diff --git a/.codegen/_openapi_sha b/.codegen/_openapi_sha
index c9e7a8be7..b59218d39 100644
--- a/.codegen/_openapi_sha
+++ b/.codegen/_openapi_sha
@@ -1 +1 @@
-7b57ba3a53f4de3d049b6a24391fe5474212daf8
\ No newline at end of file
+09a7fa63d9ae243e5407941f200960ca14d48b07
\ No newline at end of file
diff --git a/.codegen/cmds-workspace.go.tmpl b/.codegen/cmds-workspace.go.tmpl
index 013c62f88..a9daa05d8 100644
--- a/.codegen/cmds-workspace.go.tmpl
+++ b/.codegen/cmds-workspace.go.tmpl
@@ -2,7 +2,15 @@
 
 package workspace
 
-{{ $excludes := list "command-execution" "statement-execution" "dbfs" "dbsql-permissions" "account-access-control-proxy" }}
+{{ $excludes :=
+	list
+		"command-execution"
+		"statement-execution"
+		"dbfs"
+		"dbsql-permissions"
+		"account-access-control-proxy"
+		"files"
+}}
 
 import (
 	"github.com/databricks/cli/cmd/root"
diff --git a/.codegen/service.go.tmpl b/.codegen/service.go.tmpl
index 91f2e5cf7..4ede142d2 100644
--- a/.codegen/service.go.tmpl
+++ b/.codegen/service.go.tmpl
@@ -10,7 +10,15 @@ import (
 	"github.com/spf13/cobra"
 )
 
-{{ $excludes := list "command-execution" "statement-execution" "dbfs" "dbsql-permissions" "account-access-control-proxy" }}
+{{ $excludes :=
+	list
+		"command-execution"
+		"statement-execution"
+		"dbfs"
+		"dbsql-permissions"
+		"account-access-control-proxy"
+		"files"
+}}
 
 {{if not (in $excludes .KebabName) }}
 	{{template "service" .}}
diff --git a/.gitattributes b/.gitattributes
index f9ea04180..3209a0f3f 100755
--- a/.gitattributes
+++ b/.gitattributes
@@ -25,6 +25,7 @@ cmd/account/vpc-endpoints/vpc-endpoints.go linguist-generated=true
 cmd/account/workspace-assignment/workspace-assignment.go linguist-generated=true
 cmd/account/workspaces/workspaces.go linguist-generated=true
 cmd/workspace/alerts/alerts.go linguist-generated=true
+cmd/workspace/artifact-allowlists/artifact-allowlists.go linguist-generated=true
 cmd/workspace/catalogs/catalogs.go linguist-generated=true
 cmd/workspace/clean-rooms/clean-rooms.go linguist-generated=true
 cmd/workspace/cluster-policies/cluster-policies.go linguist-generated=true
@@ -32,6 +33,7 @@ cmd/workspace/clusters/clusters.go linguist-generated=true
 cmd/workspace/cmd.go linguist-generated=true
 cmd/workspace/connections/connections.go linguist-generated=true
 cmd/workspace/current-user/current-user.go linguist-generated=true
+cmd/workspace/dashboard-widgets/dashboard-widgets.go linguist-generated=true
 cmd/workspace/dashboards/dashboards.go linguist-generated=true
 cmd/workspace/data-sources/data-sources.go linguist-generated=true
 cmd/workspace/experiments/experiments.go linguist-generated=true
@@ -48,14 +50,17 @@ cmd/workspace/jobs/jobs.go linguist-generated=true
 cmd/workspace/libraries/libraries.go linguist-generated=true
 cmd/workspace/metastores/metastores.go linguist-generated=true
 cmd/workspace/model-registry/model-registry.go linguist-generated=true
+cmd/workspace/model-versions/model-versions.go linguist-generated=true
 cmd/workspace/permissions/permissions.go linguist-generated=true
 cmd/workspace/pipelines/pipelines.go linguist-generated=true
 cmd/workspace/policy-families/policy-families.go linguist-generated=true
 cmd/workspace/providers/providers.go linguist-generated=true
 cmd/workspace/queries/queries.go linguist-generated=true
 cmd/workspace/query-history/query-history.go linguist-generated=true
+cmd/workspace/query-visualizations/query-visualizations.go linguist-generated=true
 cmd/workspace/recipient-activation/recipient-activation.go linguist-generated=true
 cmd/workspace/recipients/recipients.go linguist-generated=true
+cmd/workspace/registered-models/registered-models.go linguist-generated=true
 cmd/workspace/repos/repos.go linguist-generated=true
 cmd/workspace/schemas/schemas.go linguist-generated=true
 cmd/workspace/secrets/secrets.go linguist-generated=true
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 3209ae93d..f0fa2ee68 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -5,6 +5,14 @@ on:
     types: [opened, synchronize]
   merge_group:
     types: [checks_requested]
+  push:
+    # Always run on push to main. The build cache can only be reused
+    # if it was saved by a run from the repository's default branch.
+    # The run result will be identical to that from the merge queue
+    # because the commit is identical, yet we need to perform it to
+    # seed the build cache.
+    branches:
+      - main
 
