Can Manage Run Databricks
Yes, the can manage run databricks permission lets users and bots control active job runs. It grants the power to start, cancel, repair, and view logs for specific job runs. Teams use this setting to separate job builders from daily operators. An operator can fix a stalled run without changing the job code. AI agents also use this role to trigger scheduled tasks and check job status. Still, job permissions alone do not filter the data returned by a query. How can manage run databricks works i
Manage Run Databricks: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Yes, the can manage run databricks permission lets users and bots control active job runs. It grants the power to start, cancel, repair, and view logs for specific job runs.
Teams use this setting to separate job builders from daily operators. An operator can fix a stalled run without changing the job code. AI agents also use this role to trigger scheduled tasks and check job status. Still, job permissions alone do not filter the data returned by a query.
How can manage run databricks works in practice
Databricks splits job control into a few clear levels for users and groups. One level only lets a user view run states and read output logs. The next level is can manage run databricks, which adds active run actions. The highest level allows full edits to the job settings, schedules, and clusters.
Engineers with run management rights handle daily operational failures on the platform. They can start a new run when an upstream data feed arrives late. They can stop a stuck run that wastes cloud compute credits. They can also re-run failed tasks inside a multi-step job workflow.
AI agents and automation scripts often run under service accounts with this exact role. A bot triggers a data pipeline and polls the API until the run finishes. If a step fails, the agent reads the error log and repairs the run. The agent cannot alter the notebook path, change cluster sizes, or delete the job.
Security tradeoffs of static keys and job roles
Assigning can manage run databricks limits what a user can break in job settings. Yet it still leaves large security gaps during an active session. Most teams hand out static personal tokens or service keys for API calls. Those keys often live in plain text on laptops or inside CI tools.
If an attacker steals a token, they gain the same job run rights. They can trigger expensive compute jobs or read sensitive output logs from past runs. Also, job roles do not inspect the actual SQL queries or notebook commands. A user who triggers a parameterized job might pass bad inputs into the run.
Manage Run Databricks: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Data exposure is another major risk when engineers debug failed job runs. Output logs and query results often contain raw customer details from production tables. Without extra controls, those logs show real emails, phone numbers, and card numbers. Role settings stop unauthorized job edits, but they do not rewrite sensitive fields.
Why runtime controls matter for data jobs
Modern data teams need deeper control over what happens inside every active session. Static roles only check who a user is before a job starts. They cannot pause a dangerous command or require a quick peer review first.
Adding runtime checks helps teams govern both human engineers and automated AI agents. Teams can log every command and query tied to a real user identity. Real-time data masking also rewrites matched fields like national IDs and emails in results. This keeps raw data safe while engineers check logs and fix broken runs.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between managing a job and managing a run?
Managing a run lets you start, stop, and repair runs for an existing job. Managing a job lets you edit the code path, schedule, cluster, and access list.
Can an AI agent use this permission to change notebook code?
No, this role blocks changes to notebook code, task settings, and cluster configs. The agent can only trigger runs, pass job parameters, and read the run output.
Does this permission hide sensitive data in job run logs?
No, native job permissions do not filter or mask data inside run logs. Anyone who can view the run can see emails or card numbers printed there.