---
title: "Beyond embedding: How to secure AI/BI Dashboards for every viewer"
description: "Embedding a Databricks AI/BI Dashboard in a customer-facing application is straightforward; authorization determines which rows each viewer may see. The pattern supports external partners and internal Databricks teams with one dashboard and shared dataset, while applying different regional access and masking rules. An entitlements table stores partner IDs and IdP-synchronized group names alongside regions and PII-mask flags; a secured view filters on the signed __aibi_external_value from the embed token. Direct SQL access is separately protected by Unity Catalog row filters and column masks, which evaluate the querying user's identity and groups. The design provides a default-deny, pooled logical multi-tenancy model that centralizes rules while covering both application and workspace query paths."
---

# Beyond embedding: How to secure AI/BI Dashboards for every viewer

[Databricks](https://yomu.fyi/company/databricks) · Sonakshi Pandey · Sep 9, 2026

**Type:** Explainer

## Summary

Embedding a Databricks AI/BI Dashboard in a customer-facing application is straightforward; authorization determines which rows each viewer may see. The pattern supports external partners and internal Databricks teams with one dashboard and shared dataset, while applying different regional access and masking rules. An entitlements table stores partner IDs and IdP-synchronized group names alongside regions and PII-mask flags; a secured view filters on the signed \_\_aibi\_external\_value from the embed token. Direct SQL access is separately protected by Unity Catalog row filters and column masks, which evaluate the querying user's identity and groups. The design provides a default-deny, pooled logical multi-tenancy model that centralizes rules while covering both application and workspace query paths.

## Context

The central problem is enforcing viewer-specific row access and sensitive-field masking after embedding a shared Databricks AI/BI Dashboard. External partners access the dashboard without Databricks accounts, while internal teams use Databricks and identity-provider groups; both audiences need consistent controls without separate dashboards or manually repeated query filters.

## Approach / What changed

Use one entitlements table as the source of truth and a secured view that matches its scopes against the signed \_\_aibi\_external\_value in embed tokens. Protect direct Databricks SQL access separately with Unity Catalog row filters and column masks based on the querying user's identity and account-level groups. Resolve internal groups in the backend before minting tokens, fail closed when no entitlement exists, and keep sensitive values masked where required.

## Takeaways

- The same entitlements table can map external partner IDs and internal identity-provider group names to regions and masking requirements, avoiding per-customer dashboards and duplicated filters.
- The backend signs external\_viewer\_id and external\_value into the embed token; the viewer cannot modify the signed scope, and an unknown scope matches no rows for default-deny behavior.
- Embedded queries run under the configured publishing identity, whereas Unity Catalog row filters for direct SQL evaluate the actual Databricks user's identity and account-level groups.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Databricks](https://yomu.fyi/topic/databricks), [Data Governance](https://yomu.fyi/topic/data-governance), [Unity Catalog](https://yomu.fyi/topic/unity-catalog)

- Source: [Databricks](https://www.databricks.com/blog/beyond-embedding-how-secure-aibi-dashboards-every-viewer)
- Source URL: https://www.databricks.com/blog/beyond-embedding-how-secure-aibi-dashboards-every-viewer
- Ingested by Yomu: 2026-09-10T00:04:40.517Z

[Read original post](https://www.databricks.com/blog/beyond-embedding-how-secure-aibi-dashboards-every-viewer)