Metadata extraction from Databricks is always read-only. The process does not modify data but requires access to system tables to retrieve advanced metadata, such as the SQL definitions of views and stored procedures.
Permissions for operational lineage
To enable operational lineage tracking, your Databricks token must be generated with
the following scopes: sql and unity-catalog.
Tokens without these scopes cannot retrieve the lineage data needed for operational
lineage features.
Your Databricks user must also have the following permissions:
USE CATALOG on system
USE SCHEMA on system.access
SELECT on system.access.column_lineage Required permissions
The user must have permission to run USE CATALOG, USE SCHEMA, and SELECT commands on the following catalogs, schemas, and metadata tables:
system.information_schema.metastores
system.information_schema.schema_tags
system.information_schema.table_tags
system.information_schema.column_tags
system.information_schema.catalog_tags
system.information_schema.catalogs
<catalog>.information_schema.schemata
<catalog>.information_schema.tables
<catalog>.information_schema.columns
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.table_constraints
<catalog>.information_schema.referential_constraints
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.table_constraints
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.routines
<catalog>.information_schema.routine_columns
<catalog>.information_schema.routines
<catalog>.information_schema.views
<catalog>.information_schema.tables
where <catalog> is a specific catalog to import;Required permissions for multi-database cataloging
For multi-database cataloging, the principal used by the Advanced Connectivity Bundle (ACB) must have the following permissions on each target catalog and schema:
-- 1. Allow access to the catalog (database)
GRANT USE CATALOG ON CATALOG <catalog_name> TO `<principal>`;
-- 2. Allow access to the specific schema
GRANT USE SCHEMA ON SCHEMA <catalog_name>.<schema_name> TO `<principal>`;
-- 3. Allow read access to all current and future tables/views in the schema
GRANT SELECT ON SCHEMA <catalog_name>.<schema_name> TO `<principal>`;These permissions are required on every catalog and schema that will be included in the multi-database cataloging process to ensure the Advanced Connectivity Bundle (ACB) can discover and catalog the objects successfully.