[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F66SEZBXZFG71RPRYV47NG":3,"skill-same:01M6F66SEZBXZFG71RPRYV47NG":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6F66SEZBXZFG71RPRYV47NG","databricks-enterprise-rbac",null,"Configure Databricks enterprise SSO, Unity Catalog RBAC, and organization management.\nUse when implementing SSO integration, configuring role-based permissions,\nor setting up organization-level controls with Unity Catalog.\nTrigger with phrases like \"databricks SSO\", \"databricks RBAC\",\n\"databricks enterprise\", \"unity catalog permissions\", \"databricks SCIM\".","Dicklesworthstone\u002Fpi_agent_rust","Dicklesworthstone","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F35050222?v=4","01M6CG26AR942CSVMN1M5E3DSE","Jeff Emanuel","01M6CG26EPP71PSHW1VDS71121",1986,"MIT","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdatabricks-pack\u002Fskills\u002Fdatabricks-enterprise-rbac\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"rbac","databricks","Enterprise","databricks enterprise rbac","when","implementing","controls","unity","trigger","io","organization","up","use","catalog","edit","write","read","configure","Bash","scim","sso","permissions","2026-11-10 10:12:30",false,"---\nname: databricks-enterprise-rbac\ndescription: |\n  Configure Databricks enterprise SSO, Unity Catalog RBAC, and organization management.\n  Use when implementing SSO integration, configuring role-based permissions,\n  or setting up organization-level controls with Unity Catalog.\n  Trigger with phrases like \"databricks SSO\", \"databricks RBAC\",\n  \"databricks enterprise\", \"unity catalog permissions\", \"databricks SCIM\".\nallowed-tools: Read, Write, Edit, Bash(databricks:*)\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\n---\n\n# Databricks Enterprise RBAC\n\n## Overview\nConfigure enterprise-grade access control using Unity Catalog and SSO.\n\n## Prerequisites\n- Databricks Enterprise or Premium tier\n- Unity Catalog enabled\n- Identity Provider (IdP) with SAML\u002FSCIM support\n- Account admin access\n\n## Role Definitions\n\n| Role | Unity Catalog Privileges | Use Case |\n|------|-------------------------|----------|\n| Data Admin | ALL PRIVILEGES on catalogs | Platform administrators |\n| Data Engineer | CREATE, MODIFY, SELECT on schemas | Pipeline development |\n| Data Analyst | SELECT on gold tables | Analytics and reporting |\n| Data Scientist | SELECT + ML privileges | Model training |\n| Viewer | SELECT on specific views | Business stakeholders |\n\n## Instructions\n\n### Step 1: Configure Identity Provider (SCIM)\n\n```python\n# scripts\u002Fsetup_scim.py\nfrom databricks.sdk import AccountClient\nfrom databricks.sdk.service.iam import (\n    Group,\n    User,\n    ServicePrincipal,\n)\n\ndef setup_account_groups(client: AccountClient) -> dict:\n    \"\"\"\n    Set up standard account-level groups.\n\n    These groups are synced from IdP via SCIM.\n    \"\"\"\n    standard_groups = [\n        {\n            \"display_name\": \"data-platform-admins\",\n            \"description\": \"Full platform administration\"\n        },\n        {\n            \"display_name\": \"data-engineers\",\n            \"description\": \"Data pipeline development\"\n        },\n        {\n            \"display_name\": \"data-analysts\",\n            \"description\": \"Analytics and reporting\"\n        },\n        {\n            \"display_name\": \"data-scientists\",\n            \"description\": \"ML and experimentation\"\n        },\n        {\n            \"display_name\": \"data-viewers\",\n            \"description\": \"Read-only business users\"\n        },\n    ]\n\n    created_groups = {}\n    for group_config in standard_groups:\n        group = client.groups.create(\n            display_name=group_config[\"display_name\"],\n        )\n        created_groups[group_config[\"display_name\"]] = group.id\n\n    return created_groups\n\n# SCIM Configuration for Azure AD\nscim_config = {\n    \"token_endpoint\": \"https:\u002F\u002Faccounts.azuredatabricks.net\u002Fscim\u002Fv2\",\n    \"bearer_token\": \"\u003Caccount-level-pat>\",\n    \"attribute_mappings\": {\n        \"userName\": \"userPrincipalName\",\n        \"displayName\": \"displayName\",\n        \"emails[type eq \\\"work\\\"].value\": \"mail\",\n        \"groups\": \"memberOf\",\n    }\n}\n```\n\n### Step 2: Unity Catalog Permission Model\n\n```sql\n-- Create catalog hierarchy\nCREATE CATALOG IF NOT EXISTS enterprise_data;\n\n-- Create standard schemas\nCREATE SCHEMA IF NOT EXISTS enterprise_data.bronze\nCOMMENT 'Raw ingested data';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.silver\nCOMMENT 'Cleansed and