Security and permissions
Apply least privilege across connectors, APIs, automation, and hosted deployment.
Embrasure is a hosted service. Connectors use dedicated identities and bounded scope to read catalog metadata, lineage evidence, and data required by enabled checks.
Read-only data boundary
Embrasure does not write connected warehouse data. Product mutations change Embrasure configuration or open review artifacts such as a draft pull request.
Integration access
- AWS: use a cross-account IAM role limited to selected Glue, Athena, Redshift, S3, and DataZone resources.
- Google Cloud: use the managed service account with BigQuery Job User, scoped Data Viewer, and Data Lineage Viewer.
- Azure: use managed identity or a service principal limited to selected SQL, Cosmos, Purview, Synapse, ADF, and ADLS resources.
- Snowflake and Databricks: use a service user or principal with selected catalog, schema, history, and compute access.
- SQL databases: use a dedicated read-only user and an approved private network path when required.
- GitHub and collaboration apps: grant only the repository, message, interactive-action, and destination permissions required for enabled workflows.
Secrets and network paths
Prefer workload identity, OAuth, managed service accounts, and key pairs over copied passwords. Secrets stay backend-only and must not appear in tickets, logs, screenshots, Terraform plans, or browser environment variables.
Use SSH tunneling or an approved private path for supported SQL sources. Define private networking requirements before production cutover.
API access
The API accepts a bearer session JWT or workspace-enabled personal access token. Tokens carry scopes, and workspace membership still controls access. Write operations require write scope plus an editor or administrator role.
SSO and SCIM can govern user access. They do not widen connector permissions or change the read-only data boundary.