Beyond embedding: How to secure AI/BI Dashboards for every viewer

Databricks AI/BI Dashboards can be embedded in customer-facing applications by enabling embedding and minting a scoped token in the backend, as outlined in the foundational guide. However, authorizing which rows each viewer sees presents a greater challenge, particularly when external partners and internal teams share the same dashboard. The new design pattern leverages capabilities like __aibi_external_value, Unity Catalog row filters, and column masks to enforce these access rules consistently.

The pattern centralizes access control in a single entitlements table that governs both embedded dashboards and direct SQL queries. For example, a shared 'Open Accounts Receivable (AR) Tasks' dashboard serves five viewers—Acme Ops, Bolt Partners, Core Logistics, Finance, and a regional operations team—each seeing a different regional slice of data. Acme sees only the West region with masked emails, while Finance views all three regions in full, all from the same published dashboard.

Access rules are defined in the entitlements table, which is populated by an upstream system or an application-owned group-to-region mapping, avoiding manual edits. The backend sets the viewer's scope by minting an embed token with an external_value that represents their access level. The token is signed by Databricks and exposed to the dashboard SQL as __aibi_external_value, ensuring viewers cannot modify their scope.

Queries embedded in applications execute under the service principal's identity, not the viewer's, requiring careful management of data permissions. The application must resolve the viewer's groups in the backend before minting the token, using methods like Databricks Apps with user authorization enabled to forward trusted identity context. This approach ensures the correct scope is applied without relying on SQL during embedding.