conformed data';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.gold\nCOMMENT 'Business-ready aggregations';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.ml_features\nCOMMENT 'ML feature store';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.sandbox\nCOMMENT 'Experimentation sandbox';\n\n-- Grant catalog-level permissions\n-- Data Admins: Full control\nGRANT ALL PRIVILEGES ON CATALOG enterprise_data TO `data-platform-admins`;\n\n-- Data Engineers: Create\u002Fmodify in bronze\u002Fsilver, read gold\nGRANT USAGE ON CATALOG enterprise_data TO `data-engineers`;\nGRANT CREATE, USAGE ON SCHEMA enterprise_data.bronze TO `data-engineers`;\nGRANT CREATE, USAGE ON SCHEMA enterprise_data.silver TO `data-engineers`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-engineers`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-engineers`;\n\n-- Data Analysts: Read gold, create in sandbox\nGRANT USAGE ON CATALOG enterprise_data TO `data-analysts`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-analysts`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-analysts`;\n\n-- Data Scientists: Read silver\u002Fgold, manage ML features\nGRANT USAGE ON CATALOG enterprise_data TO `data-scientists`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.silver TO `data-scientists`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-scientists`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.ml_features TO `data-scientists`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-scientists`;\n\n-- Viewers: Read-only on gold\nGRANT USAGE ON CATALOG enterprise_data TO `data-viewers`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-viewers`;\n```\n\n### Step 3: Workspace-Level Permissions\n\n```python\n# scripts\u002Fworkspace_permissions.py\nfrom databricks.sdk import WorkspaceClient\nfrom databricks.sdk.service.iam import PermissionLevel\n\ndef configure_workspace_permissions(w: WorkspaceClient):\n    \"\"\"Configure workspace-level permissions.\"\"\"\n\n    # Cluster permissions\n    cluster_policies = {\n        \"data-engineers\": \"CAN_USE\",\n        \"data-scientists\": \"CAN_USE\",\n        \"data-analysts\": \"CAN_ATTACH_TO\",\n    }\n\n    # Get all cluster policies\n    for policy in w.cluster_policies.list():\n        for group, permission in cluster_policies.items():\n            w.permissions.update(\n                object_type=\"cluster-policies\",\n                object_id=policy.policy_id,\n                access_control_list=[{\n                    \"group_name\": group,\n                    \"permission_level\": permission,\n                }]\n            )\n\n    # SQL Warehouse permissions\n    for warehouse in w.warehouses.list():\n        w.permissions.update(\n            object_type=\"sql\u002Fwarehouses\",\n            object_id=warehouse.id,\n            access_control_list=[\n                {\"group_name\": \"data-analysts\", \"permission_level\": \"CAN_USE\"},\n                {\"group_name\": \"data-engineers\", \"permission_level\": \"CAN_MANAGE\"},\n            ]\n        )\n\n    # Workspace folder permissions\n    folder_permissions = {\n        \"\u002FShared\u002FProduction\": {\n            \"data-platform-admins\": \"CAN_MANAGE\",\n            \"data-engineers\": \"CAN_RUN\",\n            \"data-analysts\": \"CAN_READ\",\n        },\n        \"\u002FShared\u002FDevelopment\": {\n            \"data-engineers\": \"CAN_MANAGE\",\n            \"data-scientists\": \"CAN_MANAGE\",\n            \"data-analysts\": \"CAN_EDIT\",\n        },\n    }\n\n    for folder, permissions in folder_permissions.items():\n        acl = [\n            {\"group_name\": group, \"permission_level\": level}\n            for group, level in permissions.items()\n        ]\n        w.workspace.set_permissions(path=folder, access_control_list=acl)\n```\n\n### Step 4: Service Principal Management\n\n```python\n# scripts\u002Fservice_principals.py\nfrom databricks.sdk import AccountClient, WorkspaceClient\nfrom databricks.sdk.service.iam import ServicePrincipal\n\ndef create_service_principal(\n    account_client: AccountClient,\n    workspace_client: WorkspaceClient,\n    name: str,\n    purpose: str,\n    workspace_permissions: dict,\n) -> dict:\n    \"\"\"\n    Create and configure a service principal.