Yes, this is what I was looking for. Does the token belong to the censored principal, or to a principal within the admin group? The token needs to belong to a principal which can attach on the cluster.

Can you put the whole error trace here? Or was the above the full error?

How to make it work in a cluster with Unity Catalog enabled?