 jobs:
   tests:
@@ -20,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Unshallow
         run: git fetch --prune --unshallow
@@ -50,7 +58,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Go
         uses: actions/setup-go@v4
diff --git a/.github/workflows/release-snapshot.yml b/.github/workflows/release-snapshot.yml
index fbf5421b4..c3398a2bd 100644
--- a/.github/workflows/release-snapshot.yml
+++ b/.github/workflows/release-snapshot.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Unshallow
         run: git fetch --prune --unshallow
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c166fc5b6..cbab15ecc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository and submodules
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Unshallow
         run: git fetch --prune --unshallow
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 687e0fc02..869465286 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -8,5 +8,7 @@
     "files.trimFinalNewlines": true,
     "python.envFile": "${workspaceFolder}/.databricks/.databricks.env",
     "databricks.python.envFile": "${workspaceFolder}/.env",
-    "python.analysis.stubPath": ".vscode"
+    "python.analysis.stubPath": ".vscode",
+    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
+    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------"
 }
diff --git a/bundle/artifacts/artifacts.go b/bundle/artifacts/artifacts.go
index c54131217..0331adb70 100644
--- a/bundle/artifacts/artifacts.go
+++ b/bundle/artifacts/artifacts.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"path/filepath"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/artifacts/whl"
@@ -107,7 +108,7 @@ func uploadArtifact(ctx context.Context, a *config.Artifact, b *bundle.Bundle) e
 	for i := range a.Files {
 		f := &a.Files[i]
 		if f.NeedsUpload() {
-			filename := path.Base(f.Source)
+			filename := filepath.Base(f.Source)
 			cmdio.LogString(ctx, fmt.Sprintf("artifacts.Upload(%s): Uploading...", filename))
 			remotePath, err := uploadArtifactFile(ctx, f.Source, b)
 			if err != nil {
@@ -136,7 +137,7 @@ func uploadArtifactFile(ctx context.Context, file string, b *bundle.Bundle) (str
 	}
 