\n\n    Args:\n        account_client: Account-level client\n        workspace_client: Workspace-level client\n        name: Service principal name\n        purpose: Description\u002Fpurpose\n        workspace_permissions: Dict of {object_type: permission_level}\n\n    Returns:\n        Service principal details\n    \"\"\"\n    # Create at account level\n    sp = account_client.service_principals.create(\n        display_name=name,\n        active=True,\n    )\n\n    # Create OAuth secret\n    secret = account_client.service_principal_secrets.create(\n        service_principal_id=sp.id,\n    )\n\n    # Add to workspace groups based on purpose\n    group_mappings = {\n        \"etl-pipeline\": \"data-engineers\",\n        \"ml-training\": \"data-scientists\",\n        \"reporting\": \"data-analysts\",\n    }\n\n    if purpose in group_mappings:\n        group_name = group_mappings[purpose]\n        # Add SP to group (via SCIM or API)\n\n    # Set workspace-level permissions\n    for obj_type, permission in workspace_permissions.items():\n        workspace_client.permissions.update(\n            object_type=obj_type,\n            object_id=\"*\",  # All objects of type\n            access_control_list=[{\n                \"service_principal_name\": sp.application_id,\n                \"permission_level\": permission,\n            }]\n        )\n\n    return {\n        \"id\": sp.id,\n        \"application_id\": sp.application_id,\n        \"client_secret\": secret.secret,  # Store securely!\n    }\n\n# Create standard service principals\nservice_principals = [\n    {\n        \"name\": \"etl-pipeline-sp\",\n        \"purpose\": \"etl-pipeline\",\n        \"permissions\": {\n            \"clusters\": \"CAN_ATTACH_TO\",\n            \"jobs\": \"CAN_MANAGE\",\n        }\n    },\n    {\n        \"name\": \"ml-training-sp\",\n        \"purpose\": \"ml-training\",\n        \"permissions\": {\n            \"clusters\": \"CAN_MANAGE\",\n            \"mlflow-experiments\": \"CAN_MANAGE\",\n        }\n    },\n]\n```\n\n### Step 5: Audit and Compliance\n\n```sql\n-- Query audit logs for access patterns\nSELECT\n    event_time,\n    user_identity.email as user_email,\n    service_name,\n    action_name,\n    request_params,\n    response.status_code\nFROM system.access.audit\nWHERE event_date > current_date() - INTERVAL 7 DAYS\n  AND service_name IN ('unityCatalog', 'clusters', 'jobs')\nORDER BY event_time DESC\nLIMIT 100;\n\n-- Permission changes audit\nSELECT\n    event_time,\n    user_identity.email as changed_by,\n    action_name,\n    request_params:full_name_arg as resource,\n    request_params:changes as permission_changes\nFROM system.access.audit\nWHERE action_name LIKE '%Grant%' OR action_name LIKE '%Revoke%'\n  AND event_date > current_date() - INTERVAL 30 DAYS\nORDER BY event_time DESC;\n\n-- Privileged access report\nSELECT DISTINCT\n    grantee,\n    privilege,\n    object_type,\n    object_name\nFROM system.information_schema.object_privileges\nWHERE privilege IN ('ALL PRIVILEGES', 'CREATE', 'MODIFY')\nORDER BY grantee, object_type;\n```\n\n### Step 6: Access Review Automation\n\n```python\n# scripts\u002Faccess_review.py\nfrom databricks.sdk import WorkspaceClient\nfrom datetime import datetime\nimport pandas as pd\n\ndef generate_access_review_report(w: WorkspaceClient, spark) -> pd.DataFrame:\n    \"\"\"\n    Generate access review report for compliance.\n\n    Returns DataFrame with all permissions by user\u002Fgroup.\n    \"\"\"\n    # Get Unity Catalog permissions\n    uc_permissions = spark.sql(\"\"\"\n        SELECT\n            grantee,\n            grantee_type,\n            privilege,\n            object_type,\n            object_name,\n            inherited_from\n        FROM system.information_schema.object_privileges\n        ORDER BY grantee, object_type\n    \"\"\").toPandas()\n\n    # Get workspace permissions\n    workspace_permissions = []\n    for obj_type in ['clusters', 'jobs', 'sql\u002Fwarehouses']:\n        for obj in getattr(w, obj_type.replace('\u002F', '_').replace('sql_', '')).list():\n            perms = w.permissions.get(object_type=obj_type, object_id=obj.id)\n            for acl in perms.access_control_list or []:\n                workspace_permissions.append({\n                    \"object_type\": obj_type,\n                    \"object_id\": obj.id,\n                    \"principal\": acl.user_name or acl.group_name or acl.service_principal_name,\n                    \"permission\": acl.all_permissions[0].permission_level if acl.all_permissions else None,\n                })\n\n    ws_df = pd.DataFrame(workspace_permissions)\n\n    # Combine reports\n    report = {\n        \"generated_at\": datetime.now().isoformat(),\n        \"unity_catalog_permissions\": uc_permissions,\n        \"workspace_permissions\": ws_df,\n    }\n\n    return report\n\ndef flag_excessive_permissions(report: dict) -> list[dict]:\n    \"\"\"Flag potentially excessive permissions.