how to restrict creation serving endpoints in databricks to a user

[drag7ter]

Is it possible somehow to restrict creation of the serving endpoints to specific users? I want to grant Workspace access under the Entitlements of the specific group, but I want not to allow users of this group create serving endpoints.

The only way I see to do this revoke permissions to system.ai schema for all workspace users set by default?

[lingareddy_Alva]

@drag7ter 

 Yes, you can restrict the creation of serving endpoints to specific users while still allowing general workspace access.
This is a common requirement when you want to control infrastructure/cost-related operations.

Options for Restricting Serving Endpoint Creation
1. Using Access Control Lists (ACLs)
    The most precise approach is to manage the specific permissions related to serving endpoints:
    REVOKE CREATE SERVING ENDPOINT ON WORKSPACE FROM `group_name`;
    or at the user level:
   REVOKE CREATE SERVING ENDPOINT ON WORKSPACE FROM `user@example.com`;

2. Modifying System Schema Permissions

    Your intuition about the system.ai schema is correct. The serving endpoint functionality is controlled through                 permissions on this schema. You have two approaches:
    Option A: Revoke broadly and grant selectively.
         -- Revoke from all workspace users
         REVOKE ALL PRIVILEGES ON SCHEMA system.ai FROM `users`;

         -- Grant to specific admin users/groups
        GRANT ALL PRIVILEGES ON SCHEMA system.ai TO `admins`;

    Option B: Revoke specific privileges
        -- More targeted approach
        REVOKE CREATE, USAGE ON SCHEMA system.ai FROM `restricted_group`;

3. Using Workspace-Level Entitlements
       If you're using Workspace-level entitlements:
           1. Create a custom entitlement that excludes serving endpoint creation.
           2. Assign this custom entitlement to the group instead of using the predefined roles.

[drag7ter]

@lingareddy_Alva thx for detailed explanation could you pls guide me to databricks docs where and how I can use option 3) ?
3. Using Workspace-Level Entitlements
       If you're using Workspace-level entitlements:
           1. Create a custom entitlement that excludes serving endpoint creation.
           2. Assign this custom entitlement to the group instead of using the predefined roles.

[lingareddy_Alva]

@drag7ter 

While I mentioned Workspace-level entitlements as an approach, I need to clarify something important: Databricks doesn't currently support creating fully customized entitlements where you can exclude specific permissions like "serving endpoint creation" while keeping everything else.

Workspace-Level Entitlements Approach

Rather than creating custom entitlements (which isn't supported), you would:

1. Use the standard entitlement roles that exclude ML capabilities
2. Then supplement with specific SQL permissions

Here's where to find the documentation and how to implement this:

Documentation References

1. Account-level entitlements documentation: https://docs.databricks.com/en/admin/users-groups/index.html
2. Workspace access control documentation: https://docs.databricks.com/en/security/access-control/workspace-acl.html
3. SQL permissions documentation: https://docs.databricks.com/en/sql/language-manual/security-grant.html