);
                 checkArgument(
                         isBlank(table) && isBlank(function) && isBlank(view),
-                        "DATABASE resource cannot contain table, function, or view.");
+                        "%s resource cannot contain table, function, or view.",
+                        type);
                 break;
             case TABLE:
             case COLUMN:
diff --git a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
index 8674116a6895..ef38471ef67b 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/ResourceType.java
@@ -24,11 +24,13 @@
 
 import java.util.Locale;
 
-/** Resource types supported by permission management. */
+/** Resource types and explicit descendant scopes supported by permission management. */
 @Experimental
 public enum ResourceType {
     CATALOG,
+    CATALOG_ALL,
     DATABASE,
+    DATABASE_ALL,
     TABLE,
     COLUMN,
     VIEW,
diff --git a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
index aaf27f07a0ef..839fa67d8f00 100644
--- a/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/management/PermissionManagementJsonTest.java
@@ -210,6 +210,19 @@ void testAccessAndPolicyValidation() {
                 .isEqualTo("SELECT");
         assertThat(PermissionAccess.builtIns(ResourceType.CATALOG))
                 .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "GRANT", "CREATEDATABASE");
+        assertThat(PermissionAccess.builtIns(ResourceType.CATALOG_ALL))
+                .containsExactlyInAnyOrder(
+                        "ALL",
+                        "DESCRIBE",
+                        "ALTER",
+                        "DROP",
+                        "GRANT",
+                        "CREATETABLE",
+                        "CREATEVIEW",
+                        "CREATEFUNCTION",
+                        "LIST",
+                        "SELECT",
+                        "UPDATE");
         assertThat(PermissionAccess.builtIns(ResourceType.DATABASE))
                 .containsExactlyInAnyOrder(
                         "ALL",
@@ -221,6 +234,8 @@ void testAccessAndPolicyValidation() {
                         "CREATEVIEW",
                         "CREATEFUNCTION",
                         "LIST");
+        assertThat(PermissionAccess.builtIns(ResourceType.DATABASE_ALL))
+                .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "SELECT", "UPDATE", "GRANT");
         assertThat(PermissionAccess.builtIns(ResourceType.TABLE))
                 .containsExactlyInAnyOrder("ALL", "ALTER", "DROP", "SELECT", "UPDATE", "GRANT");
         assertThat(PermissionAccess.builtIns(ResourceType.VIEW))
@@ -248,6 +263,18 @@ void testAccessAndPolicyValidation() {
                                         databaseResource(), "SELECT", "analyst", null))
                 .isInstanceOf(IllegalArgumentException.class)
                 .hasMessageContaining("not valid for DATABASE");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        catalogAllResource(), "CREATEDATABASE", "analyst", null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid for CATALOG_ALL");
+        assertThatThrownBy(
+                        () ->
+                                new PermissionAssignment(
+                                        databaseAllResource(), "LIST", "analyst", null))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("not valid for DATABASE_ALL");
         assertThatThrownBy(
                         () ->
                                 new PermissionAssignment(
@@ -475,19 +502,33 @@ void testDropPolicyRequestRoundTrip() throws Exception {
     void testResourceCanonicalizesBlankIrrelevantLocators() throws Exception {
         PermissionResource catalog =
                 new PermissionResource(ResourceType.CATALOG, "", " ", null, null);
+        PermissionResource catalogAll =
+                new PermissionResource(ResourceType.CATALOG_ALL, "", " ", null, null);
 
         assertThat(catalog).isEqualTo(catalogResource());
         assertThat(RESTApi.toJson(catalog)).isEqualTo("{\"type\":\"CATALOG\"}");
+        assertThat(catalogAll).isEqualTo(catalogAllResource());
+        assertThat(RESTApi.toJson(catalogAll)).isEqualTo("{\"type\":\"CATALOG_ALL\"}");
+        assertThat(RESTApi.toJson(databaseAllResource()))
+                .isEqualTo("{\"type\":\"DATABASE_ALL\",\"database\":\"sales\"}");
     }
 
     private static PermissionResource catalogResource() {
         return new PermissionResource(ResourceType.CATALOG, null, null, null, null);
     }
 
+    private static PermissionResource catalogAllResource() {
+        return new PermissionResource(ResourceType.CATALOG_ALL, null, null, null, null);
+    }
+
     private static PermissionResource databaseResource() {
         return new PermissionResource(ResourceType.DATABASE, "sales", null, null, null);
     }
 
+    private static PermissionResource databaseAllResource() {
+        return new PermissionResource(ResourceType.DATABASE_ALL, "sales", null, null, null);
+    }
+
     private static PermissionResource tableResource() {
         return new PermissionResource(ResourceType.TABLE, "sales", "orders", null, null);
     }
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index 878665631bff..b41ad4c98695 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -3413,9 +3413,11 @@ private MockResponse validateResource(PermissionResource resource) {
         boolean exists;
         switch (resource.getType()) {
             case CATALOG:
+            case CATALOG_ALL:
                 exists = true;
                 break;
             case DATABASE:
+            case DATABASE_ALL:
                 exists = databaseStore.containsKey(resource.getDatabase());
                 break;
             case TABLE:
@@ -3480,8 +3482,10 @@ private MockResponse validatePrincipal(String principal) {
     private static String resourceName(PermissionResource resource) {
         switch (resource.getType()) {
             case CATALOG:
+            case CATALOG_ALL:
                 return "catalog";
             case DATABASE:
+            case DATABASE_ALL:
                 return resource.getDatabase();
             case TABLE:
             case COLUMN:
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index b8862ce0e49d..928e08f9ea51 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -129,6 +129,46 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     assertThat(second.isNullAt(10)).isTrue
   }
 