\"\"\"\n    flags = []\n\n    uc_df = report[\"unity_catalog_permissions\"]\n\n    # Flag ALL PRIVILEGES\n    excessive = uc_df[uc_df[\"privilege\"] == \"ALL PRIVILEGES\"]\n    for _, row in excessive.iterrows():\n        if row[\"grantee_type\"] != \"GROUP\":  # Individual users with ALL PRIVILEGES\n            flags.append({\n                \"type\": \"EXCESSIVE_PRIVILEGE\",\n                \"grantee\": row[\"grantee\"],\n                \"privilege\": row[\"privilege\"],\n                \"object\": row[\"object_name\"],\n                \"recommendation\": \"Consider using specific privileges instead of ALL PRIVILEGES\",\n            })\n\n    # Flag direct user grants (should use groups)\n    direct_grants = uc_df[uc_df[\"grantee_type\"] == \"USER\"]\n    unique_users = direct_grants[\"grantee\"].unique()\n    for user in unique_users:\n        user_grants = len(direct_grants[direct_grants[\"grantee\"] == user])\n        if user_grants > 5:\n            flags.append({\n                \"type\": \"DIRECT_USER_GRANTS\",\n                \"grantee\": user,\n                \"grant_count\": user_grants,\n                \"recommendation\": \"Consider using groups for permission management\",\n            })\n\n    return flags\n```\n\n## Output\n- SCIM integration configured\n- Unity Catalog RBAC implemented\n- Workspace permissions set\n- Service principals created\n- Audit logging enabled\n\n## Error Handling\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| SSO login fails | Wrong callback URL | Verify IdP config |\n| Permission denied | Missing grant | Check inherited permissions |\n| SCIM sync failed | Token expired | Regenerate SCIM token |\n| Group not found | Case sensitivity | Match exact group name |\n\n## Examples\n\n### Quick Permission Check\n```sql\n-- Check what a user can access\nSELECT * FROM system.information_schema.object_privileges\nWHERE grantee = 'user@company.com'\nORDER BY object_type, object_name;\n```\n\n### Grant Template\n```sql\n-- Standard data consumer access\nGRANT USAGE ON CATALOG enterprise_data TO `new-team`;\nGRANT USAGE ON SCHEMA enterprise_data.gold TO `new-team`;\nGRANT SELECT ON SCHEMA enterprise_data.gold TO `new-team`;\n```\n\n## Resources\n- [Unity Catalog Privileges](https:\u002F\u002Fdocs.databricks.com\u002Fdata-governance\u002Funity-catalog\u002Fmanage-privileges\u002Fprivileges.html)\n- [SCIM Provisioning](https:\u002F\u002Fdocs.databricks.com\u002Fadministration-guide\u002Fusers-groups\u002Fscim\u002Findex.html)\n- [Identity Federation](https:\u002F\u002Fdocs.databricks.com\u002Fadministration-guide\u002Fusers-groups\u002Fbest-practices.html)\n\n## Next Steps\nFor major migrations, see `databricks-migration-deep-dive`.\n","# Databricks Enterprise RBAC\n\n## Overview\nConfigure enterprise-grade access control using Unity Catalog and SSO.\n\n## Prerequisites\n- Databricks Enterprise or Premium tier\n- Unity Catalog enabled\n- Identity Provider (IdP) with SAML\u002FSCIM support\n- Account admin access\n\n## Role Definitions\n\n| Role | Unity Catalog Privileges | Use Case |\n|------|-------------------------|----------|\n| Data Admin | ALL PRIVILEGES on catalogs | Platform administrators |\n| Data Engineer | CREATE, MODIFY, SELECT on schemas | Pipeline development |\n| Data Analyst | SELECT on gold tables | Analytics and reporting |\n| Data Scientist | SELECT + ML privileges | Model training |\n| Viewer | SELECT on specific views | Business stakeholders |\n\n## Instructions\n\n### Step 1: Configure Identity Provider (SCIM)\n\n```python\n# scripts\u002Fsetup_scim.py\nfrom databricks.sdk import AccountClient\nfrom databricks.sdk.service.iam import (\n    Group,\n    User,\n    ServicePrincipal,\n)\n\ndef setup_account_groups(client: AccountClient) -> dict:\n    \"\"\"\n    Set up standard account-level groups.\n\n    These groups are synced from IdP via SCIM.\n    \"\"\"\n    standard_groups = [\n        {\n            \"display_name\": \"data-platform-admins\",\n            \"description\": \"Full platform administration\"\n        },\n        {\n            \"display_name\": \"data-engineers\",\n            \"description\": \"Data pipeline development\"\n        },\n        {\n            \"display_name\": \"data-analysts\",\n            \"description\": \"Analytics and reporting\"\n        },\n        {\n            \"display_name\": \"data-scientists\",\n            \"description\": \"ML and experimentation\"\n        },\n        {\n            \"display_name\": \"data-viewers\",\n            \"description\": \"Read-only business users\"\n        },\n    ]\n\n    created_groups = {}\n    for group_config in standard_groups:\n        group = client.groups.create(\n            display_name=group_config[\"display_name\"],\n        )\n        