Beyond embedding: How to secure AI/BI Dashboards for every viewer

Summary

Embedding a Databricks AI/BI Dashboard in a customer-facing application is straightforward; authorization determines which rows each viewer may see. The pattern supports external partners and internal Databricks teams with one dashboard and shared dataset, while applying different regional access and masking rules. An entitlements table stores partner IDs and IdP-synchronized group names alongside regions and PII-mask flags; a secured view filters on the signed __aibi_external_value from the embed token. Direct SQL access is separately protected by Unity Catalog row filters and column masks, which evaluate the querying user's identity and groups. The design provides a default-deny, pooled logical multi-tenancy model that centralizes rules while covering both application and workspace query paths.

Takeaways

1. 1

   The same entitlements table can map external partner IDs and internal identity-provider group names to regions and masking requirements, avoiding per-customer dashboards and duplicated filters.

2. 2

   The backend signs external_viewer_id and external_value into the embed token; the viewer cannot modify the signed scope, and an unknown scope matches no rows for default-deny behavior.

3. 3

   Embedded queries run under the configured publishing identity, whereas Unity Catalog row filters for direct SQL evaluate the actual Databricks user's identity and account-level groups.