9.2 Publishing, Sharing & Access Control

Publishing, sharing, and access control represent the core governance model for Databricks AI/BI Dashboards. Because dashboards in Databricks interact directly with data governed by Unity Catalog, administrators and analysts must understand how draft states, publication workflows, permission levels, and credential execution modes operate to balance user accessibility with strict enterprise security.

The Draft vs. Published Lifecycle

Databricks AI/BI Dashboards maintain a strict operational boundary between the Draft Canvas and the Published Dashboard. This separation ensures data analysts can iteratively refine dataset queries, adjust visual layouts, and test parameter bindings without disrupting business users viewing active reports.

State Isolation Mechanics

• Draft State: The interactive authoring environment where creators build SQL datasets, drag and drop canvas widgets, configure color palettes, and test parameter controls. Changes made in draft mode are auto-saved immediately but remain completely invisible to dashboard consumers.
• Published State: A locked snapshot of the dashboard canvas and dataset definitions generated when the author clicks the Publish button. Consumers viewing the published dashboard interact exclusively with this snapshot.
• Re-Publishing & Version Rollback: Clicking Publish overwrites the previous published version with the current draft state. Authors can revert their draft canvas to match the currently published snapshot if experimental changes need to be discarded.

When an analyst modifies a SQL dataset query in draft mode—such as adding a new calculation or altering a JOIN clause—the published dashboard continues executing the previous query definition until the analyst explicitly publishes the updated draft.

Credential Execution Modes: Run as Viewer vs. Embed Credentials

When publishing an AI/BI Dashboard, the author must select one of two credential execution modes: Run as Viewer (User Credentials) or Embed Credentials (Run as Owner / Publisher Credentials). This setting dictates how queries are executed against Databricks SQL Warehouses and how Unity Catalog access controls are enforced.

Run as Viewer (User Credentials)

In Run as Viewer mode, every query issued by the published dashboard runs under the specific identity of the person currently viewing the dashboard.

• Unity Catalog Privilege Requirements: The viewer must possess explicit SELECT privileges on all underlying Unity Catalog tables, views, and schemas referenced by the dashboard datasets.
• SQL Warehouse Access: The viewer must have CAN USE privileges on the Databricks SQL Warehouse assigned to the dashboard.
• Security Enforcement: Unity Catalog row-level filters and column-level masks are dynamically evaluated for each individual viewer. If User A is restricted to viewing US customer data while User B can view EU data, the exact same dashboard canvas automatically renders US data for User A and EU data for User B.

Embed Credentials (Publisher Credentials / Run as Owner)

In Embed Credentials mode, all queries execute using the credentials and permissions of the dashboard publisher (or designated service principal owner).

• Viewer Access Requirements: Viewers require only workspace CAN VIEW permission on the dashboard object. They do not need direct SELECT permissions on underlying Unity Catalog tables, nor do they need CAN USE access on the SQL Warehouse.
• Aggregated Distribution: This mode is ideal for broadcasting executive summary dashboards or broad operational KPIs to hundreds of stakeholders who lack direct access to raw data tables or SQL Warehouses.
• Security Implications: Because queries execute with the owner's privileges, Unity Catalog row filters and column masks assigned to the viewer are bypassed. Security must be ensured by verifying that dataset queries in the dashboard perform appropriate aggregations and do not expose sensitive raw PII.

Workspace Access Control & Permission Levels

Access to AI/BI Dashboards within a Databricks workspace is governed by Workspace Access Control Lists (ACLs). Dashboard owners can grant three distinct permission levels to individual workspace users, user groups, or Service Principals:

1. CAN EDIT: Allows users to modify SQL dataset queries, alter canvas layouts, edit widget configurations, change publishing settings, and manage dashboard permissions.
2. CAN RUN: Allows users to view published dashboards, trigger manual dataset query refreshes, change interactive parameter filters, and view execution history. Users cannot alter canvas layout or dataset SQL code.
3. CAN VIEW: Allows users to view the published dashboard snapshot and interact with client-side parameter controls. If the dashboard uses "Run as Viewer" mode, CAN VIEW users must also have table SELECT and warehouse CAN USE permissions.

-- Conceptual Unity Catalog grant command for supporting Run as Viewer dashboards
GRANT SELECT ON TABLE main.sales_gold.fact_orders TO `finance_analysts_group`;
GRANT USE SCHEMA ON SCHEMA main.sales_gold TO `finance_analysts_group`;
GRANT USE CATALOG ON CATALOG main TO `finance_analysts_group`;

Dashboard Ownership Management

Every dashboard has a single owner—typically the user who created it. If a dashboard owner leaves the organization or transitions teams, workspace administrators must transfer ownership to an active user or a Service Principal. Ownership transfer is critical for dashboards operating in "Embed Credentials" mode; if the owner's Databricks account is deactivated, queries under Embed Credentials mode will fail until ownership is reassigned.

External Embedding & Sharing Controls

Databricks AI/BI Dashboards can be shared securely outside the workspace UI.

• Direct URL Sharing: Workspace users with appropriate permissions can access published dashboards via unique workspace URLs.
• Iframe Embedding: Dashboards configured with Embed Credentials can be embedded into internal enterprise portals (such as SharePoint, Salesforce, or custom React applications) using <iframe> tags.
• OAuth 2.0 Authentication: Embed scenarios can leverage Databricks OAuth 2.0 M2M (Machine-to-Machine) or User-to-Machine tokens to establish seamless single sign-on (SSO) without prompting end-users for login credentials.
• Workspace Admin Guardrails: Workspace administrators retain overarching security controls in the Databricks Admin Console. Admins can globally disable dashboard iframe embedding, restrict external link sharing, or enforce mandatory "Run as Viewer" execution across all workspace dashboards.