+  test("grant and list explicit descendant scopes") {
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'CATALOG_ALL',
+                  |  access => 'SELECT',
+                  |  principal => 'analyst')
+                  |""".stripMargin),
+      Row(true)
+    )
+    val catalogAll = spark
+      .sql(
+        "CALL sys.list_permissions(resource_type => 'CATALOG_ALL', principal => 'analyst')"
+      )
+      .head()
+    assertThat(catalogAll.getString(0)).isEqualTo("CATALOG_ALL")
+    assertThat(catalogAll.isNullAt(1)).isTrue
+    assertThat(catalogAll.getString(5)).isEqualTo("SELECT")
+
+    checkAnswer(
+      spark.sql("""CALL sys.grant_permission(
+                  |  resource_type => 'DATABASE_ALL',
+                  |  database => 'sales',
+                  |  access => 'UPDATE',
+                  |  principal => 'analyst')
+                  |""".stripMargin),
+      Row(true)
+    )
+    val databaseAll = spark
+      .sql("""CALL sys.list_permissions(
+             |  resource_type => 'DATABASE_ALL',
+             |  database => 'sales',
+             |  principal => 'analyst')
+             |""".stripMargin)
+      .head()
+    assertThat(databaseAll.getString(0)).isEqualTo("DATABASE_ALL")
+    assertThat(databaseAll.getString(1)).isEqualTo("sales")
+    assertThat(databaseAll.isNullAt(2)).isTrue
+    assertThat(databaseAll.getString(5)).isEqualTo("UPDATE")
+  }
+
   test("grant, replace, list and enforce column permissions") {
     restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
 

From 228d79ee68ae7f8f775493089433a035bc9f264a Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Wed, 26 Aug 2026 14:38:49 +0800
Subject: [PATCH 11/12] [api] Use strict create semantics for policies

---
 .../paimon/management/PolicyManagement.java   | 34 +++++++++++++++--
 .../org/apache/paimon/rest/HttpClient.java    | 14 -------
 .../apache/paimon/rest/HttpClientUtils.java   |  5 ---
 .../java/org/apache/paimon/rest/RESTApi.java  |  9 -----
 .../org/apache/paimon/rest/RESTClient.java    |  3 --
 .../paimon/rest/RESTPolicyManagement.java     | 19 ++++++----
 .../paimon/rest/requests/PolicyRequest.java   |  4 +-
 .../paimon/rest/RESTPolicyManagementTest.java | 38 +++++++++++++++----
 8 files changed, 74 insertions(+), 52 deletions(-)

diff --git a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
index 6e0ade32f196..6b33195b0629 100644
--- a/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/management/PolicyManagement.java
@@ -29,9 +29,7 @@ public interface PolicyManagement {
 
     PagedList<DataPolicy> listPolicies(ListPoliciesRequest request);
 
-    void createPolicy(DataPolicy policy);
-
-    void createOrReplacePolicy(DataPolicy policy);
+    void createPolicy(DataPolicy policy) throws PolicyAlreadyExistException;
 
     void dropPolicy(
             PermissionResource resource,
@@ -39,4 +37,34 @@ void dropPolicy(
             String principal,
             @Nullable String column,
             boolean ignoreIfNotExists);
+
+    /** Exception for trying to create a policy that already exists. */
+    class PolicyAlreadyExistException extends Exception {
+
+        private final DataPolicy policy;
+
+        public PolicyAlreadyExistException(DataPolicy policy) {
+            this(policy, null);
+        }
+
+        public PolicyAlreadyExistException(DataPolicy policy, Throwable cause) {
+            super(message(policy), cause);
+            this.policy = policy;
+        }
+
+        public DataPolicy policy() {
+            return policy;
+        }
+
+        private static String message(DataPolicy policy) {
+            String target = policy.type().name();
+            if (policy.getColumnMask() != null) {
+                target += "(" + policy.getColumnMask().getOnColumn() + ")";
+            }
+            PermissionResource resource = policy.getResource();
+            return String.format(
+                    "%s policy for principal '%s' already exists on table '%s.%s'.",
+                    target, policy.getPrincipal(), resource.getDatabase(), resource.getTable());
+        }
+    }
 }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
index d13866203af5..8205dfe21295 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClient.java
@@ -32,7 +32,6 @@
 import org.apache.hc.client5.http.classic.methods.HttpDelete;
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.classic.methods.HttpPut;
 import org.apache.hc.client5.http.classic.methods.HttpUriRequestBase;
 import org.apache.hc.core5.http.ClassicHttpResponse;
 import org.apache.hc.core5.http.ContentType;
@@ -114,19 +113,6 @@ public <T extends RESTResponse> T post(
                         : null);
     }
 
