azure-dbx-job-run-now

id: azure-dbx-job-run-now
emits: CanTrigger
applies_to:
- azure
match_effective_permission:
  action: databricks:jobs:run
  scope_type: job
where:
- principal has CAN_MANAGE_RUN or CAN_MANAGE on the target job (POST /api/2.1/jobs/run-now)
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <Databricks Job (BatchJob)>
  permissions:
  - "databricks:jobs:run (CAN_MANAGE_RUN or CAN_MANAGE \u2014 POST /api/2.1/jobs/run-now)"
  api_source: Databricks workspace object ACL (job permissions)
  evidence_field: job.permissions[].permission_level
  note: This is an explicit normalization rule that reads Databricks job ACL data to emit CanTrigger.
    The CAN_MANAGE_RUN / CAN_MANAGE permission on a job is an explicit data-plane permission fact (not
    derived).
  false_positive_note: "CAN_MANAGE_RUN is the trigger-only privilege; it allows run-now and cancel but\
    \ NOT job definition update (that requires CAN_MANAGE). Trigger-only yields CanExecuteAs only via\
    \ cicd-chains cicd-trigger-runner-executes-as, which is CONDITIONAL(attacker_influenced_definition)\
    \ \u2014 only if the job's CURRENT definition already runs attacker-influenced code. Do NOT derive\
    \ ACTIVE CanExecuteAs from trigger-only without evidence of attacker code already in the definition."
  narrative: '{principal.name} can trigger an immediate run of Databricks job {target.name} (CAN_MANAGE_RUN,
    /api/2.1/jobs/run-now), causing it to execute on its configured cluster and run as the cluster''s
    managed identity.'