Replit and Databricks AppKit Kill the Permission Code Problem for Enterprise Apps

Building enterprise data apps has always involved a frustrating tradeoff: you either lock down your data so tightly that only engineers can touch it, or you open it up and hope nobody sees something they shouldn't. Replit and Databricks are now taking direct aim at that problem with a deepened integration that puts per-user data governance at the center of the app-building experience, and the public preview is open for sign-ups today.

What Just Changed

The headline feature of this update is user-level authorization inside Databricks Apps built with Replit. The app now acts with the calling user's identity, and Unity Catalog policies, including row-level filters, column masks, and table access control lists, are enforced automatically. In plain terms: the same app can show an HR analyst a full org chart while showing a department manager only their own team, with zero custom filtering code in the application itself.

User authorization enables fine-grained access control by applying Unity Catalog features like row-level filters and column masks to app activity, keeping access control consistent with workspace governance and avoiding hardcoded permission logic in the app. The practical upshot is that when the app accesses data, the user's existing Unity Catalog permissions apply automatically. For example, if a table includes a row filter that limits visibility by region, the app only returns the rows that the user is allowed to query, with no additional filtering logic needed in the app.

The Stack Under the Hood

To understand why this matters, it helps to know what the two pieces of this integration actually do. Databricks AppKit is available inside Replit, a leader in collaborative, agentic app development. The integration allows app developers to develop in Replit and deploy on Databricks, starting from natural language prompts to build data-aware applications.

The Replit agent can examine the kind of data you have access to without that data ever leaving Databricks. Once ready, the app can be deployed from Replit directly into Databricks, where it is hosted entirely within Databricks and inherits Databricks authentication, Unity Catalog-enforced data governance, and existing networking restrictions.

The framework powering this is Databricks AppKit, a TypeScript framework with a layered architecture:

• Data Layer: Connects to governed Databricks services including SQL warehouses, Lakebase (Postgres), model serving endpoints, and agents.
• Server Layer: A Node.js backend with use-case plugins that handle authentication, caching, streaming, telemetry, timeouts, retries, and rate limits out of the box.
• Client Layer: A React frontend that renders UI components, manages state, and provides type-safe query hooks.

The Problem This Actually Solves

Enterprise applications today are rarely just forms on a database. The apps enterprise teams are asking for tend to be long running and stateful, and they almost always touch sensitive or regulated data. The old pattern was painful: a business owner identifies a need, a prototype gets hacked together somewhere, and then the real work gets thrown over the wall to an engineering team to add proper security before it can go to production.

Rather than extracting and copying sensitive data into development environments, builders now have direct, authorized access to tables, models, and warehouses through Replit's IDE. This means developers can reference live data schemas, query against actual datasets, and iterate on applications without ever materializing copies of sensitive information. For enterprises with compliance requirements, this eliminates a major security and audit problem.

The governance model that makes this work is Unity Catalog's row-level security, which has been generally available since mid-2024. Row filters restrict which rows a user can see in a table. The filter is a SQL user-defined function that evaluates each row at query time, excluding rows where the function returns false. This is commonly used for row-level security. What's new here is that these filters now flow through automatically to apps built in Replit, without any extra plumbing.

Who Wins Here

The clearest winner is the enterprise persona who has been stuck waiting for engineering bandwidth. Enterprise users can now vibe code living applications in Replit, then deploy them into Databricks so they inherit the governance, security, and observability platform teams expect. The security team doesn't have to audit every new internal tool from scratch because the governance is enforced at the data layer, not the app layer.

Real-world examples of what this unlocks:

• An HR analyst builds a full org view for the CEO without ever having direct access to the underlying employee records.
• A sales dashboard that automatically shows each rep only their own accounts, with managers seeing their whole team, all from a single deployed app.
• Compliance-sensitive healthcare or financial apps where different user roles see different slices of the same dataset.

True per-user governance means Unity Catalog policies including row filters, column masks, and ACLs apply automatically. Least-privilege scopes plus UC permissions prevent the app from overreaching even if misconfigured. User-level auditability means audit logs can attribute actions to the end user, not just the app service principal.

The Bigger Picture

This update lands at an interesting moment. Replit recently raised $400 million at a $9 billion valuation , and the company has been aggressively pushing into the enterprise market. Databricks, meanwhile, has been building out its application hosting story since Databricks Apps launched in public preview in October 2024, with customers already having built tens of thousands of apps on the platform.

The competitive implication is significant. Tools like Retool, Streamlit, and Gradio have long owned the "internal data app" category, but they all require developers to manually implement access control. By making governance automatic and inherited from the data layer, the Replit-Databricks combination removes one of the biggest reasons enterprises hesitate to let non-engineers build internal tools.

If enterprises try to bolt governance and observability on at the end, they end up with brittle tools that platform and security teams do not trust. As Replit and Databricks continue working together, the goal is to let more people inside a business participate in building data-driven applications without compromising on security or governance.

What's Next

The public preview for this user-authorization feature in Databricks Apps is open now. If you're building on Replit and want to connect to Databricks, the Replit x Databricks partner page is where to sign up. Existing Replit enterprise customers can reach out to their account teams for gated access. The Databricks AppKit documentation covers the TypeScript framework in detail if you want to understand what you're deploying into.

The broader trajectory here points toward a world where the question "who is allowed to see this?" gets answered once, at the data layer, and every app built on top of it just inherits the answer automatically. That's a meaningful shift for any team that has ever spent a sprint writing permission checks that should have been someone else's problem.