 	fileHash := sha256.Sum256(raw)
-	remotePath := path.Join(uploadPath, fmt.Sprintf("%x", fileHash), path.Base(file))
+	remotePath := path.Join(uploadPath, fmt.Sprintf("%x", fileHash), filepath.Base(file))
 	// Make sure target directory exists.
 	err = b.WorkspaceClient().Workspace.MkdirsByPath(ctx, path.Dir(remotePath))
 	if err != nil {
diff --git a/bundle/artifacts/artifacts_test.go b/bundle/artifacts/artifacts_test.go
new file mode 100644
index 000000000..4c0a18f38
--- /dev/null
+++ b/bundle/artifacts/artifacts_test.go
@@ -0,0 +1,121 @@
+package artifacts
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"regexp"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+	"github.com/stretchr/testify/require"
+)
+
+func touchEmptyFile(t *testing.T, path string) {
+	err := os.MkdirAll(filepath.Dir(path), 0700)
+	require.NoError(t, err)
+	f, err := os.Create(path)
+	require.NoError(t, err)
+	f.Close()
+}
+
+type MockWorkspaceService struct {
+}
+
+// Delete implements workspace.WorkspaceService.
+func (MockWorkspaceService) Delete(ctx context.Context, request workspace.Delete) error {
+	panic("unimplemented")
+}
+
+// Export implements workspace.WorkspaceService.
+func (MockWorkspaceService) Export(ctx context.Context, request workspace.ExportRequest) (*workspace.ExportResponse, error) {
+	panic("unimplemented")
+}
+
+// GetStatus implements workspace.WorkspaceService.
+func (MockWorkspaceService) GetStatus(ctx context.Context, request workspace.GetStatusRequest) (*workspace.ObjectInfo, error) {
+	panic("unimplemented")
+}
+
+// Import implements workspace.WorkspaceService.
+func (MockWorkspaceService) Import(ctx context.Context, request workspace.Import) error {
+	return nil
+}
+
+// List implements workspace.WorkspaceService.
+func (MockWorkspaceService) List(ctx context.Context, request workspace.ListWorkspaceRequest) (*workspace.ListResponse, error) {
+	panic("unimplemented")
+}
+
+// Mkdirs implements workspace.WorkspaceService.
+func (MockWorkspaceService) Mkdirs(ctx context.Context, request workspace.Mkdirs) error {
+	return nil
+}
+
+// GetPermissionLevels implements workspace.WorkspaceService.
+func (MockWorkspaceService) GetPermissionLevels(
+	ctx context.Context,
+	request workspace.GetWorkspaceObjectPermissionLevelsRequest,
+) (*workspace.GetWorkspaceObjectPermissionLevelsResponse, error) {
+	panic("unimplemented")
+}
+
+// GetPermissions implements workspace.WorkspaceService.
+func (MockWorkspaceService) GetPermissions(
+	ctx context.Context,
+	request workspace.GetWorkspaceObjectPermissionsRequest,
+) (*workspace.WorkspaceObjectPermissions, error) {
+	panic("unimplemented")
+}
+
+// SetPermissions implements workspace.WorkspaceService.
+func (MockWorkspaceService) SetPermissions(
+	ctx context.Context,
+	request workspace.WorkspaceObjectPermissionsRequest,
+) (*workspace.WorkspaceObjectPermissions, error) {
+	panic("unimplemented")
+}
+
+// UpdatePermissions implements workspace.WorkspaceService.
+func (MockWorkspaceService) UpdatePermissions(
+	ctx context.Context,
+	request workspace.WorkspaceObjectPermissionsRequest,
+) (*workspace.WorkspaceObjectPermissions, error) {
+	panic("unimplemented")
+}
+
+func TestUploadArtifactFileToCorrectRemotePath(t *testing.T) {
+	dir := t.TempDir()
+	whlPath := filepath.Join(dir, "dist", "test.whl")
+	touchEmptyFile(t, whlPath)
+	b := &bundle.Bundle{
+		Config: config.Root{
+			Path: dir,
+			Bundle: config.Bundle{
+				Target: "whatever",
+			},
+			Workspace: config.Workspace{
+				ArtifactsPath: "/Users/test@databricks.com/whatever",
+			},
+		},
+	}
+
+	b.WorkspaceClient().Workspace.WithImpl(MockWorkspaceService{})
+	artifact := &config.Artifact{
+		Files: []config.ArtifactFile{
+			{
+				Source: whlPath,
+				Libraries: []*compute.Library{
+					{Whl: "dist\\test.whl"},
+				},
+			},
+		},
+	}
+
+	err := uploadArtifact(context.Background(), artifact, b)
+	require.NoError(t, err)
+	require.Regexp(t, regexp.MustCompile("/Users/test@databricks.com/whatever/.internal/[a-z0-9]+/test.whl"), artifact.Files[0].RemotePath)
+}
diff --git a/bundle/config/artifact.go b/bundle/config/artifact.go
index 60331eb13..1955e265d 100644
--- a/bundle/config/artifact.go
+++ b/bundle/config/artifact.go
@@ -8,9 +8,18 @@ import (
 	"path"
 	"strings"
 
