First off, I really enjoyed exploring this app — it's a great starting point, and I personally love the idea of visualizing geospatial data on a 3D pane. The concept and execution are genuinely impressive, and I can see a lot of potential value for customers wanting to bring location intelligence into Genie conversations.
I wanted to share a piece of feedback from the perspective of a Citizen Developer, since I think it's worth considering as the project evolves.
When I deployed the app to my personal workspace, everything worked beautifully — which makes sense, since I'm the only user and there are no other permissions at play. However, when I tried deploying it to an Enterprise workspace by simply following the README (without first reviewing the code in detail), I noticed that the deployment unintentionally overwrote all existing permissions on the SQL Warehouse. For shared enterprise environments where multiple teams and service principals already rely on the warehouse, this can be quite disruptive.
The root cause appears to be in setup_and_deploy.py (around lines 426–433 in https://github.com/databricks-solutions/genie-geo-chat/blob/main/setup_and_deploy.py), where w.warehouses.set_permissions(...) is used. The set_permissions call replaces the entire ACL rather than appending to it, so any pre-existing grants (other users, SPs, groups) get wiped out. The same pattern may apply to a few other permission calls in that section as well.
Would you mind taking another look at the security/permissions setup when you get a chance? Ideally, the deployment should add or update permissions for the required service principal without revoking anything that's already in place. A safer pattern would be to either:
- Use w.warehouses.update_permissions(...) (which patches the ACL incrementally), or
- Fetch the existing ACL first, append the app SP's entry, and pass the full merged list to set_permissions.
A similar review of the w.permissions.update(...) call for the Genie Space would also be worthwhile, just to be safe.
Totally understand this is a solution accelerator and not a hardened product — just flagging it because Citizen Developers (myself included) tend to follow the README verbatim, and a small change here would make the app much safer to drop into enterprise workspaces.
Thanks again for putting this together — really looking forward to seeing where it goes.