created_groups[group_config[\"display_name\"]] = group.id\n\n    return created_groups\n\n# SCIM Configuration for Azure AD\nscim_config = {\n    \"token_endpoint\": \"https:\u002F\u002Faccounts.azuredatabricks.net\u002Fscim\u002Fv2\",\n    \"bearer_token\": \"\u003Caccount-level-pat>\",\n    \"attribute_mappings\": {\n        \"userName\": \"userPrincipalName\",\n        \"displayName\": \"displayName\",\n        \"emails[type eq \\\"work\\\"].value\": \"mail\",\n        \"groups\": \"memberOf\",\n    }\n}\n```\n\n### Step 2: Unity Catalog Permission Model\n\n```sql\n-- Create catalog hierarchy\nCREATE CATALOG IF NOT EXISTS enterprise_data;\n\n-- Create standard schemas\nCREATE SCHEMA IF NOT EXISTS enterprise_data.bronze\nCOMMENT 'Raw ingested data';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.silver\nCOMMENT 'Cleansed and conformed data';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.gold\nCOMMENT 'Business-ready aggregations';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.ml_features\nCOMMENT 'ML feature store';\n\nCREATE SCHEMA IF NOT EXISTS enterprise_data.sandbox\nCOMMENT 'Experimentation sandbox';\n\n-- Grant catalog-level permissions\n-- Data Admins: Full control\nGRANT ALL PRIVILEGES ON CATALOG enterprise_data TO `data-platform-admins`;\n\n-- Data Engineers: Create\u002Fmodify in bronze\u002Fsilver, read gold\nGRANT USAGE ON CATALOG enterprise_data TO `data-engineers`;\nGRANT CREATE, USAGE ON SCHEMA enterprise_data.bronze TO `data-engineers`;\nGRANT CREATE, USAGE ON SCHEMA enterprise_data.silver TO `data-engineers`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-engineers`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-engineers`;\n\n-- Data Analysts: Read gold, create in sandbox\nGRANT USAGE ON CATALOG enterprise_data TO `data-analysts`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-analysts`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-analysts`;\n\n-- Data Scientists: Read silver\u002Fgold, manage ML features\nGRANT USAGE ON CATALOG enterprise_data TO `data-scientists`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.silver TO `data-scientists`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-scientists`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.ml_features TO `data-scientists`;\nGRANT ALL PRIVILEGES ON SCHEMA enterprise_data.sandbox TO `data-scientists`;\n\n-- Viewers: Read-only on gold\nGRANT USAGE ON CATALOG enterprise_data TO `data-viewers`;\nGRANT USAGE, SELECT ON SCHEMA enterprise_data.gold TO `data-viewers`;\n```\n\n### Step 3: Workspace-Level Permissions\n\n```python\n# scripts\u002Fworkspace_permissions.py\nfrom databricks.sdk import WorkspaceClient\nfrom databricks.sdk.service.iam import PermissionLevel\n\ndef configure_workspace_permissions(w: WorkspaceClient):\n    \"\"\"Configure workspace-level permissions.\"\"\"\n\n    # Cluster permissions\n    cluster_policies = {\n        \"data-engineers\": \"CAN_USE\",\n        \"data-scientists\": \"CAN_USE\",\n        \"data-analysts\": \"CAN_ATTACH_TO\",\n    }\n\n    # Get all cluster policies\n    for policy in w.cluster_policies.list():\n        for group, permission in cluster_policies.items():\n            w.permissions.update(\n                object_type=\"cluster-policies\",\n                object_id=policy.policy_id,\n                access_control_list=[{\n                    \"group_name\": group,\n                    \"permission_level\": permission,\n                }]\n            )\n\n    # SQL Warehouse permissions\n    for warehouse in w.warehouses.list():\n        w.permissions.update(\n            object_type=\"sql\u002Fwarehouses\",\n            object_id=warehouse.id,\n            access_control_list=[\n                {\"group_name\": \"data-analysts\", \"permission_level\": \"CAN_USE\"},\n                {\"group_name\": \"data-engineers\", \"permission_level\": \"CAN_MANAGE\"},\n            ]\n        )\n\n    # Workspace folder permissions\n    folder_permissions = {\n        \"\u002FShared\u002FProduction\": {\n            \"data-platform-admins\": \"CAN_MANAGE\",\n            \"data-engineers\": \"CAN_RUN\",\n            \"data-analysts\": \"CAN_READ\",\n        },\n        \"\u002FShared\u002FDevelopment\": {\n            \"data-engineers\": \"CAN_MANAGE\",\n            \"data-scientists\": \"CAN_MANAGE\",\n            \"data-analysts\": \"CAN_EDIT\",\n        },\n    }\n\n    for folder, permissions in folder_permissions.items():\n        acl = [\n            {\"group_name\": group, \"permission_level\": level}\n            for group, level in permissions.items()\n        ]\n        w.workspace.set_permissions(path=folder, access_control_list=acl)\n```\n\n### Step 4: Service Principal Management\n\n```python\n# scripts\u002Fservice_principals.py\nfrom databricks.sdk import AccountClient, WorkspaceClient\nfrom databricks.sdk.service.iam import ServicePrincipal\n\ndef create_service_principal(\n    account_client: AccountClient,\n    workspace_client: WorkspaceClient,\n    name: str,\n    purpose: str,\n    workspace_permissions: dict,\n) -> dict:\n    \"\"\"\n    Create and configure a service principal.