Hi @staskh,

Got it. You need something that makes bulk leaks harder without fighting screenshots, phones, etc.

On the Catalog Explorer download button... today, if a user has READ VOLUME on a Unity Catalog volume, Catalog Explorer is explicitly designed to let them select files and click Download. There isn’t a separate UI switch to hide/disable that controls the way some Jupyter‑style file browsers let you do.

The practical pattern, if you want to avoid one‑click file downloads, is..

• Don’t grant business users access to volumes at all (no READ VOLUME), and
• Expose data only as tables/views via Unity Catalog, where you can:
  • Limit what they see (row/column security, views).
  • Control/disable result downloads in downstream tools. For example, the SQL editor has an admin control that can disable downloads entirely for the workspace.

On the earlier endpoint/channel controls point, I meant..

• DLP/CASB: A gateway or endpoint agent that inspects traffic and either blocks or flags patterns like "user just downloaded a 3 GB CSV from Databricks" or "uploaded a large file to a personal SaaS app".
• Rate‑limiting/size limits: Use the built‑in limits (e.g., max download sizes in SQL/Genie) plus your own rules (views that aggregate or cap result sizes) so users can’t casually pull full‑fidelity history in one go.
• VDI/RDS: Put Databricks behind a virtual desktop (Citrix, VMware Horizon, Azure Virtual Desktop, Amazon WorkSpaces, etc.) and lock down that desktop (no local drives, restricted clipboard/printing). That way, even if the UI offers "Download", the data is landing in a tightly controlled environment, not directly on a personal laptop.

In terms of RBI/VDI vendors.... Databricks doesn’t publish an official recommended vendor list for RBI/VDI. In practice, customers usually standardise on whatever is already blessed by their security/org stack (for example, Citrix / VMware Horizon / AVD / Amazon WorkSpaces on the VDI side, or Zscaler / Netskope / Cloudflare‑style secure web gateways on the RBI/DLP side). You can sync with your security architects to validate any specific vendor choices, but we don’t mandate a product‑specific shortlist.

If this answer resolves your question, could you mark it as “Accept as Solution”? That helps other users quickly find the correct fix.