Security and permissions

Embrasure is a hosted service. Connectors use dedicated identities and bounded scope to read catalog metadata, lineage evidence, and data required by enabled checks.

Integration access

• AWS: use a cross-account IAM role limited to selected Glue, Athena, Redshift, S3, and DataZone resources.
• Google Cloud: use the managed service account with BigQuery Job User, scoped Data Viewer, and Data Lineage Viewer.
• Azure: use managed identity or a service principal limited to selected SQL, Cosmos, Purview, Synapse, ADF, and ADLS resources.
• Snowflake and Databricks: use a service user or principal with selected catalog, schema, history, and compute access.
• SQL databases: use a dedicated read-only user and an approved private network path when required.
• GitHub and collaboration apps: grant only the repository, message, interactive-action, and destination permissions required for enabled workflows.

Secrets and network paths

Prefer workload identity, OAuth, managed service accounts, and key pairs over copied passwords. Secrets stay backend-only and must not appear in tickets, logs, screenshots, Terraform plans, or browser environment variables.

Use SSH tunneling or an approved private path for supported SQL sources. Define private networking requirements before production cutover.

API access

The API accepts a bearer session JWT or workspace-enabled personal access token. Tokens carry scopes, and workspace membership still controls access. Write operations require write scope plus an editor or administrator role.

SSO and SCIM can govern user access. They do not widen connector permissions or change the read-only data boundary.