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 )
 
+type Artifacts map[string]*Artifact
+
+func (artifacts Artifacts) SetConfigFilePath(path string) {
+	for _, artifact := range artifacts {
+		artifact.ConfigFilePath = path
+	}
+}
+
 type ArtifactType string
 
 const ArtifactPythonWheel ArtifactType = `whl`
@@ -34,6 +43,8 @@ type Artifact struct {
 	// (Python wheel, Java jar and etc) itself
 	Files        []ArtifactFile `json:"files"`
 	BuildCommand string         `json:"build"`
+
+	paths.Paths
 }
 
 func (a *Artifact) Build(ctx context.Context) ([]byte, error) {
diff --git a/bundle/config/mutator/override_compute_test.go b/bundle/config/mutator/override_compute_test.go
index f04c91c46..cb37eeb5f 100644
--- a/bundle/config/mutator/override_compute_test.go
+++ b/bundle/config/mutator/override_compute_test.go
@@ -2,7 +2,6 @@ package mutator_test
 
 import (
 	"context"
-	"os"
 	"testing"
 
 	"github.com/databricks/cli/bundle"
@@ -16,7 +15,7 @@ import (
 )
 
 func TestOverrideDevelopment(t *testing.T) {
-	os.Setenv("DATABRICKS_CLUSTER_ID", "")
+	t.Setenv("DATABRICKS_CLUSTER_ID", "")
 	bundle := &bundle.Bundle{
 		Config: config.Root{
 			Bundle: config.Bundle{
@@ -62,7 +61,7 @@ func TestOverrideDevelopment(t *testing.T) {
 }
 
 func TestOverrideDevelopmentEnv(t *testing.T) {
-	os.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
+	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	bundle := &bundle.Bundle{
 		Config: config.Root{
 			Resources: config.Resources{
@@ -90,7 +89,7 @@ func TestOverrideDevelopmentEnv(t *testing.T) {
 }
 
 func TestOverridePipelineTask(t *testing.T) {
-	os.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
+	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	bundle := &bundle.Bundle{
 		Config: config.Root{
 			Resources: config.Resources{
@@ -144,7 +143,7 @@ func TestOverrideProduction(t *testing.T) {
 }
 
 func TestOverrideProductionEnv(t *testing.T) {
-	os.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
+	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	bundle := &bundle.Bundle{
 		Config: config.Root{
 			Resources: config.Resources{
diff --git a/bundle/config/mutator/process_target_mode.go b/bundle/config/mutator/process_target_mode.go
index be93512bb..06ae7b858 100644
--- a/bundle/config/mutator/process_target_mode.go
+++ b/bundle/config/mutator/process_target_mode.go
@@ -160,10 +160,7 @@ func (m *processTargetMode) Apply(ctx context.Context, b *bundle.Bundle) error {
 		}
 		return transformDevelopmentMode(b)
 	case config.Production:
-		isPrincipal, err := auth.IsServicePrincipal(ctx, b.WorkspaceClient(), b.Config.Workspace.CurrentUser.Id)
-		if err != nil {
-			return err
-		}
+		isPrincipal := auth.IsServicePrincipal(b.Config.Workspace.CurrentUser.Id)
 		return validateProductionMode(ctx, b, isPrincipal)
 	case "":
 		// No action
diff --git a/bundle/config/mutator/trampoline_test.go b/bundle/config/mutator/trampoline_test.go
index f8a376a7f..daf09257f 100644
--- a/bundle/config/mutator/trampoline_test.go
+++ b/bundle/config/mutator/trampoline_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/require"
@@ -69,7 +70,7 @@ func TestGenerateTrampoline(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"test": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: tmpDir,
 						},
 						JobSettings: &jobs.JobSettings{
diff --git a/bundle/config/mutator/translate_paths.go b/bundle/config/mutator/translate_paths.go
index 08f839861..acfd55258 100644
--- a/bundle/config/mutator/translate_paths.go
+++ b/bundle/config/mutator/translate_paths.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"path"
 	"path/filepath"
@@ -11,8 +12,6 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/libs/notebook"
-	"github.com/databricks/databricks-sdk-go/service/jobs"
-	"github.com/databricks/databricks-sdk-go/service/pipelines"
 )
 
 type ErrIsNotebook struct {
@@ -44,7 +43,9 @@ func (m *translatePaths) Name() string {
 	return "TranslatePaths"
 }
 
