A nightly GitHub Actions workflow authenticates as the service principal ci-deployer and runs databricks bundle deploy -t prod, creating and updating the team's Lakeflow Jobs and pipelines in the production workspace. Security policy requires machine identities to hold the narrowest access that still lets the pipeline deploy successfully. Which privilege assignment satisfies the policy?

1. A. Make ci-deployer an account admin, so the nightly deploy can never fail because of a missing permission 💬 A
2. B. Rely on inheritance: a service principal automatically holds the permissions of the engineer who authored the bundle 💬 B
3. C. Grant ci-deployer only what the deployment needs: privileges to create and manage its jobs and pipelines, plus required catalog and schema access ✓ C
4. D. Assign no privileges at all, because bundle deployments run under the workspace identity rather than the signed-in principal 💬 D

Reveal answer

Correct answer: Grant ci-deployer only what the deployment needs: privileges to create and manage its jobs and pipelines, plus required catalog and schema access

Reference: https://docs.databricks.com/aws/en/dev-tools/bundles/