How Lakemine works

Lakemine runs inside your own Databricks account, reads your usage data in place, and never receives your data or your Databricks sign-in.

This page is the short version, written for a security reviewer or Databricks administrator deciding whether to bring Lakemine in. It takes a few minutes to read.

Where everything runs

Everything inside Your Databricks account stays there. What does leave is install metadata and aggregate usage figures, listed in What is Lakemine. Every connection is started from your side. Lakemine has no way in.

How install works

The installer is a setup wizard you run once. It is not a service, and it does not stay running.

1. Sign in to Lakemine. The installer confirms your subscription is active before it touches anything in Databricks.
2. Connect to your own Databricks account. You sign in to Databricks yourself, in your browser. Lakemine is never given your Databricks sign-in and never asks for it.
3. Choose where it goes. The installer lists your workspaces, catalogs and SQL warehouses. You pick where results are written, how often the scan runs, how far back it looks, and which group of people can open the dashboard.
4. Review what it needs. The installer checks which permissions are already in place and asks only for the ones that are missing, showing each one with a plain reason before it is applied.
5. It creates a dedicated machine identity (a Databricks service principal, not a human user) for the scan to run as, and a place in your catalog for the results to be written.
6. The scan and the dashboard are deployed into the workspace you chose. The analysis code is deployed in compiled form.
7. The first scan runs straight away so the dashboard has something in it rather than opening empty.
8. The installer is finished. It has no background service and no part in running the scan. You can close it, and you can remove it from your machine. It keeps a little data on your computer, listed in What the installer stores on your computer.

Uninstalling removes everything Lakemine created, including the scan, the dashboard, the results tables and the identity the scan ran as.

Permissions

Install is a one-time administrative act, done under your own identity so it is attributable to a named person. The installer then creates one dedicated machine identity that the scheduled scan runs as from that point on. Nothing runs as a person after setup, so the scan does not change behaviour or break when someone changes role or leaves. That identity needs to read the usage data Databricks keeps, to read and write its own results tables, and to use the SQL warehouse you picked. Nothing else.

One caveat worth knowing before you install: Databricks grants access to its usage data at the account level. There is no way to narrow that read access to a single workspace. That is how Databricks structures this data, not a choice Lakemine makes, so the scan identity can see usage across your whole Databricks account even though everything Lakemine deploys lives in the one workspace you chose.

If you need more detail

For the permission list in full, the reasoning behind splitting the install identity from the run identity, and the exact fields in each report, see Access model in depth and What is Lakemine.

For a short summary of where your data stays and what access the installer requests, see Security overview.