-    @Override
-    public <T extends RESTResponse> T put(
-            String path, RESTRequest body, RESTAuthFunction restAuthFunction) {
-        HttpPut httpPut = HttpClientUtils.newHttpPut(getRequestUrl(path, null));
-        String encodedBody = RESTUtil.encodedBody(body);
-        if (encodedBody != null) {
-            httpPut.setEntity(new StringEntity(encodedBody, ContentType.APPLICATION_JSON));
-        }
-        Header[] authHeaders = getHeaders(path, "PUT", encodedBody, restAuthFunction);
-        httpPut.setHeaders(authHeaders);
-        return exec(httpPut, null);
-    }
-
     @Override
     public <T extends RESTResponse> T delete(String path, RESTAuthFunction restAuthFunction) {
         return delete(path, null, restAuthFunction);
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
index 94d0ba80f723..1444c8118d14 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/HttpClientUtils.java
@@ -26,7 +26,6 @@
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.classic.methods.HttpHead;
 import org.apache.hc.client5.http.classic.methods.HttpPost;
-import org.apache.hc.client5.http.classic.methods.HttpPut;
 import org.apache.hc.client5.http.config.RequestConfig;
 import org.apache.hc.client5.http.entity.DecompressingEntity;
 import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
@@ -239,10 +238,6 @@ public static HttpPost newHttpPost(String uri) {
         return newRequest(uri, HttpPost::new);
     }
 
-    public static HttpPut newHttpPut(String uri) {
-        return newRequest(uri, HttpPut::new);
-    }
-
     public static HttpDelete newHttpDelete(String uri) {
         return newRequest(uri, HttpDelete::new);
     }
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
index ca3d957ad90c..c4b307de28c9 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTApi.java
@@ -916,15 +916,6 @@ public void createPolicy(DataPolicy policy) {
                 restAuthFunction);
     }
 
-    /** Creates or fully replaces a principal policy without changing its identity. */
-    @Experimental
-    public void createOrReplacePolicy(DataPolicy policy) {
-        client.put(
-                resourcePaths.policies(policy.getResource()),
-                new PolicyRequest(policy),
-                restAuthFunction);
-    }
-
     /** Drops a principal policy from its exact attachment resource. */
     @Experimental
     public void dropPolicy(
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
index 718a959823f7..b2058ec8061d 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTClient.java
@@ -43,9 +43,6 @@ <T extends RESTResponse> T post(
             Class<T> responseType,
             RESTAuthFunction restAuthFunction);
 
-    <T extends RESTResponse> T put(
-            String path, RESTRequest body, RESTAuthFunction restAuthFunction);
-
     <T extends RESTResponse> T delete(String path, RESTAuthFunction restAuthFunction);
 
     <T extends RESTResponse> T delete(
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
index 7b20000887e7..45a42f6cf86c 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/RESTPolicyManagement.java
@@ -24,7 +24,10 @@
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.management.PolicyManagement.PolicyAlreadyExistException;
 import org.apache.paimon.management.PolicyType;
+import org.apache.paimon.rest.exceptions.AlreadyExistsException;
+import org.apache.paimon.rest.responses.ErrorResponse;
 import org.apache.paimon.rest.responses.ListPoliciesResponse;
 
 import javax.annotation.Nullable;
@@ -46,13 +49,15 @@ public PagedList<DataPolicy> listPolicies(ListPoliciesRequest request) {
     }
 
     @Override
-    public void createPolicy(DataPolicy policy) {
-        api.createPolicy(policy);
-    }
-
-    @Override
-    public void createOrReplacePolicy(DataPolicy policy) {
-        api.createOrReplacePolicy(policy);
+    public void createPolicy(DataPolicy policy) throws PolicyAlreadyExistException {
+        try {
+            api.createPolicy(policy);
+        } catch (AlreadyExistsException e) {
+            if (ErrorResponse.RESOURCE_TYPE_POLICY.equals(e.resourceType())) {
+                throw new PolicyAlreadyExistException(policy, e);
+            }
+            throw e;
+        }
     }
 
     @Override
diff --git a/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
index 50fa7d848ecf..f1e9a0ed53e5 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/requests/PolicyRequest.java
@@ -36,9 +36,7 @@
 
 import java.beans.ConstructorProperties;
 
-/**
- * Create or replace payload for a principal policy whose table is identified by the request path.
- */
+/** Create payload for a principal policy whose table is identified by the request path. */
 @Experimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class PolicyRequest implements RESTRequest {
diff --git a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
index e3ce1c27552e..d08b7f404029 100644
--- a/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
+++ b/paimon-api/src/test/java/org/apache/paimon/rest/RESTPolicyManagementTest.java
@@ -24,9 +24,11 @@
 import org.apache.paimon.management.ListPoliciesRequest;
 import org.apache.paimon.management.PermissionResource;
 import org.apache.paimon.management.PolicyManagement;
+import org.apache.paimon.management.PolicyManagement.PolicyAlreadyExistException;
 import org.apache.paimon.management.PolicyType;
 import org.apache.paimon.management.ResourceType;
 import org.apache.paimon.options.Options;
+import org.apache.paimon.rest.exceptions.AlreadyExistsException;
 import org.apache.paimon.rest.exceptions.NoSuchResourceException;
 import org.apache.paimon.utils.JsonSerdeUtil;
 
