Databricks permissions - Developer Portal

Workspace roles

Actor	Needs	Why
Workspace admin (one-time)	Create the secret scope and ACLs; create the Databricks App and its secret resources	Setup only
Analyst using the app	Can use on the app	Opens the app; never sees credentials
Analyst running notebooks	READ on the `kyberis` secret scope, access to the Git folder, and cluster attach	`dbutils.secrets.get` of the API key
Job service principal	READ on the `kyberis` secret scope, read on the source table, write on the output table	Scheduled enrichment runs
App service principal	READ on the `kyberis` secret scope, granted automatically via the app secret resources	Injecting environment variables at app start

What the integration does not need

No workspace admin rights at runtime.
No Unity Catalog metastore privileges beyond the tables you point the notebooks at.
No cluster-scoped init scripts, and no cluster environment variables.
No permissions in the Kyberis product beyond a standard customer API key with default read scopes. The integration performs read-only enrichment calls and never mutates Kyberis data.

Enrichment output tables contain threat verdicts about your indicators. Treat them like any security telemetry: grant table access via Unity Catalog to the security team’s groups, and avoid granting broad workspace-wide SELECT. Nothing in the output rows contains credentials — see Data handling and privacy.

⌘I