Role-based access control (RBAC)
Role-based access control (RBAC) is a Databricks data governance capability, introduced July 2026.
Databricks access-control model where a user assumes a role - implemented as a group - and acts with only that role's permissions for the duration of the session, instead of the permissions they have accumulated.
- A 'role' here is not a new kind of object at all - it's an ordinary Databricks group that someone has been granted the Assume permission on, wearing a different hat.
- Normally your permissions pile up from every group you belong to and follow you everywhere, so assuming a role is one of the rare logins that can leave you seeing less rather than more.
- Anything you make while acting as a role - notebooks, queries, SQL warehouses, jobs - is owned by the role rather than by you.
Limitations: A user can act as only one role at a time. When acting as a role, creating Agent Bricks agents, managing alerts, and Lakeflow pipelines are unsupported, and creating Vector Search indexes fails (create as a user, then reassign ownership to the role); the workspace SCIM API cannot create or manage groups, workspace asset sharing controls reach 100 groups by default, and roles still inherit whatever the workspace users group can see.
Open in REbricked →- Category
- Data governance
- Also known as
- RBAC, role-based access control, exclusive access, role switcher
- Verified
- 2026-08-20