\n\n    Args:\n        account_client: Account-level client\n        workspace_client: Workspace-level client\n        name: Service principal name\n        purpose: Description\u002Fpurpose\n        workspace_permissions: Dict of {object_type: permission_level}\n\n    Returns:\n        Service principal details\n    \"\"\"\n    # Create at account level\n    sp = account_client.service_principals.create(\n        display_name=name,\n        active=True,\n    )\n\n    # Create OAuth secret\n    secret = account_client.service_principal_secrets.create(\n        service_principal_id=sp.id,\n    )\n\n    # Add to workspace groups based on purpose\n    group_mappings = {\n        \"etl-pipeline\": \"data-engineers\",\n        \"ml-training\": \"data-scientists\",\n        \"reporting\": \"data-analysts\",\n    }\n\n    if purpose in group_mappings:\n        group_name = group_mappings[purpose]\n        # Add SP to group (via SCIM or API)\n\n    # Set workspace-level permissions\n    for obj_type, permission in workspace_permissions.items():\n        workspace_client.permissions.update(\n            object_type=obj_type,\n            object_id=\"*\",  # All objects of type\n            access_control_list=[{\n                \"service_principal_name\": sp.application_id,\n                \"permission_level\": permission,\n            }]\n        )\n\n    return {\n        \"id\": sp.id,\n        \"application_id\": sp.application_id,\n        \"client_secret\": secret.secret,  # Store securely!\n    }\n\n# Create standard service principals\nservice_principals = [\n    {\n        \"name\": \"etl-pipeline-sp\",\n        \"purpose\": \"etl-pipeline\",\n        \"permissions\": {\n            \"clusters\": \"CAN_ATTACH_TO\",\n            \"jobs\": \"CAN_MANAGE\",\n        }\n    },\n    {\n        \"name\": \"ml-training-sp\",\n        \"purpose\": \"ml-training\",\n        \"permissions\": {\n            \"clusters\": \"CAN_MANAGE\",\n            \"mlflow-experiments\": \"CAN_MANAGE\",\n        }\n    },\n]\n```\n\n### Step 5: Audit and Compliance\n\n```sql\n-- Query audit logs for access patterns\nSELECT\n    event_time,\n    user_identity.email as user_email,\n    service_name,\n    action_name,\n    request_params,\n    response.status_code\nFROM system.access.audit\nWHERE event_date > current_date() - INTERVAL 7 DAYS\n  AND service_name IN ('unityCatalog', 'clusters', 'jobs')\nORDER BY event_time DESC\nLIMIT 100;\n\n-- Permission changes audit\nSELECT\n    event_time,\n    user_identity.email as changed_by,\n    action_name,\n    request_params:full_name_arg as resource,\n    request_params:changes as permission_changes\nFROM system.access.audit\nWHERE action_name LIKE '%Grant%' OR action_name LIKE '%Revoke%'\n  AND event_date > current_date() - INTERVAL 30 DAYS\nORDER BY event_time DESC;\n\n-- Privileged access report\nSELECT DISTINCT\n    grantee,\n    privilege,\n    object_type,\n    object_name\nFROM system.information_schema.object_privileges\nWHERE privilege IN ('ALL PRIVILEGES', 'CREATE', 'MODIFY')\nORDER BY grantee, object_type;\n```\n\n### Step 6: Access Review Automation\n\n```python\n# scripts\u002Faccess_review.py\nfrom databricks.sdk import WorkspaceClient\nfrom datetime import datetime\nimport pandas as pd\n\ndef generate_access_review_report(w: WorkspaceClient, spark) -> pd.DataFrame:\n    \"\"\"\n    Generate access review report for compliance.\n\n    Returns DataFrame with all permissions by user\u002Fgroup.\n    \"\"\"\n    # Get Unity Catalog permissions\n    uc_permissions = spark.sql(\"\"\"\n        SELECT\n            grantee,\n            grantee_type,\n            privilege,\n            object_type,\n            object_name,\n            inherited_from\n        FROM system.information_schema.object_privileges\n        ORDER BY grantee, object_type\n    \"\"\").toPandas()\n\n    # Get workspace permissions\n    workspace_permissions = []\n    for obj_type in ['clusters', 'jobs', 'sql\u002Fwarehouses']:\n        for obj in getattr(w, obj_type.replace('\u002F', '_').replace('sql_', '')).list():\n            perms = w.permissions.get(object_type=obj_type, object_id=obj.id)\n            for acl in perms.access_control_list