Databricks recipe: multi-tenant Genie isolation via OAuth custom identity claims + ABAC
Wise_Ear_4064 · reddit · 2026-11-05
A Databricks SA shares a customer architecture: end users never log into Databricks but still need tenant-scoped SQL and Genie Agent queries over shared tables.
Rejected options: per-user provisioning (too many), per-tenant service principals (principal sprawl), app-layer filtering (risk of direct warehouse access).
The pattern that worked: the app mints an OAuth token for a shared service principal stamped with customclaim=storeid, and a dynamic view or ABAC policy filters via currentoauthcustomidentityclaim(). 200 users at one store share a single SP while every query stays store-scoped.
Key gotcha: for Genie, use ABAC on the table, not a claim-filtered view—the view would show zero rows to the agent builder; ABAC scopes only the SP while authors see the full table.
More from coding & agent
- Raindrop engineer makes the case for building your own internal Slack agent — zeeg · 2026-11-05
- Genkit Go, Eino, ADK Go, tRPC-Agent-Go, LangChainGo compared with real code — rseroter · 2026-11-05
- How do you connect cloud AI agents to tools behind a customer's firewall? — JoleneAtCynapsa · 2026-11-05
- Elixir guide for OO programmers by Bruce Park goes free online with an AI tutor — burkov · 2026-11-05
- MCP listing on Claude brought 24,000 users in 5 weeks, founder says launch there first — ElevatorFriendly648 · 2026-11-05
- User reports OpenAI's Sol 6.1 running at 'quarter speed' for days — ruslansv · 2026-11-05