Databricks Outlines Reference Pattern for Securing Embedded AI/BI Dashboards

Embedding a Databricks AI/BI Dashboard requires minting a scoped token in the backend and rendering it with the client SDK. [1] To control which rows each viewer sees, Databricks recommends a reference pattern that combines an entitlements table, Unity Catalog row filters, and column masks. [1] This approach uses a single dashboard to serve every viewer by leveraging a signed embed token's __aibi_external_value to determine row access. [1] This prevents organizations from having to create a separate dashboard for every customer or repeat filters across multiple queries. [1]

The pattern enforces a default-deny approach that masks sensitive columns and refuses tokens for viewers lacking entitlements. [1] Access is granted via synchronized identity-provider groups, such as Entra ID or Okta, instead of manually maintained user lists. [1] The application uses an on-behalf-of token to resolve an internal viewer's groups before minting the final embed token. [1] External partners accessing a white-label portal only see their designated region with masked contact information, while internal teams can query the exact same data source using direct SQL protected by Unity Catalog. [1]

The Databricks pattern addresses a common friction point in multi-tenant BI deployments: the proliferation of duplicated dashboards to satisfy strict data isolation requirements. By pushing row-level security down to Unity Catalog and tying it to identity-provider groups, organizations can separate dashboard design from access control. This closely mirrors how modern cloud data warehouses handle multi-tenancy, but specifically extends those protections to embedded AI/BI interfaces and external white-label portals. What the sources don't address: How this centralized authorization layer impacts query latency or overall dashboard rendering performance when evaluating complex, nested group hierarchies.