CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed

[al-conductorone]

Adds the missing Users row to the capabilities list, adds the docs-team input form, removes a stale config field reference that pointed at nothing, and fixes a heading typo. Note: the closed PR's plan to strip out personal-access-token setup was intentionally not revived, since that authentication method is now supported.

[linear-code]

CXH-2351

[github-actions]

🟡 Suggestion: The capabilities table marks Groups as provisionable unconditionally, but README.md and the new docs/docs-info.md both state that account-group provisioning only works with the OAuth (client-id/secret) flow — a workspace token cannot provision groups. Since this PR is the docs cleanup pass, consider adding that caveat here so connector.mdx matches the other two docs.

[github-actions]

Connector PR Review: CXH-2351: complete the Databricks docs and config cleanup dropped when PR #55 closed

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base ef6c2aae70ca.
Review mode: incremental since 6dbda3c3
View review run

Review Summary

The new commit is docs-only: it adds an OAuth-only caveat for group provisioning to docs/connector.mdx and rewords the PAT option from "a single workspace" to "one or more workspaces" with positionally-paired deployment names. Both prior findings are addressed — the capabilities table now carries the group-provisioning caveat, and the PAT wording matches WorkspacesField/WorkspaceTokensField and the equal-length check at pkg/config/config.go:126. The full PR diff (README, config_schema.json, pkg/config/config.go, docs/) was re-scanned for security and correctness; no blocking issues found, and the base-url removal from the field groups is consistent — the field stays in configFields, so the CLI flag and cfg.BaseUrl at pkg/connector/connector.go:202 still work, and since it is ExportTargetCLIOnly the group entries were dangling references.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• docs/connector.mdx:23 — The new note says group provisioning as a whole is unavailable with a workspace token, but README.md and docs/docs-info.md scope the restriction to account groups, and groupBuilder.Grant/Revoke do provision workspace-scoped groups over the workspace plane.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around line 21-24: The Note block states "Group provisioning requires OAuth
  authentication. It is not available when authenticating with a workspace token."
  This reads broader than the actual limitation. README.md ("provisioning of account
  groups from a workspace token is not supported") and docs/docs-info.md
  ("Provisioning of account groups is only available with OAuth") both scope the
  restriction to ACCOUNT groups. In pkg/connector/groups.go, Grant (line 275) and
  Revoke (line 414) resolve a workspaceId from the parent resource and, when it is
  non-empty, call UpdateGroup/UpdateRuleSets against the workspace plane, which a
  workspace token can reach (see prepareClientAuth at pkg/connector/connector.go:215,
  which returns NewTokenAuth for the workspace-token method). Only the account plane
  is unreachable with a workspace token. Reword the note to scope it to account
  groups, e.g. "Provisioning account groups requires OAuth authentication. It is not
  available when authenticating with a workspace token, because the Databricks API
  does not allow provisioning account groups from a workspace token." This also keeps
  connector.mdx, README.md, and docs/docs-info.md consistent with each other.

[github-actions]

No blocking issues found.

[github-actions]

🟡 Suggestion: This drops the "account" qualifier that README.md and docs/docs-info.md both use, so it reads broader than the actual limitation. groupBuilder.Grant/Revoke (pkg/connector/groups.go:275, :414) route through the workspace plane when workspaceId != "", which a workspace token can reach — it's account-level groups that are unreachable, since prepareClientAuth only gets workspace-scoped auth for that method (pkg/connector/connector.go:215). Consider scoping the note to account groups.

Suggested change

	Group provisioning requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning groups from a workspace token.
	Provisioning **account groups** requires OAuth authentication. It is not available when authenticating with a workspace token, because the Databricks API does not allow provisioning account groups from a workspace token.

[github-actions]

No blocking issues found.