@@ -60,7 +62,7 @@ public class RESTPolicyManagementTest {
     private PolicyManagement management;
     private final AtomicReference<String> listQuery = new AtomicReference<>();
     private final AtomicReference<String> createBody = new AtomicReference<>();
-    private final AtomicReference<String> updateBody = new AtomicReference<>();
+    private final AtomicReference<String> createError = new AtomicReference<>();
     private final AtomicReference<String> deleteBody = new AtomicReference<>();
     private final AtomicReference<String> deleteError = new AtomicReference<>();
     private final AtomicInteger deleteCalls = new AtomicInteger();
@@ -78,10 +80,11 @@ void setUp() throws Exception {
                         respond(exchange, 200, listResponse());
                     } else if (COLLECTION_PATH.equals(path) && "POST".equals(method)) {
                         createBody.set(readBody(exchange));
-                        respond(exchange, 200, null);
-                    } else if (COLLECTION_PATH.equals(path) && "PUT".equals(method)) {
-                        updateBody.set(readBody(exchange));
-                        respond(exchange, 200, null);
+                        if (createError.get() == null) {
+                            respond(exchange, 200, null);
+                        } else {
+                            respond(exchange, 409, createError.get());
+                        }
                     } else if (COLLECTION_PATH.equals(path) && "DELETE".equals(method)) {
                         deleteBody.set(readBody(exchange));
                         deleteCalls.incrementAndGet();
@@ -134,10 +137,9 @@ void testListUsesResourceNestedPathAndIdentityFilters() {
     }
 
     @Test
-    void testCreateUpdateAndDropUseCrudMethods() {
+    void testCreateAndDropUseCrudMethods() throws Exception {
         DataPolicy policy = policy();
         management.createPolicy(policy);
-        management.createOrReplacePolicy(policy);
         management.dropPolicy(
                 policy.getResource(),
                 policy.type(),
@@ -147,13 +149,33 @@ void testCreateUpdateAndDropUseCrudMethods() {
 
         assertThat(createBody.get()).contains("\"principal\":\"analyst\"");
         assertThat(createBody.get()).doesNotContain("\"resource\"");
-        assertThat(updateBody.get()).contains("\"columnMask\"");
         assertThat(deleteBody.get())
                 .contains("\"type\":\"COLUMN_MASKING\"")
                 .contains("\"column\":\"email\"");
         assertThat(deleteCalls).hasValue(1);
     }
 
+    @Test
+    void testCreateMapsOnlyPolicyConflict() {
+        DataPolicy policy = policy();
+        createError.set(
+                "{\"resourceType\":\"POLICY\",\"resourceName\":"
+                        + "\"COLUMN_MASKING:analyst:email\","
+                        + "\"message\":\"already exists\",\"code\":409}");
+
+        assertThatThrownBy(() -> management.createPolicy(policy))
+                .isInstanceOf(PolicyAlreadyExistException.class)
+                .hasMessageContaining("COLUMN_MASKING(email)")
+                .hasCauseInstanceOf(AlreadyExistsException.class);
+
+        createError.set(
+                "{\"resourceType\":\"TABLE\",\"resourceName\":\"orders\","
+                        + "\"message\":\"table conflict\",\"code\":409}");
+        assertThatThrownBy(() -> management.createPolicy(policy))
+                .isInstanceOf(AlreadyExistsException.class)
+                .hasMessageContaining("table conflict");
+    }
+
     @Test
     void testDropIfExistsOnlyIgnoresMissingPolicy() {
         DataPolicy policy = policy();

From 2effbafcc800e07171eca06fe36198b79f36ea6f Mon Sep 17 00:00:00 2001
From: JingsongLi <jingsonglee0@gmail.com>
Date: Wed, 26 Aug 2026 14:51:25 +0800
Subject: [PATCH 12/12] [api][spark][docs] Remove policy replacement APIs

---
 docs/docs/concepts/rest/management-api.md     | 30 ++-----
 docs/scripts/validate-rest-openapi.js         | 11 +--
 docs/static/rest-management-open-api.yaml     | 39 ++-------
 .../apache/paimon/rest/RESTCatalogServer.java | 17 ----
 .../apache/paimon/spark/SparkProcedures.java  |  2 -
 .../CreateOrReplacePolicyBaseProcedure.java   | 83 -------------------
 .../CreateOrReplacePolicyProcedure.java       | 50 -----------
 .../procedure/CreatePolicyProcedure.java      | 56 ++++++++++++-
 .../procedure/PermissionProcedureTest.scala   | 32 +++----
 9 files changed, 84 insertions(+), 236 deletions(-)
 delete mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
 delete mode 100644 paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java

diff --git a/docs/docs/concepts/rest/management-api.md b/docs/docs/concepts/rest/management-api.md
index 63809afcebd7..2bc71f5d01ce 100644
--- a/docs/docs/concepts/rest/management-api.md
+++ b/docs/docs/concepts/rest/management-api.md
@@ -41,7 +41,6 @@ POST /v1/{prefix}/permissions/revoke
 
