Thank you again for such a valuable response!

While recommending using Instance Profile, did you mean a solution described at https://docs.databricks.com/en/connect/storage/tutorial-s3-instance-profile.html ? It is noted as a "legacy pattern", and Unity Catalog recomended insteat.  

Do I understand correctly that Spark library is using Unity Catalog credential model ( and those "external location" provision works well), but Pandas library still follow legacy credential model and need different permisison provisioning?

Regards

Stas