How do I let business users build their own apps safely?

Summary

• Business users can safely build their own data and AI apps on Databricks because every app is a first-class object governed by Unity Catalog, inheriting the same fine-grained access controls, row-level filters, column masks, auditing, and identity you already use for your data.
• App Spaces let admins pre-approve an environment once (resource access, data permissions, API scopes, and security policies), so every app built inside that space automatically inherits those guardrails, shifting from reactive per-app reviews to systematic governance.
• Each app runs on isolated serverless compute with its own service principal that receives only explicitly granted permissions, and on-behalf-of-user access means an app respects each viewer's own data permissions.
• Databricks One gives business users a simple, curated place to discover and use approved apps without managing fine-grained permissions themselves.
• Databricks Apps support SSO, IP access lists, encryption in transit and at rest, full audit logging, and compliance standards including SOC 2 Type II, ISO 27001, HIPAA, PCI-DSS, GDPR, and FedRAMP High.

How do I let business users build their own apps safely?

Giving business users the ability to build their own apps usually raises a governance question: how do you let non-developers ship apps quickly without giving them access to data or actions they should not have? On Databricks, the answer is that governance is built into the platform rather than bolted on per app. Every Databricks App is a first-class governed object, runs on isolated serverless compute, and enforces the same permissions, identity, and auditing you already use for your data. That lets platform teams open up app building broadly while keeping consistent guardrails in place.

Why Databricks Apps

• Governed by Unity Catalog. Every app is a first-class object in Unity Catalog and inherits its security, auditing, and fine-grained access controls. Row-level filters and column masks apply automatically to an app's queries based on the user's identity, and attribute-based access control (ABAC) drives policy-based data access, so an app can only ever reach data the user is entitled to see.
• App Spaces for governance at scale. With App Spaces, admins define resource access, data permissions, API scopes, and security policies once at the environment level, and every app created in that space inherits them. This shifts governance from reactive, per-app reviews to systematic, pre-approved environments and keeps policy consistent across the whole app portfolio.
• Clear permission model. Databricks Apps use two permission levels, CAN USE (run and interact with the app) and CAN MANAGE (edit settings, permissions, and delete the app). Admins can restrict who is allowed to create apps and control distribution through workspace entitlements and identity-provider group synchronization.
• Identity-aware access. Apps enforce unified authentication through SSO and support IP access lists. An app can run with on-behalf-of-user access, where it respects the calling user's own permissions, or with service principal access, where all users share the same resource permissions. Each app is automatically provisioned a service principal with only the minimal permissions it needs, with no implicit elevation or credential sharing.
• Isolated, secure infrastructure. Each app runs on dedicated serverless compute with network segmentation, and data is encrypted in transit and at rest. Production apps can be required to deploy only from security-reviewed Git repositories, and dependency pinning helps limit supply-chain risk.
• Simple, safe distribution. Databricks One provides a curated interface where business users can discover and open approved apps without having to manage fine-grained permissions themselves, keeping the experience simple while governance stays consistent end to end.
• Audit and compliance. All app activity is logged, giving admins visibility into what apps exist, who owns them, and how they are used. Databricks Apps support compliance standards including SOC 2 Type II, ISO 27001, GDPR, HIPAA, PCI-DSS, and FedRAMP High.

Getting started

• Read Introducing Databricks Apps for an overview of what you can build and how apps are governed.
• Review Best practices for Databricks Apps permissions to plan CAN USE / CAN MANAGE grants and who can create apps.
• Learn how App Spaces enable governed app building so business users can build inside pre-approved environments.
• See the Databricks Apps documentation to build and deploy your first app.

FAQs

Can business users build apps without deep engineering support?

Yes. App Spaces let admins pre-approve an environment with the right data permissions, resource access, and security policies, so business users can build inside those guardrails and every app they create automatically inherits the approved governance.

How do I control who can create and access apps?

Admins restrict app creation through workspace entitlements and identity-provider group synchronization, and grant CAN USE or CAN MANAGE on each app. Access to data is always governed by Unity Catalog permissions.

How do apps enforce data permissions?

Each app is governed by Unity Catalog, so row-level filters, column masks, and access controls apply automatically. With on-behalf-of-user access, an app respects the permissions of the person using it rather than exposing data beyond what that user can see.

Where do business users find approved apps?

Databricks One provides a curated interface where business users can discover and open the apps shared with them without managing fine-grained permissions themselves.