Hi @staskh - Good question. Airlocking Databricks with RBI can easily become more complex than the actual risk you’re trying to manage.

If your end users need insights, don’t give them Databricks access at all. Run workloads via jobs (service principals), keep data in Unity Catalog, and expose only approved outputs via a separate app/BI layer. No workspace access means no download buttons to worry about.

If some users do need interactive access, focus on reducing blast radius, not perfect prevention. You can’t fully stop exfiltration (copy/paste, screenshots, photos). Technology can only raise the bar. Policy and monitoring do the rest.

• Use Unity Catalog with tight table/column/row permissions.
• Prefer Databricks SQL/dashboards and control export there.
• Lock down network and egress (Private Link/VNet, firewalls).

RBI can be a last‑mile control in very high‑security environments. Still, for many deployments, you get more value (and less complexity) from strong permissions, job‑driven access patterns, and network controls rather than trying to airlock the Databricks UI itself.

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.