Permissions - Precisely Data Integrity Suite

Permissions for operational lineage

To enable operational lineage tracking, your Databricks token must be generated with the following scopes: sql and unity-catalog. Tokens without these scopes cannot retrieve the lineage data needed for operational lineage features.

Your Databricks user must also have the following permissions:

USE CATALOG on system
USE SCHEMA on system.access
SELECT on system.access.column_lineage 

Required permissions

Databricks organizes data hierarchically: Catalog → Schema → Table → Fields. Permissions must be granted at every level above the target object. Unity Catalog evaluates permissions from the catalog level down to the table level, so a grant at a lower level has no effect if a higher-level grant is missing. The following permissions are required for Test Connection, Browsing (Query), Sampling, and Cataloging operations.

Databricks-managed Service Principals can have ambiguous or shared display names. When granting permissions, select the appropriate principal by Client ID. The Client ID configured for the connection can be verified in Databricks under Account Console > User Management > Service Principals. In Databricks, open Catalog Explorer, select the target catalog or schema, open the Permissions tab, and grant the required privileges (USE CATALOG, USE SCHEMA, and SELECT) to the appropriate principal. Granting permissions at the catalog level is recommended because access is inherited by new schemas and tables.

The user must have permission to run USE CATALOG, USE SCHEMA, and SELECT commands on the following catalogs, schemas, and metadata tables:

system.information_schema.metastores
system.information_schema.schema_tags
system.information_schema.table_tags
system.information_schema.column_tags
system.information_schema.catalog_tags
system.information_schema.catalogs
<catalog>.information_schema.schemata
<catalog>.information_schema.tables
<catalog>.information_schema.columns
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.table_constraints
<catalog>.information_schema.referential_constraints
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.table_constraints
<catalog>.information_schema.key_column_usage
<catalog>.information_schema.routines
<catalog>.information_schema.routine_columns
<catalog>.information_schema.routines
<catalog>.information_schema.views
<catalog>.information_schema.tables

In these entries, <catalog> represents the specific catalog to import.

Troubleshooting permissions: Invalid or expired credentials can return 401 Unauthorized, invalid_client, or OAuth token errors before permission checks occur. Missing USE CATALOG, USE SCHEMA, or SELECT permissions typically returns an INSUFFICIENT_PERMISSIONS error. If BROWSE or catalog-level access is missing, the object may be absent from discovery results without an explicit error. Repeated permission failures can also trigger a circuit breaker error. This is a downstream symptom, so check for an underlying INSUFFICIENT_PERMISSIONS error first and retry after approximately one minute.

Required permissions for multi-database cataloging

For multi-database cataloging, the principal used by the Advanced Connectivity Bundle (ACB) must have the following permissions on each target catalog and schema:

For Unity Catalog environments, permissions can be granted at the catalog level so that access is inherited by new schemas and tables:

GRANT USE CATALOG, USE SCHEMA, SELECT ON CATALOG <catalog_name> TO `<client_id>`;

Alternatively, for multi-database cataloging, grant access to each target catalog and schema:

-- 1. Allow access to the catalog (database)
      GRANT USE CATALOG ON CATALOG <catalog_name> TO `<principal>`;
                
-- 2. Allow access to the specific schema
      GRANT USE SCHEMA ON SCHEMA <catalog_name>.<schema_name> TO `<principal>`;
                
-- 3. Allow read access to all current and future tables/views in the schema
      GRANT SELECT ON SCHEMA <catalog_name>.<schema_name> TO `<principal>`;

These permissions are required on every catalog and schema that will be included in the multi-database cataloging process to make sure the Advanced Connectivity Bundle (ACB) can discover and catalog the objects successfully.