or []:\n                workspace_permissions.append({\n                    \"object_type\": obj_type,\n                    \"object_id\": obj.id,\n                    \"principal\": acl.user_name or acl.group_name or acl.service_principal_name,\n                    \"permission\": acl.all_permissions[0].permission_level if acl.all_permissions else None,\n                })\n\n    ws_df = pd.DataFrame(workspace_permissions)\n\n    # Combine reports\n    report = {\n        \"generated_at\": datetime.now().isoformat(),\n        \"unity_catalog_permissions\": uc_permissions,\n        \"workspace_permissions\": ws_df,\n    }\n\n    return report\n\ndef flag_excessive_permissions(report: dict) -> list[dict]:\n    \"\"\"Flag potentially excessive permissions.\"\"\"\n    flags = []\n\n    uc_df = report[\"unity_catalog_permissions\"]\n\n    # Flag ALL PRIVILEGES\n    excessive = uc_df[uc_df[\"privilege\"] == \"ALL PRIVILEGES\"]\n    for _, row in excessive.iterrows():\n        if row[\"grantee_type\"] != \"GROUP\":  # Individual users with ALL PRIVILEGES\n            flags.append({\n                \"type\": \"EXCESSIVE_PRIVILEGE\",\n                \"grantee\": row[\"grantee\"],\n                \"privilege\": row[\"privilege\"],\n                \"object\": row[\"object_name\"],\n                \"recommendation\": \"Consider using specific privileges instead of ALL PRIVILEGES\",\n            })\n\n    # Flag direct user grants (should use groups)\n    direct_grants = uc_df[uc_df[\"grantee_type\"] == \"USER\"]\n    unique_users = direct_grants[\"grantee\"].unique()\n    for user in unique_users:\n        user_grants = len(direct_grants[direct_grants[\"grantee\"] == user])\n        if user_grants > 5:\n            flags.append({\n                \"type\": \"DIRECT_USER_GRANTS\",\n                \"grantee\": user,\n                \"grant_count\": user_grants,\n                \"recommendation\": \"Consider using groups for permission management\",\n            })\n\n    return flags\n```\n\n## Output\n- SCIM integration configured\n- Unity Catalog RBAC implemented\n- Workspace permissions set\n- Service principals created\n- Audit logging enabled\n\n## Error Handling\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| SSO login fails | Wrong callback URL | Verify IdP config |\n| Permission denied | Missing grant | Check inherited permissions |\n| SCIM sync failed | Token expired | Regenerate SCIM token |\n| Group not found | Case sensitivity | Match exact group name |\n\n## Examples\n\n### Quick Permission Check\n```sql\n-- Check what a user can access\nSELECT * FROM system.information_schema.object_privileges\nWHERE grantee = 'user@company.com'\nORDER BY object_type, object_name;\n```\n\n### Grant Template\n```sql\n-- Standard data consumer access\nGRANT USAGE ON CATALOG enterprise_data TO `new-team`;\nGRANT USAGE ON SCHEMA enterprise_data.gold TO `new-team`;\nGRANT SELECT ON SCHEMA enterprise_data.gold TO `new-team`;\n```\n\n## Resources\n- [Unity Catalog Privileges](https:\u002F\u002Fdocs.databricks.com\u002Fdata-governance\u002Funity-catalog\u002Fmanage-privileges\u002Fprivileges.html)\n- [SCIM Provisioning](https:\u002F\u002Fdocs.databricks.com\u002Fadministration-guide\u002Fusers-groups\u002Fscim\u002Findex.html)\n- [Identity Federation](https:\u002F\u002Fdocs.databricks.com\u002Fadministration-guide\u002Fusers-groups\u002Fbest-practices.html)\n\n## Next Steps\nFor major migrations, see `databricks-migration-deep-dive`.\n",{"name":5,"author":46,"license":15,"version":47,"description":48,"allowed-tools":49},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Configure Databricks enterprise SSO, Unity Catalog RBAC, and organization management.\nUse when implementing SSO integration, configuring role-based permissions,\nor setting up organization-level controls with Unity Catalog.\nTrigger with phrases like \"databricks SSO\", \"databricks RBAC\",\n\"databricks enterprise\", \"unity catalog permissions\", \"databricks SCIM\".