Policy Catalog

Kostavo ships 107 resource policies. Every policy supports Notify mode; the Actions column lists all supported action modes. Add policies to a policy profile to run them.

Clusters & Compute

Policy	ID	Description	Actions
Abandoned Single-User Clusters	cluster_abandoned	Find single-user clusters whose creator is no longer an active workspace member	REMOVE, NOTIFY
Clusters Without Disk Encryption	cluster_disk_encryption	Find clusters with local disk encryption disabled	NOTIFY
Clusters With Custom Docker Containers	cluster_docker_container	Detect clusters using custom Docker images, which may contain unvetted dependencies and bypass standard runtime governance	NOTIFY
Cluster Env Vars — Not Using Secret Scopes	cluster_env_vars_scope	Detect clusters with spark environment variables not backed by Databricks secret scopes ({{secrets/scope/key}})	NOTIFY
Cluster Env Vars — Possible Secrets	cluster_env_vars_secrets	Detect clusters whose spark environment variable values appear to contain secrets (API keys, tokens, connection strings, etc.)	NOTIFY
Clusters With Init Scripts	cluster_init_script	Flag clusters with init scripts that can inject arbitrary code and bypass governance controls	NOTIFY
Clusters With Legacy Access Mode	cluster_legacy_access_mode	Detect clusters using legacy access modes that lack proper data isolation	NOTIFY
Legacy Databricks Runtime	cluster_legacy_runtime	Find clusters running outdated or non-LTS Databricks Runtime versions	NOTIFY
Clusters with Failed Libraries	cluster_library_failed	Find clusters that have libraries in FAILED or SKIPPED installation state	NOTIFY
Long-Running Clusters	cluster_long_running	Find clusters that have been running for longer than a maximum number of hours	REMOVE, FIX, NOTIFY
No Auto-Termination	cluster_no_autotermination	Find clusters with auto-termination disabled or set above a maximum threshold	FIX, NOTIFY
Clusters Without Policy	cluster_no_policy	Find clusters that are not governed by a cluster policy, bypassing org guardrails	NOTIFY
Clusters Without Tags	cluster_no_tags	Find clusters with no custom tags or missing specified required tag keys	NOTIFY
Oversized Clusters	cluster_oversized	Find clusters where the number of workers exceeds a maximum threshold	NOTIFY
Overly Permissive Cluster Access	cluster_permissions_open	Find clusters where broad groups (e.g. 'users') have CAN_ATTACH_TO or CAN_RESTART — this can lead to uncontrolled compute spend and data access	NOTIFY
Permissive Cluster Policies	cluster_policy_permissive	Find cluster policies missing constraints on auto-termination, node types, worker count, or runtime	NOTIFY
Single-Node Cluster Misuse	cluster_single_node_misuse	Find clusters with num_workers=0 (single-node mode) that use large or GPU instance types — this wastes resources since Spark parallelism is not used	NOTIFY
Clusters Not Using Spot Instances	cluster_spot_policy	Find clusters configured with on-demand instances where spot or spot-with-fallback could reduce costs significantly	NOTIFY
Clusters With SSH Access	cluster_ssh_enabled	Detect clusters with SSH public keys configured, allowing direct SSH access to nodes	NOTIFY
Policy Non-Compliant Clusters	policy_noncompliant_cluster	Find clusters that no longer comply with their assigned cluster policy — policy changes may leave existing clusters out of compliance	NOTIFY
Running Compute Clusters	running_compute	Find compute clusters that are currently running	FIX, NOTIFY

SQL Warehouses

Policy	ID	Description	Actions
Stale Saved SQL Queries	stale_saved_query	Find saved SQL queries that have not been updated or run in a long time — workspace clutter that may reference outdated tables or schemas	NOTIFY
Excessive Multi-Cluster Warehouses	warehouse_multi_cluster_excessive	Find SQL warehouses where the maximum number of clusters exceeds a threshold	FIX, NOTIFY
Warehouse No Auto-Stop	warehouse_no_autostop	Find SQL warehouses with auto-stop disabled or set above a maximum threshold	FIX, NOTIFY
Warehouses Without Tags	warehouse_no_tags	Find SQL warehouses with no custom tags or missing specified required tag keys	NOTIFY
Non-Serverless Warehouses	warehouse_not_serverless	Find SQL warehouses not using serverless compute, missing auto-scaling and zero idle cost benefits	NOTIFY
Overly Permissive Warehouse Access	warehouse_permissions_open	Find SQL warehouses where broad groups (e.g. 'users') have CAN_USE or CAN_MANAGE — unrestricted warehouse access can lead to large unexpected compute bills	NOTIFY
Warehouses on Preview Channel	warehouse_preview_channel	Detect SQL warehouses running on the preview channel, which may have stability issues	FIX, NOTIFY
Running SQL Warehouses	warehouse_running	Find SQL warehouses that are currently running	FIX, NOTIFY
Warehouse Size	warehouse_size	Find SQL Warehouses that exceed a specified maximum size and downscale them	REMOVE, FIX, NOTIFY

Jobs

Policy	ID	Description	Actions
Jobs Using All-Purpose Clusters	job_all_purpose_cluster	Find jobs with tasks running on all-purpose clusters instead of job clusters or serverless, which is more expensive	NOTIFY
Job Cluster Env Vars — Not Using Secret Scopes	job_cluster_env_vars_scope	Detect job cluster definitions with spark environment variables not backed by Databricks secret scopes ({{secrets/scope/key}})	NOTIFY
Job Cluster Env Vars — Possible Secrets	job_cluster_env_vars_secrets	Detect job cluster definitions whose spark environment variable values appear to contain secrets (API keys, tokens, connection strings, etc.)	NOTIFY
Job Clusters Without Tags	job_cluster_no_tags	Find jobs with new_cluster definitions missing custom tags for cost tracking	NOTIFY
Job Clusters With SSH Access	job_cluster_ssh	Find jobs with new_cluster definitions that have SSH public keys configured	NOTIFY
Continuous Jobs Running	job_continuous_running	Find jobs configured in continuous mode that are actively running — these incur ongoing compute costs and may be forgotten	FIX, NOTIFY
Excessive Job Concurrency	job_excessive_concurrency	Find jobs configured to allow too many concurrent runs, risking resource contention and cost spikes	FIX, NOTIFY
Repeatedly Failing Jobs	job_failing_repeatedly	Find triggered jobs where the last N consecutive runs have all failed	FIX, NOTIFY
Long-Running Job Runs	job_long_running_run	Detect active job runs that have been executing longer than a configurable threshold	FIX, NOTIFY
Jobs With No/Inactive Creator	job_no_creator	Find jobs whose creator is missing or is no longer an active workspace user (account deleted/deactivated)	FIX, NOTIFY
Jobs Without Failure Notifications	job_no_notification	Find scheduled/triggered jobs with no email or webhook notifications configured for failures	NOTIFY
Jobs Without Retry Policy	job_no_retry_policy	Find scheduled/triggered jobs with tasks that have no retry policy, making them vulnerable to transient failures	NOTIFY
Jobs Without Timeout	job_no_timeout	Find scheduled/triggered jobs with no timeout configured, risking runaway execution	NOTIFY
Jobs Not From Asset Bundle	job_not_asset_bundle	Flag jobs not deployed using Databricks Asset Bundles (DABs), indicating ad-hoc or manually created jobs outside CI/CD governance	NOTIFY
Overly Permissive Job Access	job_permissions_open	Find jobs where broad groups (e.g. 'users') have CAN_MANAGE or CAN_MANAGE_RUN — this can lead to unintended job modifications or costly runs	NOTIFY
Jobs Without Queue Enabled	job_queue_disabled	Find scheduled/triggered jobs without queue enabled — new runs fail instead of queuing when max concurrent runs is reached	FIX, NOTIFY
High-Frequency Scheduled Jobs	job_schedule_frequency	Find jobs scheduled to run more frequently than a threshold — very high-frequency jobs may be better served by streaming or continuous mode	NOTIFY
Jobs with Triggers	job_with_trigger	Find jobs that have active triggers or schedules configured	REMOVE, FIX, NOTIFY
Policy Non-Compliant Jobs	policy_noncompliant_job	Find jobs with compute that no longer complies with the assigned cluster policy — policy changes may leave existing job configurations out of compliance	NOTIFY

Pipelines

Policy	ID	Description	Actions
Continuous Pipelines	pipeline_continuous_mode	Find Lakeflow Declarative Pipelines in continuous mode that run 24/7	FIX, NOTIFY
Pipelines in Development Mode	pipeline_development_mode	Find Lakeflow Declarative Pipelines in development mode — development pipelines skip retries and data quality enforcement, and are not suitable for production	NOTIFY
Pipeline Edition	pipeline_edition	Find Lakeflow Declarative Pipelines not using the expected edition. Higher editions (PRO, ADVANCED) incur additional cost.	NOTIFY
Failed Pipelines	pipeline_failed	Detect Lakeflow Declarative Pipelines stuck in FAILED state	NOTIFY
Pipelines Without Notifications	pipeline_no_notification	Find Lakeflow Declarative Pipelines with no email or webhook notifications configured for failures	NOTIFY
Pipelines Without Target Schema	pipeline_no_target	Find Lakeflow Declarative Pipelines with no target schema or catalog, meaning output goes to an unmanaged location	NOTIFY
Pipelines Not From Asset Bundle	pipeline_not_asset_bundle	Flag Lakeflow Declarative Pipelines not deployed using Databricks Asset Bundles, indicating ad-hoc or manually created pipelines outside CI/CD governance	NOTIFY
Pipelines on Preview Channel	pipeline_preview_channel	Find Lakeflow Declarative Pipelines using the preview channel, which may have stability issues compared to the current (stable) channel	NOTIFY

Model Serving

Policy	ID	Description	Actions
Model Serving Provisioned Throughput	model_serving_provisioned	Find model serving endpoints with provisioned throughput enabled	REMOVE, FIX, NOTIFY
Serving Allowed Entity Types	serving_entity_types	Detect served entities using disallowed entity types (foundation model, external model, custom)	NOTIFY
Serving Env Vars — Not Using Secret Scopes	serving_env_vars_scope	Detect served entities and models with environment variables not backed by Databricks secret scopes ({{secrets/scope/key}})	NOTIFY
Serving Env Vars — Possible Secrets	serving_env_vars_secrets	Detect served entities and models whose environment variable values appear to contain secrets (API keys, tokens, connection strings, etc.)	NOTIFY
Serving Deployment State	serving_model_state	Detect served entities and models in failed, aborted, or recovering deployment states	REMOVE, NOTIFY
Serving Provisioned Concurrency Limits	serving_provisioned_concurrency	Detect served entities and models with provisioned concurrency outside allowed min/max range	FIX, NOTIFY
Serving Scale-to-Zero Disabled	serving_scale_to_zero	Detect served entities and models with scale-to-zero disabled, burning compute 24/7	REMOVE, FIX, NOTIFY
Serving Maximum Workload Size	serving_workload_size	Detect served entities and models exceeding a specified maximum workload size	FIX, NOTIFY
Serving Allowed Workload Types	serving_workload_type	Detect served entities and models using disallowed workload types (GPU, multi-GPU)	NOTIFY

Lakebase

Policy	ID	Description	Actions
Lakebase Excessive Branch Count	lakebase_branch_count_excessive	Detect Lakebase projects with too many branches, which increases cost and operational complexity	NOTIFY
Lakebase Branch No Expiry	lakebase_branch_no_expiry	Detect non-default Lakebase branches without expiry, which accumulate and waste storage	NOTIFY
Lakebase Default Branch Unprotected	lakebase_default_branch_unprotected	Detect Lakebase default branches not protected from accidental deletion or reset	FIX, NOTIFY
Lakebase Endpoint Excessive Max CU	lakebase_endpoint_autoscaling_max_excessive	Detect Lakebase endpoints with autoscaling max compute units above threshold, risking runaway costs	FIX, NOTIFY
Lakebase Endpoint Excessive Min CU	lakebase_endpoint_autoscaling_min_too_high	Detect Lakebase endpoints with autoscaling min compute units above threshold, incurring high baseline costs	FIX, NOTIFY
Lakebase Endpoint No Suspension	lakebase_endpoint_no_suspension	Detect Lakebase endpoints with suspension disabled, wasting compute resources	FIX, NOTIFY
Lakebase Endpoint Excessive Suspend Timeout	lakebase_endpoint_suspend_timeout_excessive	Detect Lakebase endpoints with a suspend timeout longer than allowed, wasting idle compute	FIX, NOTIFY
Lakebase HA Policy	lakebase_ha_policy	Enforce or disallow high availability on Lakebase endpoints based on organisational policy	FIX, NOTIFY
Lakebase Legacy Postgres Version	lakebase_legacy_pg_version	Detect Lakebase projects running a Postgres version below the required minimum	NOTIFY
Lakebase Native Login Enabled	lakebase_native_login_enabled	Detect Lakebase projects with PG native password login enabled, which is less secure than OAuth	FIX, NOTIFY
Lakebase Insufficient PITR Retention	lakebase_pitr_retention_insufficient	Detect Lakebase projects with history retention below the required minimum, risking data loss	FIX, NOTIFY
Lakebase Project No Tags	lakebase_project_no_tags	Detect Lakebase projects without custom tags, which hinders cost tracking and governance	NOTIFY
Lakebase Role Dangerous Attributes	lakebase_role_dangerous_attributes	Detect Lakebase roles with dangerous Postgres attributes that grant excessive capabilities	NOTIFY
Lakebase Role Password Auth	lakebase_role_password_auth	Detect Lakebase roles using Postgres password authentication (SCRAM-SHA-256) instead of OAuth	NOTIFY
Lakebase Role Superuser	lakebase_role_superuser	Detect Lakebase roles with DATABRICKS_SUPERUSER membership, which grants excessive privileges	NOTIFY