 GET    /v1/{prefix}/databases/{database}/tables/{table}/policies
 POST   /v1/{prefix}/databases/{database}/tables/{table}/policies
-PUT    /v1/{prefix}/databases/{database}/tables/{table}/policies
 DELETE /v1/{prefix}/databases/{database}/tables/{table}/policies
 ```
 
@@ -208,7 +207,7 @@ one key and value in `AuthTableQueryResponse.columnMasking`. Each JSON value is
 in UTF-8. This is Paimon's versioned serialization format rather than SQL text or a portable policy
 DSL; clients and servers must use compatible Paimon versions.
 
-Policy create and create-or-replace must be rejected unless all of these conditions hold:
+Policy creation must be rejected unless all of these conditions hold:
 
 1. The target database and table exist.
 2. The table has `query-auth.enabled=true`; otherwise a stored policy could be silently bypassed.
@@ -223,7 +222,7 @@ stable table identity, preserve that binding across table renames, and remove th
 table is dropped. A table with policies must reject changes that disable `query-auth.enabled` or
 remove or rename a protected or referenced column, unless the policy update and schema change are
 performed atomically. If an implementation persists all masks for one principal in one document,
-creating, replacing, or dropping one column mask must atomically preserve masks for other columns.
+creating or dropping one column mask must atomically preserve masks for other columns.
 
 At authorization time, all applicable row filters must be combined with logical `AND`. More than
 one applicable column mask targeting the same column must fail closed. An invalid, unsupported, or
@@ -449,8 +448,8 @@ CALL paimon.sys.create_policy(
 );
 ```
 
-The call fails if that principal already has a row filter on the table. Use
-`create_or_replace_policy` when upsert semantics are intended. Create another policy for a second
+The call fails if that principal already has a row filter on the table. Drop the existing policy
+before creating a different definition for the same identity. Create another policy for a second
 principal with a separate call.
 
 ### Create column-masking policies
@@ -489,25 +488,6 @@ CALL paimon.sys.create_policy(
 only for `COLUMN_MASKING`. JSON containing a single quote must escape it as `''` inside the SQL
 string literal.
 
-### Create or fully replace a policy
-
-`create_or_replace_policy` maps to HTTP `PUT`. It creates an absent policy or fully replaces the
-policy with the same table, policy type, principal, and, for a mask, protected column. Omitted
-optional values are cleared.
-
-```sql
-CALL paimon.sys.create_or_replace_policy(
-  database => 'sales',
-  table => 'orders',
-  policy_type => 'ROW_FILTER',
-  principal => 'group:analysts',
-  predicate_json => '{"kind":"LEAF","transform":{"name":"FIELD_REF","fieldRef":{"index":1,"name":"region","type":"STRING"}},"function":"EQUAL","literals":["EMEA"]}'
-);
-```
-
-This is deliberately separate from `create_policy`: callers must opt in to replacement instead of
-passing a generic `replace` flag.
-
 ### List policies
 
