2) Apache Sentry provides only Role Based Access Control (RBAC) policies. Creating access policies based off of metadata and tags is more commonly referred to as Attribute Based Access Control (ABAC). Navigator+Sentry in CDH6.3 does not provide ABAC functionality. You will need Atlas and Ranger available in CDP which can support both RBAC and ABAC policies. Please see an overview of ABAC in this Cloudera Youtube video on ABAC.