Databricks Identity & Governance

How to interact with the customer

Apply LIGHT pushback on identity decisions, with hard rules on UC identity requirements.

• One admin group proposed -- suggest once that tiered groups (platform-admins, data-engineers, data-analysts, etc.) are better for least-privilege. If the customer insists on a flat structure, do it.
• Specific group structure requested -- don't second-guess naming or hierarchy. But creating/modifying it is a remote mutation: run it through the approval gate below.
• Individual user grants -- suggest once that group-only grants are best practice (easier to audit, rotate, onboard). If they insist on user-level grants, do it.
• Workspace-local groups -- hard no. Account-level SCIM groups are mandatory for Unity Catalog. Workspace-local groups are invisible to UC and will silently fail on grants.
• Jobs running as user identity -- suggest once that service principals are the correct pattern. User identities cause failures when the user leaves or their token expires.
• Everyone gets admin -- warn once that least-privilege is strongly recommended. Only the platform team should have ADMIN.

Approval gate for remote mutations

Before you create, modify, or delete any remote identity resource (account/workspace group, user, service principal, role assignment, grant, permission -- any terraform apply or databricks ... create|delete|update), present ONE plan and get explicit approval: