More Granular Workspace Permissions (RBAC)

Allow Workspace Admins to assign more granular permissions and create custom roles based on atomic permissions, following the principle of least privilege.

Examples of possible atomic permissions:

• Read workspace settings
• Manage workspace settings
• Read workspace role assignments
• Manage workspace role assignments
• Read OneLake security access role assignments
• Read workspace activity logs
• Read data
• Write data
• Share read data permissions
• Share write data permissions
• Create and edit workspace items
• Delete workspace items
• Share create and edit workspace items
• Share delete workspace items
• etc.

This would enable Workspace Admins to automate auditing and governance, delegate specific responsibilities, and follow least-privilege principles without granting unnecessarily broad workspace roles.