Configure Databricks permissions for zero-copy segmentation

Learn how to grant the Databricks permissions required for zero-copy segmentation.

Attention: This feature is available to limited users through the Reltio Early Access (EA) program. Interested in finding out more about this feature or participating in our EA program? Get details in topic Early Access (EA) features.

Zero-copy segmentation uses the service principal configured for the Databricks connection to execute segment queries on the SQL warehouse. The service principal requires permission to use the warehouse, read the entity and interaction data referenced by segment rules, and create and updatesegment_resultsin the target schema.

This task explains how to grant these segmentation-specific permissions.

The following Reltio roles coordinate this configuration:

Prerequisites

Before you begin, confirm the following requirements:

You completed Databricks permission prerequisites for zero-copy segmentation.
You have the values for <sp>, <catalog>, and <target_schema>.
If segment rules use interaction attributes, you also have the values for <interaction_catalog>, <interaction_schema>, and <interaction_table>.

To configure Databricks permissions for zero-copy segmentation

Assign CAN USE permission on the SQL warehouse to the connection service principal.
Follow the Databricks instructions to manage the SQL warehouse and assign CAN USE permission to the service principal.
Grant the service principal access to the catalog, target schema, and published entity data.
Run the following commands as the target-schema owner or a metastore administrator:
```
GRANT USE CATALOG ON CATALOG <catalog> TO `<sp>`;
GRANT USE SCHEMA ON SCHEMA <catalog>.<target_schema> TO `<sp>`;
GRANT SELECT ON TABLE <catalog>.<target_schema>.entities TO `<sp>`;
```
Unity Catalog requires the complete access chain. The SELECT privilege on entities takes effect only when the service principal also has USE CATALOG and USE SCHEMA.
Grant the service principal permission to create the segment results table.
Run the following command as the target-schema owner or a metastore administrator:
```
GRANT CREATE TABLE ON SCHEMA <catalog>.<target_schema> TO `<sp>`;
```
During the first segment evaluation, the connection service principal createssegment_resultsand becomes the owner of that table. Table ownership provides the privileges required to read and writesegment_results.
Give the service principal write access to segment_results when the table exists under a different owner.
When segment_results exists under a different owner, choose one of these options:
1. Transfer ownership to the connection service principal:
```
ALTER TABLE <catalog>.<target_schema>.segment_results OWNER TO `<sp>`;
```
2. Retain the current owner and grant the required table privileges:
```
GRANT SELECT, MODIFY
ON TABLE <catalog>.<target_schema>.segment_results
TO `<sp>`;
```
Run the selected command as the current table owner or a metastore administrator.

Skip this step when segment_results does not exist, when the connection service principal already owns the table, or when it already has SELECT and MODIFY on the table.
Grant the service principal access to mapped interaction sources when segment rules use interaction attributes.
Run the following command as the owner of each mapped table or view:
```
GRANT USE CATALOG ON CATALOG <interaction_catalog> TO `<sp>`;
GRANT USE SCHEMA ON SCHEMA <interaction_catalog>.<interaction_schema> TO `<sp>`;
GRANT SELECT ON TABLE <interaction_catalog>.<interaction_schema>.<interaction_table> TO `<sp>`;
```
Repeat the commands for every interaction mapping used by segment rules.

Note: For a mapped view, the view owner must retain access to every underlying table.

Result

The connection service principal can use the SQL warehouse, read the required entity and interaction data, and create or use the segment results table. Its access remains limited to the Databricks resources granted in this procedure.

Verification steps

Run the SQL checks as the connection service principal on the warehouse assigned to the Databricks connection.

Confirm access to the published entity data:

SELECT COUNT(*)
FROM <catalog>.<target_schema>.entities;

If segment rules use interaction attributes, confirm access to each mapped interaction source:
```
SELECT COUNT(*)
FROM <interaction_catalog>.<interaction_schema>.<interaction_table>;
```
Evaluate a segment in Reltio Intelligent 360.

Confirm that the evaluation completes without a Databricks permission error.

Confirm that the connection service principal owns segment_results or has SELECT and MODIFY on the table:

SELECT table_name, table_owner
FROM <catalog>.information_schema.tables
WHERE table_schema = '<target_schema>'
  AND table_name = 'segment_results';

SHOW GRANTS `<sp>`
ON TABLE <catalog>.<target_schema>.segment_results;

Confirm that table_owner matches the connection service principal, or that the grants include SELECT and MODIFY.

Compare the number of matching identifiers in Databricks with the segment size in Reltio:
```
SELECT COUNT(DISTINCT entity_id)
FROM <catalog>.<target_schema>.segment_results
WHERE segment_id = '<segment_id>';
```
Confirm that the count matches the segment size displayed in Reltio Intelligent 360.

If a verification step or segment evaluation fails, use Troubleshoot zero-copy segmentation with Databricks to identify the missing permission or configuration.

Unify and manage your data

Configure Databricks permissions for zero-copy segmentation

Footer