Thanks for the detailed information, Iwill review and get back to you if any question meanwhile can you please on this query 

Databricks Workspace ACL Enforcement – How to Prevent Users from Creating Objects Outside Team Folder and Attaching to Shared Clusters?

Background

I am configuring workspace-level access control in Databricks to restrict Data Engineers (DE group) to operate only inside a dedicated team folder and to prevent unintended compute usage.

Here is the setup I implemented:

Configuration Details

Identity & Group Setup

• Created a user and added the user to DE-grp

• Assigned Workspace User role to DE-grp

• Applied default workspace entitlements

Folder Permissions

• Created a workspace folder:
  /Team/DatabricksEngineering

• Assigned CAN MANAGE permission to DE-grp

• No permissions were granted to DE-grp on other workspace folders

Compute Permissions

• Admin created shared clusters

• Granted Attach To permission to DE-grp

• DE-grp does NOT have permission to create clusters

Expected Behavior

I expected the following:

• Users in DE-grp should only create and manage notebooks inside:
  /Team/DatabricksEngineering

• Users should NOT be able to:

  • Create workspace objects outside this folder

  • Attach notebooks to shared clusters unless explicitly allowed

Observed Behavior (Problem)

When logging in as a DE-grp user:

1. Workspace Object Scope Leak

   • User can still create notebooks inside their personal Home folder:
     /Users/<username>

   • Since the user owns their Home folder, they automatically get CAN MANAGE permission

   • This bypasses folder-based governance

2. Compute Access Gap

   • Even though the user cannot create clusters:

   • They can still attach their notebooks which they created in Home folder to existing shared clusters and execute code