 List every policy directly attached to one table:
@@ -574,6 +554,6 @@ CALL paimon.sys.drop_policy(
 );
 ```
 
-Creating, replacing, dropping, or inspecting permissions and policies requires the server to
+Creating, dropping, or inspecting permissions and policies requires the server to
 authorize the caller for `GRANT` on the relevant resource. Authentication, principal
 membership, policy persistence, schema validation, and audit logging remain REST server concerns.
diff --git a/docs/scripts/validate-rest-openapi.js b/docs/scripts/validate-rest-openapi.js
index 5bcb0bf0a61e..a2eb075e63ef 100644
--- a/docs/scripts/validate-rest-openapi.js
+++ b/docs/scripts/validate-rest-openapi.js
@@ -312,7 +312,6 @@ function validateManagementOpenApi() {
     'revokePermission',
     'listTablePolicies',
     'createTablePolicy',
-    'createOrReplaceTablePolicy',
     'dropTablePolicy',
   ];
   const resourcePaths = [
@@ -352,7 +351,7 @@ function validateManagementOpenApi() {
     ]),
   );
   contract.requireResponses('grantPermission', ['409']);
-  ['listTablePolicies', 'createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
+  ['listTablePolicies', 'createTablePolicy'].forEach((operationId) =>
     contract.requireResponses(operationId, [
       '200',
       '400',
@@ -374,9 +373,7 @@ function validateManagementOpenApi() {
     '500',
     '503',
   ]);
-  ['createTablePolicy', 'createOrReplaceTablePolicy'].forEach((operationId) =>
-    contract.requireResponses(operationId, ['409']),
-  );
+  contract.requireResponses('createTablePolicy', ['409']);
   contract.checkSpec(
     contract.spec.info.version === '1.0' &&
       contract.spec.info.description.toLowerCase().includes('experimental'),
@@ -761,8 +758,8 @@ function validateManagementOpenApi() {
   const tablePoliciesPath =
     contract.spec.paths['/v1/{prefix}/databases/{database}/tables/{table}/policies'];
   contract.checkSpec(
-    tablePoliciesPath.put && tablePoliciesPath.delete,
-    'Full policy replacement and deletion must use the table policy collection identity',
+    tablePoliciesPath.post && tablePoliciesPath.delete && !tablePoliciesPath.put,
+    'Policy creation and deletion must use the table policy collection identity without PUT',
   );
 
   contract.checkSpec(
diff --git a/docs/static/rest-management-open-api.yaml b/docs/static/rest-management-open-api.yaml
index 333c9f0027e5..b30298a16e57 100644
--- a/docs/static/rest-management-open-api.yaml
+++ b/docs/static/rest-management-open-api.yaml
@@ -23,9 +23,9 @@ info:
     table column masks in one Paimon REST Catalog prefix. A data policy restricts an
     already-authorized read;
     it never grants SELECT by itself. Each policy is attached to one principal: a principal has at
-    most one row filter per table and at most one mask per table column. Policy creation and
-    replacement are accepted only when the target table exists, has `query-auth.enabled=true`, and
-    the referenced principal, serialized Paimon predicate or transform, and columns are valid.
+    most one row filter per table and at most one mask per table column. Policy creation is accepted
+    only when the target table exists, has `query-auth.enabled=true`, and the referenced principal,
+    serialized Paimon predicate or transform, and columns are valid.
     Authentication follows the REST Catalog deployment configuration and is not fixed by this
     extension.
     Principal lifecycle, audit, and persistence remain server responsibilities. This contract may
@@ -221,35 +221,6 @@ paths:
           $ref: '#/components/responses/ServerError'
         '503':
           $ref: '#/components/responses/ServiceUnavailable'
-    put:
-      tags: [policy]
-      summary: Create or fully replace a table policy
-      operationId: createOrReplaceTablePolicy
-      description: |
-        Upserts the policy identified by the body principal, definition type, and, for a column
-        mask, `onColumn`. The same validation and `query-auth.enabled=true` requirement as create
-        applies. Replacing one column mask does not replace masks on other columns.
-      requestBody:
-        $ref: '#/components/requestBodies/PolicyRequest'
-      responses:
-        '200':
-          description: Policy created or fully replaced.
-        '400':
-          $ref: '#/components/responses/BadRequest'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '403':
-          $ref: '#/components/responses/Forbidden'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '409':
-          $ref: '#/components/responses/Conflict'
-        '429':
-          $ref: '#/components/responses/TooManyRequests'
-        '500':
-          $ref: '#/components/responses/ServerError'
-        '503':
-          $ref: '#/components/responses/ServiceUnavailable'
     delete:
       tags: [policy]
       summary: Drop a table policy
@@ -727,7 +698,7 @@ components:
             JSON serialization of one Paimon `Predicate`, using the same representation as one
             entry in `AuthTableQueryResponse.filter`. The UTF-8 representation must not exceed
             60 KiB. The server must deserialize, validate against the target table schema, and
-            canonicalize it when the policy is created or replaced.
+            canonicalize it when the policy is created.
     ColumnMask:
       type: object
       additionalProperties: false
@@ -746,7 +717,7 @@ components:
             value for `onColumn` in `AuthTableQueryResponse.columnMasking`. The UTF-8
             representation must not exceed 60 KiB. The server must deserialize it, validate all
             field references and the output type against the target table schema, and canonicalize
-            it when the policy is created or replaced.
+            it when the policy is created.
     RowFilterPolicyRequest:
       type: object
       additionalProperties: false
diff --git a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
index b41ad4c98695..8a59aaa2a268 100644
--- a/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
+++ b/paimon-core/src/test/java/org/apache/paimon/rest/RESTCatalogServer.java