\n","Read, Write, Edit, Bash(databricks:*)","main","90b50ed0778745a80fd5bfb13b1843d45b9e82f7","tests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdatabricks-pack\u002Fskills\u002Fdatabricks-enterprise-rbac",233,"https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust","https:\u002F\u002Fgithub.com\u002FDicklesworthstone","https:\u002F\u002Fwww.jeffreyemanuel.com\u002F","Building in NY","2026-11-13 03:33:43",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add Dicklesworthstone\u002Fpi_agent_rust --skill databricks-enterprise-rbac",{"tool":65,"command":66},"bunx","bunx skills add Dicklesworthstone\u002Fpi_agent_rust --skill databricks-enterprise-rbac",{"tool":68,"command":69},"pnpm","pnpm dlx skills add Dicklesworthstone\u002Fpi_agent_rust --skill databricks-enterprise-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Fplugins-community\u002Fplugins\u002Fsaas-packs\u002Fdatabricks-pack\u002Fskills\u002Fdatabricks-enterprise-rbac\u002FSKILL.md",true,[],[74,114,139,165,192,214],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":87,"publishedAt":41},"01M6FEGPPK0ZTKCCM0R3E3KS33","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",[88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,31,106,107,108,109,110,111,112,113],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","component","routing","state management","state","shadcn","file","ui","Tools","Tailwind","html","single-file","simple","ui components","multi","for","jsx","suite",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":125,"publishedAt":41},"01M6FEE9VTK1W4GY21AKREJXRG","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[121,124],{"categoryNo":122,"categoryName":123,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[126,127,128,93,129,130,89,131,132,133,103,134,135,136,137,138,111],"testing","webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","logs","applications","behavior","local","with",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":143,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":41},"01M6FE20F7ZTQBFWKF4MPJ2SBX","neuropixels-analysis","Neuropixels neural recording analysis. Load SpikeGLX\u002FOpenEphys data, preprocess, motion correction, Kilosort4 spike sorting, quality metrics, Allen\u002FIBL curation, AI-assisted visual analysis, for Neuropixels 1.0\u002F2.0 extracellular electrophysiology. Use when working with neural recordings, spike sorting, extracellular electrophysiology, or when the user mentions Neuropixels, SpikeGLX, Open Ephys, Kilosort, quality metrics, or unit curation.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fneuropixels-analysis\u002FSKILL.md",[],[147,148,149,150,151,152,153,154,31,155,156,157,158,159,160,161,138,162,163,164,111,23],"analysis","neuropixels analysis","spike","metrics","data","open","quality","user","recordings","Neural","motion","visual","quality metrics","unit","sorting","curation","recording","load",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":169,"sourceHtmlUrl":170,"categories":171,"keywords":175,"publishedAt":41},"01M6FDP0PDK6F1GGX395C7625Z","skill-creator","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[172],{"categoryNo":173,"categoryName":174,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",[176,177,178,179,180,181,182,183,184,185,186,187,188,189,138,111,190,23,191],"skill creator","creator","workflows","create","update","capabilities","knowledge","tool","integrations","specialized","guide","new skill","existing skill","users","Existing","new",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":196,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":41},"01M6FDM8Y7VK7NYG9SM7QPA3PW","notebooklm","Use this skill to query your Google NotebookLM notebooks directly from Claude Code for source-grounded, citation-backed answers from Gemini. Browser automation, library management, persistent auth. Drastically reduced hallucinations through document-only responses.","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fnotebooklm\u002FSKILL.md",[199],{"categoryNo":173,"categoryName":174,"taxonomyType":85,"taxonomyTypeDesc":86},[194,201,202,203,204,205,206,133,207,208,31,209,210,211,212,111,213],"google","browser automation","gemini","automation","auth","code","library","management","only","document","query","Citation","source",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":218,"sourceHtmlUrl":219,"categories":220,"keywords":227,"publishedAt":41},"01M6FDHPXE10J3XGTCH5HBHS1M","slack-gif-creator","Knowledge and utilities for creating animated GIFs optimized for Slack. Provides constraints, validation tools, and animation concepts. Use when users request animated GIFs for Slack like \"make me a GIF of X doing Y for Slack.\"","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDicklesworthstone\u002Fpi_agent_rust\u002Fblob\u002Fmain\u002Ftests\u002Fext_conformance\u002Fartifacts\u002Ftemplates-davila7\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fslack-gif-creator\u002FSKILL.md",[221,224],{"categoryNo":222,"categoryName":223,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":225,"categoryName":226,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000016","图像与多媒体",[228,229,230,177,231,104,232,233,182,31,234,189,235,236,237,111,238,23],"slack gif creator","slack","gif","validation","constraints","Animation","me","make","Utilities","concepts","request"]