App Spaces
This feature is in Beta. To use it, a workspace admin must turn on Governed agentic app-building from the Previews page. See Manage Databricks previews.
An App Space is a container that enables admins to define who can create and use apps, what actions apps can take, and which resources apps can use.
Instead of having developers define resources and set permissions for each app, an App Space enables admins to configure grants and resources for groups of app developers.
App developers use Genie App Builder to build apps in an App Space. Apps created in an App Space scale to zero when not in use and scale back up when requested by a user.
App Spaces are part of a set of new Databricks Apps capabilities. For the bigger picture, see Governed agentic app building.
Why use App Spaces
As coding agents make it easier to build apps, more people across an organization are creating them. App Spaces let business and other nontechnical users create apps that access data without breaking your organization's governance model. An admin defines the guardrails (identities, scopes, and resources) one time for a group of builders, and every app built in the space inherits them.
Create an App Space
You must be a workspace admin to create App Spaces.
- In the Databricks Apps UI, click App Spaces > + New Space, or
- Use the Databricks REST API or Terraform provider.
You can't change an App Space's name after you create it.
Configure an App Space
As a workspace admin, you can configure:
- User authorization: what apps can do on behalf of users.
- App authorization: which shared resources and data apps can access.
- Serverless usage policy: the serverless usage policy for apps in the space.
- Permissions: who can create apps in the space.
User authorization
User authorization, sometimes referred to as on-behalf-of-user (OBO) authorization, allows a Databricks app to act with the identity of the signed-in user. The app can only reach data and resources the user is already permitted to access, within the scopes you allow. See Configure authorization in a Databricks app.
An App Space lets admins restrict the principals and the scopes that can be used with user authorization. Use user authorization when access should follow each user's existing Databricks permissions, such as for Unity Catalog tables, Genie spaces and agents, or dashboards.
Authorizing principal
You can restrict the authorizing principal that apps use with user authorization. This lets you limit the data and resources an app can access through OBO.
Setting | Who can use apps? | Who can apps act on behalf of? (within permitted scopes) |
|---|---|---|
Any principal | Anyone the developer shares their app with | Any principal that a user can assume, if the app has been shared with them |
Only the specified role | Users in the selected group, if the app has been shared with them | Only the indicated role |
For example:
- An App Space restricts the authorizing principal to the group
Data Scientists. - Jane Doe is a member of
Data Scientists. - The app developer shares their app with Jane Doe.
- Jane must assume the
Data Scientistsrole to sign in to the app. - With user authorization, the app has access only to what
Data Scientistscan access (within allowed scopes), even if Jane Doe has additional grants and permissions.
- The only way to restrict sharing is by limiting the authorizing principal.
- Role-based access control must be enabled to use Only the specified role.
- Only account groups can be used with role restrictions.
Scopes
Apps that use user authorization must declare specific authorization scopes to limit what the app can do on the user's behalf. See Configure authorization in a Databricks app. In an App Space, you can control the maximum scopes that apps may request.
App authorization
With app authorization, also called machine-to-machine (M2M) authorization, an app acts as its own identity rather than as a user. Each app in a space gets a unique Application Service Principal (ASP) that is tied to the app's lifecycle and identifies the app in audit logs. Users can't create, edit, or grant access to an ASP directly; only the app uses it.
Use app authorization for resources the app owns and that users generally shouldn't access directly, such as a Lakebase database, a Model Serving endpoint or AI Gateway, secrets, and volumes. A developer grants an individual app access to its own resources, for example its own Lakebase.
The space's app authorization doesn't grant apps direct access to shared resources, such as a shared Lakebase instance or an AI Gateway for inference.
Serverless usage policy
Apps in a space run under a serverless usage policy. See Cost management tools on Databricks.
Permissions
The following permissions control who can work in an App Space:
Permission | Grants the ability to |
|---|---|
| Develop apps in the space |
| Modify the space's settings |
| View the space, but not create apps in it (or necessarily use apps in it) |
Example use cases
You can shape an App Space around how a group works:
Type | Description |
|---|---|
Personal apps | Private space for experiments and personal tools. Apps can't be shared and act only with the developer's permissions. |
Public apps | Apps shareable with anyone in the workspace. Can only access data and resources available to every workspace user. |
Privileged developer apps | Lets an approved group of developers build apps with broad permissions. |
Team apps | Apps built by a specific team, aligned with its existing role, infrastructure, data, and permissions. |
Project apps | Apps associated with a defined project or engagement, sharing its provisioned tables, warehouses, pipelines, and access boundaries. |
Limitations
The following are current limitations of App Spaces:
- An App Space contains only Serverless Micro Apps.
- Apps in an App Space are built and deployed only through Genie App Builder, not from source code or another coding agent.
- Apps in a space have no general public internet egress. Outbound access is limited to the Databricks workspace and the managed npm/PyPI package proxies.
- You can't prevent users from creating apps outside of App Spaces.
For the requirements to use these capabilities, see Requirements.