-// rewritePath converts a given relative path to a stable remote workspace path.
+type rewriteFunc func(literal, localFullPath, localRelPath, remotePath string) (string, error)
+
+// rewritePath converts a given relative path from the loaded config to a new path based on the passed rewriting function
 //
 // It takes these arguments:
 //   - The argument `dir` is the directory relative to which the given relative path is.
@@ -57,13 +58,23 @@ func (m *translatePaths) rewritePath(
 	dir string,
 	b *bundle.Bundle,
 	p *string,
-	fn func(literal, localPath, remotePath string) (string, error),
+	fn rewriteFunc,
 ) error {
 	// We assume absolute paths point to a location in the workspace
 	if path.IsAbs(filepath.ToSlash(*p)) {
 		return nil
 	}
 
+	url, err := url.Parse(*p)
+	if err != nil {
+		return err
+	}
+
+	// If the file path has scheme, it's a full path and we don't need to transform it
+	if url.Scheme != "" {
+		return nil
+	}
+
 	// Local path is relative to the directory the resource was defined in.
 	localPath := filepath.Join(dir, filepath.FromSlash(*p))
 	if interp, ok := m.seen[localPath]; ok {
@@ -72,19 +83,19 @@ func (m *translatePaths) rewritePath(
 	}
 
 	// Remote path must be relative to the bundle root.
-	remotePath, err := filepath.Rel(b.Config.Path, localPath)
+	localRelPath, err := filepath.Rel(b.Config.Path, localPath)
 	if err != nil {
 		return err
 	}
-	if strings.HasPrefix(remotePath, "..") {
+	if strings.HasPrefix(localRelPath, "..") {
 		return fmt.Errorf("path %s is not contained in bundle root path", localPath)
 	}
 
 	// Prefix remote path with its remote root path.
-	remotePath = path.Join(b.Config.Workspace.FilesPath, filepath.ToSlash(remotePath))
+	remotePath := path.Join(b.Config.Workspace.FilesPath, filepath.ToSlash(localRelPath))
 
 	// Convert local path into workspace path via specified function.
-	interp, err := fn(*p, localPath, filepath.ToSlash(remotePath))
+	interp, err := fn(*p, localPath, localRelPath, filepath.ToSlash(remotePath))
 	if err != nil {
 		return err
 	}
@@ -94,81 +105,69 @@ func (m *translatePaths) rewritePath(
 	return nil
 }
 
-func (m *translatePaths) translateNotebookPath(literal, localPath, remotePath string) (string, error) {
-	nb, _, err := notebook.Detect(localPath)
+func translateNotebookPath(literal, localFullPath, localRelPath, remotePath string) (string, error) {
+	nb, _, err := notebook.Detect(localFullPath)
 	if os.IsNotExist(err) {
 		return "", fmt.Errorf("notebook %s not found", literal)
 	}
 	if err != nil {
-		return "", fmt.Errorf("unable to determine if %s is a notebook: %w", localPath, err)
+		return "", fmt.Errorf("unable to determine if %s is a notebook: %w", localFullPath, err)
 	}
 	if !nb {
-		return "", ErrIsNotNotebook{localPath}
+		return "", ErrIsNotNotebook{localFullPath}
 	}
 
 	// Upon import, notebooks are stripped of their extension.
-	return strings.TrimSuffix(remotePath, filepath.Ext(localPath)), nil
+	return strings.TrimSuffix(remotePath, filepath.Ext(localFullPath)), nil
 }
 
