Serverless compute access control

Serverless compute access control is a Databricks compute / bi capability, introduced August 2026.

Workspace-admin governance over who may run serverless workloads, expressed as Can Use / Can Manage permissions on two built-in serverless compute objects: Default Interactive Compute (notebooks and Databricks Connect) and Default Automated Compute (jobs and Spark Declarative Pipelines on Lakeflow).

• It went GA by changing nothing: every workspace user already has Can Use on both objects by default, so the feature ships fully permissive and only bites once an admin removes someone. 🔗
• You get exactly two compute objects and they are permanent tenants - Default Interactive Compute and Default Automated Compute cannot be renamed or deleted. 🔗
• The docs warn that during a service disruption the access checks might fail open, which is why they tell you not to use it as an absolute spend cap - a rare access control whose documented failure mode is letting people in. 🔗

⚠ Limitations: In a service disruption access checks might fail open, so denied users could still start serverless workloads - Databricks says not to rely on it as an absolute spend cap. Background compute (system-initiated jobs) is exempt from the controls. The companion rate limits on serverless compute are still in Private Preview. 🔗

Category

Compute / BI

Introduced

August 2026🔗

Also known as

serverless compute permissions, Default Interactive Compute, Default Automated Compute, serverless compute objects

Verified

2026-09-20