Databricks Apps

Policy	ID	Description	Actions
App Compute Size	app_compute_size	Flag Databricks Apps whose compute size exceeds the allowed maximum	NOTIFY
Running Databricks Apps	app_running	Find Databricks Apps that are currently running and optionally stop them	REMOVE, FIX, NOTIFY
App Schedule (Start/Stop)	app_schedule	Automatically start Databricks Apps before operating hours and stop them after operating hours	FIX

Instance Pools

Policy	ID	Description	Actions
Idle Instance Pools	instance_pool_idle	Find instance pools with high minimum idle instances burning pre-warmed VM costs	FIX, NOTIFY
Instance Pool No Autotermination	instance_pool_no_autotermination	Find instance pools where idle instances are kept alive too long, burning pre-warmed VM costs	FIX, NOTIFY
Oversized Instance Pools	instance_pool_oversized	Find instance pools where the minimum idle instances far exceed actual usage — idle instances in pools still incur cloud infrastructure costs	NOTIFY
Unused Instance Pools	instance_pool_unused	Find instance pools not referenced by any running or configured cluster — wasted reserved capacity with no consumers	REMOVE, NOTIFY

Vector Search

Policy	ID	Description	Actions
Empty Vector Search Endpoints	vector_search_empty	Find Vector Search endpoints without indexes	REMOVE, FIX, NOTIFY
Running Vector Search Endpoints	vector_search_running	Find Vector Search endpoints that are provisioned and running	FIX, NOTIFY

Alerts & Dashboards

Policy	ID	Description	Actions
SQL Alerts (v2) Without Notification Destination	alert_v2_no_destination	Find scheduled SQL alerts (v2) with no notification subscribers — alerts fire silently with nobody receiving them. FIX pauses the alert schedule; REMOVE trashes the alert.	REMOVE, FIX, NOTIFY
High-Frequency SQL Alerts (v2)	alert_v2_schedule_frequency	Find SQL alerts (v2) scheduled more frequently than a threshold — very frequent alerts drive unnecessary warehouse usage and cost. FIX pauses the alert schedule.	FIX, NOTIFY
SQL Alerts (v2) on Oversized Warehouse	alert_v2_warehouse_size	Find SQL alerts (v2) attached to a warehouse larger than the allowed maximum — large warehouses are expensive and alerts rarely need them. FIX pauses the alert schedule.	FIX, NOTIFY
Stale Lakeview Dashboards	lakeview_dashboard_stale	Find Lakeview (AI/BI) dashboards that haven't been updated recently — stale dashboards with scheduled refreshes waste warehouse compute	NOTIFY
Legacy SQL Alerts	legacy_alert_enabled	Find legacy SQL alerts using the deprecated v1 API — these should be migrated to v2 alerts for proper scheduling and notification management. REMOVE deletes the alert.	REMOVE, NOTIFY
Legacy SQL Dashboards	legacy_dashboard	Find legacy Redash-based SQL dashboards — these are deprecated and should be migrated to Lakeview (AI/BI) dashboards	NOTIFY

Workspace Security & Hygiene

Policy	ID	Description	Actions
Init Scripts in DBFS	dbfs_init_scripts	Find init scripts stored in /databricks/init which can cause unexpected behavior	NOTIFY
DBFS Large Files	dbfs_large_files	Find files exceeding size threshold in DBFS root	REMOVE, FIX, NOTIFY
Global Init Scripts	global_init_script	Detect global init scripts that run on every cluster, representing a broad security risk	NOTIFY
Missing IP Access Lists	no_ip_access_list	Flag workspaces with no IP access lists configured or all lists disabled	NOTIFY
Secrets Management	secret_scope_exists	Verify that at least one secret scope exists in the workspace, indicating proper use of Databricks Secrets for credential management	NOTIFY
Permissive Secret Scope ACLs	secret_scope_permissive	Find secret scopes that grant MANAGE permission too broadly	NOTIFY
Excessive Service Principals	service_principal_count	Flag workspaces with an unusually high number of service principals — may indicate abandoned automation or poor identity lifecycle management	NOTIFY
Inactive Service Principals	service_principal_inactive	Find service principals that are deactivated but still exist in the workspace — they may still own resources or have stale tokens	NOTIFY
Excessive Token Count	token_excess_count	Alert when a workspace has too many personal access tokens, increasing the attack surface	NOTIFY
Tokens Without Expiry	token_no_expiry	Find personal access tokens that have no expiry date or exceed a maximum lifetime	REMOVE, NOTIFY
Excessive Workspace Admins	workspace_admin_count	Detect when the workspace admins group has too many members, increasing the blast radius of compromised accounts	NOTIFY