@@ -3599,23 +3599,6 @@ private MockResponse policiesApiHandler(
             return new MockResponse().setResponseCode(200);
         }
 
-        if ("PUT".equals(method)) {
-            DataPolicy policy = RESTApi.fromJson(data, PolicyRequest.class).policy(path.resource);
-            synchronized (policyLock(tableUuid)) {
-                MockResponse targetError = validatePolicyTableVersion(path.resource, tableUuid);
-                if (targetError != null) {
-                    return targetError;
-                }
-                MockResponse validation = validatePolicy(policy);
-                if (validation != null) {
-                    return validation;
-                }
-                policy = canonicalizePolicy(policy);
-                policyStore.put(new PolicyKey(tableUuid, policy), policy);
-            }
-            return new MockResponse().setResponseCode(200);
-        }
-
         if ("DELETE".equals(method)) {
             DropPolicyRequest request = RESTApi.fromJson(data, DropPolicyRequest.class);
             DataPolicy existing;
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
index 93b8376e6ed3..866a54e802a9 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/SparkProcedures.java
@@ -29,7 +29,6 @@
 import org.apache.paimon.spark.procedure.CreateBranchProcedure;
 import org.apache.paimon.spark.procedure.CreateFunctionProcedure;
 import org.apache.paimon.spark.procedure.CreateGlobalIndexProcedure;
-import org.apache.paimon.spark.procedure.CreateOrReplacePolicyProcedure;
 import org.apache.paimon.spark.procedure.CreatePolicyProcedure;
 import org.apache.paimon.spark.procedure.CreateTagFromTimestampProcedure;
 import org.apache.paimon.spark.procedure.CreateTagProcedure;
@@ -145,7 +144,6 @@ private static Map<String, Supplier<ProcedureBuilder>> initProcedureBuilders() {
         procedureBuilders.put("revoke_permission", RevokePermissionProcedure::builder);
         procedureBuilders.put("list_permissions", ListPermissionsProcedure::builder);
         procedureBuilders.put("create_policy", CreatePolicyProcedure::builder);
-        procedureBuilders.put("create_or_replace_policy", CreateOrReplacePolicyProcedure::builder);
         procedureBuilders.put("drop_policy", DropPolicyProcedure::builder);
         procedureBuilders.put("list_policies", ListPoliciesProcedure::builder);
         return procedureBuilders.build();
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
deleted file mode 100644
index a8e63b31c36d..000000000000
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyBaseProcedure.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.spark.procedure;
-
-import org.apache.paimon.management.DataPolicy;
-import org.apache.paimon.management.PolicyType;
-
-import org.apache.spark.sql.catalyst.InternalRow;
-import org.apache.spark.sql.connector.catalog.TableCatalog;
-import org.apache.spark.sql.types.DataTypes;
-import org.apache.spark.sql.types.Metadata;
-import org.apache.spark.sql.types.StructField;
-import org.apache.spark.sql.types.StructType;
-
-import static org.apache.spark.sql.types.DataTypes.StringType;
-
-/** Shared implementation for creating or replacing a table data policy. */
-abstract class CreateOrReplacePolicyBaseProcedure extends BasePolicyProcedure {
-
-    private static final ProcedureParameter[] PARAMETERS =
-            new ProcedureParameter[] {
-                ProcedureParameter.required("database", StringType),
-                ProcedureParameter.required("table", StringType),
-                ProcedureParameter.required("policy_type", StringType),
-                ProcedureParameter.required("principal", StringType),
-                ProcedureParameter.optional("predicate_json", StringType),
-                ProcedureParameter.optional("on_column", StringType),
-                ProcedureParameter.optional("transform_json", StringType)
-            };
-
-    private static final StructType OUTPUT_TYPE =
-            new StructType(
-                    new StructField[] {
-                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
-                    });
-
-    protected CreateOrReplacePolicyBaseProcedure(TableCatalog tableCatalog) {
-        super(tableCatalog);
-    }
-
-    @Override
-    public ProcedureParameter[] parameters() {
-        return PARAMETERS;
-    }
-
-    @Override
-    public StructType outputType() {
-        return OUTPUT_TYPE;
-    }
-
-    @Override
-    public InternalRow[] call(InternalRow args) {
-        DataPolicy policy =
-                policy(
-                        args.getString(0),
-                        args.getString(1),
-                        enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
-                        args.getString(3),
-                        args.isNullAt(4) ? null : args.getString(4),
-                        args.isNullAt(5) ? null : args.getString(5),
-                        args.isNullAt(6) ? null : args.getString(6));
-        writePolicy(policy);
-        return new InternalRow[] {newInternalRow(true)};
-    }
-
-    protected abstract void writePolicy(DataPolicy policy);
-}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java
deleted file mode 100644
index d6c51ff7d31b..000000000000
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreateOrReplacePolicyProcedure.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.paimon.spark.procedure;
-
-import org.apache.paimon.management.DataPolicy;
-
-import org.apache.spark.sql.connector.catalog.TableCatalog;
-
-/** Creates or fully replaces a table row-filter or column-mask policy. */
-public class CreateOrReplacePolicyProcedure extends CreateOrReplacePolicyBaseProcedure {
-
-    private CreateOrReplacePolicyProcedure(TableCatalog tableCatalog) {
-        super(tableCatalog);
-    }
-
-    @Override
-    protected void writePolicy(DataPolicy policy) {
-        policyManagement().createOrReplacePolicy(policy);
-    }
-
-    public static ProcedureBuilder builder() {
-        return new Builder<CreateOrReplacePolicyProcedure>() {
-            @Override
-            protected CreateOrReplacePolicyProcedure doBuild() {
