Steve, your answer incorrect. Databricks does NOT use Horizon/Polaris or any other IRC rest APIs to talk to any external system.  Access to any external Iceberg Catalog like Glue, Google. Horizon, Polaris & etc. is blocked by UNITY either to read or write data.

This is exactly why you have to provide a JDBC connection string for the federated catalogs. Databricks needs to run SQL queries for each table to figure out the schema, columns but more importantly where the actual iceberg files are located.

Because UNITY won't allow IRC Rest Catalog APIs to other catalogs, running bunch of DESC TABLE or SHOW COLUMNS type SQL queries for metadata using Provider's compute (Snowflake compute in the case of Horizon) for each query is both a bottle neck for performance, adds cost to provider but more importantly does not provide the temp vended creds to access the table locations as IRC APIs would.

Because it has no way of fetching vended creds via SQL, it required provider (Snowflake admin) to grant permanent full read/write access to Databricks for their main iceberg table storage locations (Unsecure, major compliancy issues) as Databricks owner can mistakenly blow up any file or folder with that kind of access w/o any knowledge of catalog owner (Snowflake).

It still needs WRITE access even if it needs to only read the table because Databricks compute (mainly Photon) does not currently have ability to directly read Iceberg tables. It will generate Delta metadata for each IB table and use that to query instead of reading Iceberg directly.

If it did use IRC APIs for external catalogs for read & write ops like Glue or Snowflake can, it would :

1. Not need a JDBC Connection (APIs are Driverless.Only login creds would be enough to talk to IRC Apis)
2. Not need SNOWFLAKE_WAREHOUSE for that connection as IRC Rest APIs do not use any provider compute clusters to run queries.
3. Not need permanent read/write access to root storage locations for all iceberg table because IRC dynamically sends Temp Vended Creds for compliant engines to access the files.