We're an ISV. Our product is installed into each customer's own Databricks
workspace as a dedicated deployment. We maintain the code and run all
deployments; the customer never installs anything themselves.
We license per store, so the product needs to know which of the customer's
stores are licensed. That record has to be readable by the customer but not
modifiable โ and since they hold admin over their own metastore, anything we
leave in their workspace can be changed by them.
Our plan is to keep the list in our own workspace; Delta Share it read-only into
theirs, and have our batch jobs read the share directly at decision time, so
nothing in the enforcement path reads a table they can write to. At job startup
we also check that the catalog really is a Delta Sharing catalog originating
from our provider, so a similarly named local catalog can't be substituted.
We've tested the basics โ the share mounts, a local view can reference it, and
writes are refused at credential vending, which is the behaviour we wanted.
Is Delta Sharing a reasonable fit for holding per-customer entitlement data this
way, or are we stretching it beyond what it's meant for? Interested in how other
ISVs handle entitlement that the customer must be able to read but not change.
Thanks in Advance!