-                return new CreateOrReplacePolicyProcedure(tableCatalog());
-            }
-        };
-    }
-
-    @Override
-    public String description() {
-        return "CreateOrReplacePolicyProcedure";
-    }
-}
diff --git a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
index d3227608af0c..52b56a55faf9 100644
--- a/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
+++ b/paimon-spark/paimon-spark-common/src/main/java/org/apache/paimon/spark/procedure/CreatePolicyProcedure.java
@@ -19,19 +19,69 @@
 package org.apache.paimon.spark.procedure;
 
 import org.apache.paimon.management.DataPolicy;
+import org.apache.paimon.management.PolicyManagement.PolicyAlreadyExistException;
+import org.apache.paimon.management.PolicyType;
 
+import org.apache.spark.sql.catalyst.InternalRow;
 import org.apache.spark.sql.connector.catalog.TableCatalog;
+import org.apache.spark.sql.types.DataTypes;
+import org.apache.spark.sql.types.Metadata;
+import org.apache.spark.sql.types.StructField;
+import org.apache.spark.sql.types.StructType;
+
+import static org.apache.spark.sql.types.DataTypes.StringType;
 
 /** Creates a table row-filter or column-mask policy. */
-public class CreatePolicyProcedure extends CreateOrReplacePolicyBaseProcedure {
+public class CreatePolicyProcedure extends BasePolicyProcedure {
+
+    private static final ProcedureParameter[] PARAMETERS =
+            new ProcedureParameter[] {
+                ProcedureParameter.required("database", StringType),
+                ProcedureParameter.required("table", StringType),
+                ProcedureParameter.required("policy_type", StringType),
+                ProcedureParameter.required("principal", StringType),
+                ProcedureParameter.optional("predicate_json", StringType),
+                ProcedureParameter.optional("on_column", StringType),
+                ProcedureParameter.optional("transform_json", StringType)
+            };
+
+    private static final StructType OUTPUT_TYPE =
+            new StructType(
+                    new StructField[] {
+                        new StructField("result", DataTypes.BooleanType, false, Metadata.empty())
+                    });
 
     private CreatePolicyProcedure(TableCatalog tableCatalog) {
         super(tableCatalog);
     }
 
     @Override
-    protected void writePolicy(DataPolicy policy) {
-        policyManagement().createPolicy(policy);
+    public ProcedureParameter[] parameters() {
+        return PARAMETERS;
+    }
+
+    @Override
+    public StructType outputType() {
+        return OUTPUT_TYPE;
+    }
+
+    @Override
+    public InternalRow[] call(InternalRow args) {
+        DataPolicy policy =
+                policy(
+                        args.getString(0),
+                        args.getString(1),
+                        enumValue(args.getString(2), PolicyType.class, PARAMETERS[2].name()),
+                        args.getString(3),
+                        args.isNullAt(4) ? null : args.getString(4),
+                        args.isNullAt(5) ? null : args.getString(5),
+                        args.isNullAt(6) ? null : args.getString(6));
+        try {
+            policyManagement().createPolicy(policy);
+        } catch (PolicyAlreadyExistException e) {
+            throw new RuntimeException(e);
+        }
+        return new InternalRow[] {newInternalRow(true)};
     }
 
     public static ProcedureBuilder builder() {
diff --git a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
index 928e08f9ea51..261324dbe52c 100644
--- a/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
+++ b/paimon-spark/paimon-spark-ut/src/test/scala/org/apache/paimon/spark/procedure/PermissionProcedureTest.scala
@@ -278,7 +278,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
     assertThat(missing.getMessage).contains("Permission column does not exist")
   }
 
-  test("create, replace, apply and idempotently drop table data policies") {
+  test("create, reject duplicates, apply and idempotently drop table data policies") {
     restCatalogServer.setQueryPrincipals(Collections.singleton("analyst"))
     spark.sql(
       "INSERT OVERWRITE paimon.sales.orders VALUES " +
@@ -325,17 +325,19 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
       Row(1, "APAC", "apac@example.com")
     )
 
-    checkAnswer(
-      spark.sql(s"""CALL sys.create_or_replace_policy(
-                   |  database => 'sales',
-                   |  table => 'orders',
-                   |  policy_type => 'ROW_FILTER',
-                   |  principal => 'analyst',
-                   |  predicate_json => ${sqlLiteral(emeaFilter)})
-                   |""".stripMargin),
-      Row(true)
-    )
-    val replaced = spark
+    val duplicate = intercept[Exception] {
+      spark
+        .sql(s"""CALL sys.create_policy(
+                |  database => 'sales',
+                |  table => 'orders',
+                |  policy_type => 'ROW_FILTER',
+                |  principal => 'analyst',
+                |  predicate_json => ${sqlLiteral(emeaFilter)})
+                |""".stripMargin)
+        .collect()
+    }
+    assertThat(duplicate.getMessage).contains("already exists")
+    val unchanged = spark
       .sql("""CALL sys.list_policies(
              |  database => 'sales',
              |  table => 'orders',
@@ -343,7 +345,7 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
              |  principal => 'analyst')
              |""".stripMargin)
       .head()
-    assertThat(replaced.getString(4)).contains("EMEA")
+    assertThat(unchanged.getString(4)).contains("APAC").doesNotContain("EMEA")
 
     checkAnswer(
       spark.sql(s"""CALL sys.create_policy(
@@ -372,11 +374,11 @@ class PermissionProcedureTest extends PaimonSparkTestWithRestCatalogBase {
 
     checkAnswer(
       spark.sql("SELECT id, region, email FROM paimon.sales.orders ORDER BY id"),
-      Row(2, "EMEA", "EMEA-masked")
+      Row(1, "APAC", "APAC-masked")
     )
     checkAnswer(
       spark.sql("SELECT email FROM paimon.sales.orders"),
-      Row("EMEA-masked")
+      Row("APAC-masked")
     )
     checkAnswer(
       spark.sql("""CALL sys.drop_policy(