The databricks service account used to create the workspace is a project owner, so that shouldn't be the case. If there are additional permissions above and beyond what's granted with "Owner" status let me know, but I don't think that's the issue here. I do notice that the workspace-specific service accounts that get created have the format:
db-{workspace_id}@prod-gcp-us-central1.iam.gserviceaccount.com |
where the project ID is `prod-gcp-us-central1` instead of the actual project specified when creating the workspace. Maybe that has something to do with it?