Introducing Intents
Intents are now available in public preview for use with Databricks Unity Catalog. Intents let policy authors control access based on specific, declared reasons for accessing data rather than relying only on users' broader identity, groups, or attributes. This means policies can account for what a user is doing and why they need access, not just who they are.
How intents work
When a governor creates an intent, they configure
- Groups that determine who is authorized to use the intent
- Attributes that replace the user’s birthright attributes when they assume the intent
For example, the Analysts group can be assigned to an intent called Fraud Investigation with the attribute Task:FraudInvestigation. When an authorized user switches to this intent in Databricks, their Department:Operations birthright attribute is replaced by Task:FraudInvestigation.
A policy can then use that attribute to grant access to masked fields, such as PII. When the user switches out of the intent, that access is revoked and their birthright attributes are restored.
Why use intents?
- Regulatory compliance and auditability: Access events can be tied to a declared use case, providing evidence that access was actively constrained to an approved intent.
- Simple setup: You can leverage the attributes and groups you already use when creating intents. Sensitive data discovery, masking policies, subscription policies, and more fit naturally with intent-based access.
- Use-case-driven access: A user’s broader permissions remain dormant while they operate under a specific intent, allowing policies to evaluate access in the context of the active use case.
🔎 To learn more, see the Intents reference guide.