-func (m *translatePaths) translateFilePath(literal, localPath, remotePath string) (string, error) {
-	nb, _, err := notebook.Detect(localPath)
+func translateFilePath(literal, localFullPath, localRelPath, remotePath string) (string, error) {
+	nb, _, err := notebook.Detect(localFullPath)
 	if os.IsNotExist(err) {
 		return "", fmt.Errorf("file %s not found", literal)
 	}
 	if err != nil {
-		return "", fmt.Errorf("unable to determine if %s is not a notebook: %w", localPath, err)
+		return "", fmt.Errorf("unable to determine if %s is not a notebook: %w", localFullPath, err)
 	}
 	if nb {
-		return "", ErrIsNotebook{localPath}
+		return "", ErrIsNotebook{localFullPath}
 	}
 	return remotePath, nil
 }
 
-func (m *translatePaths) translateJobTask(dir string, b *bundle.Bundle, task *jobs.Task) error {
-	var err error
-
-	if task.NotebookTask != nil {
-		err = m.rewritePath(dir, b, &task.NotebookTask.NotebookPath, m.translateNotebookPath)
-		if target := (&ErrIsNotNotebook{}); errors.As(err, target) {
-			return fmt.Errorf(`expected a notebook for "tasks.notebook_task.notebook_path" but got a file: %w`, target)
-		}
-		if err != nil {
-			return err
-		}
-	}
-
-	if task.SparkPythonTask != nil {
-		err = m.rewritePath(dir, b, &task.SparkPythonTask.PythonFile, m.translateFilePath)
-		if target := (&ErrIsNotebook{}); errors.As(err, target) {
-			return fmt.Errorf(`expected a file for "tasks.spark_python_task.python_file" but got a notebook: %w`, target)
-		}
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
+func translateNoOp(literal, localFullPath, localRelPath, remotePath string) (string, error) {
+	return localRelPath, nil
 }
 
-func (m *translatePaths) translatePipelineLibrary(dir string, b *bundle.Bundle, library *pipelines.PipelineLibrary) error {
-	var err error
+type transformer struct {
+	// A directory path relative to which `path` will be transformed
+	dir string
+	// A path to transform
+	path *string
+	// Name of the config property where the path string is coming from
+	configPath string
+	// A function that performs the actual rewriting logic.
+	fn rewriteFunc
+}
 
-	if library.Notebook != nil {
-		err = m.rewritePath(dir, b, &library.Notebook.Path, m.translateNotebookPath)
-		if target := (&ErrIsNotNotebook{}); errors.As(err, target) {
-			return fmt.Errorf(`expected a notebook for "libraries.notebook.path" but got a file: %w`, target)
-		}
-		if err != nil {
-			return err
-		}
-	}
+type transformFunc func(resource any, dir string) *transformer
 
-	if library.File != nil {
-		err = m.rewritePath(dir, b, &library.File.Path, m.translateFilePath)
-		if target := (&ErrIsNotebook{}); errors.As(err, target) {
-			return fmt.Errorf(`expected a file for "libraries.file.path" but got a notebook: %w`, target)
+// Apply all matches transformers for the given resource
+func (m *translatePaths) applyTransformers(funcs []transformFunc, b *bundle.Bundle, resource any, dir string) error {
+	for _, transformFn := range funcs {
+		transformer := transformFn(resource, dir)
+		if transformer == nil {
+			continue
 		}
+
+		err := m.rewritePath(transformer.dir, b, transformer.path, transformer.fn)
 		if err != nil {
+			if target := (&ErrIsNotebook{}); errors.As(err, target) {
+				return fmt.Errorf(`expected a file for "%s" but got a notebook: %w`, transformer.configPath, target)
+			}
+			if target := (&ErrIsNotNotebook{}); errors.As(err, target) {
+				return fmt.Errorf(`expected a notebook for "%s" but got a file: %w`, transformer.configPath, target)
+			}
 			return err
 		}
 	}
@@ -179,36 +178,14 @@ func (m *translatePaths) translatePipelineLibrary(dir string, b *bundle.Bundle,
 func (m *translatePaths) Apply(_ context.Context, b *bundle.Bundle) error {
 	m.seen = make(map[string]string)
 
-	for key, job := range b.Config.Resources.Jobs {
-		dir, err := job.ConfigFileDirectory()
+	for _, fn := range []func(*translatePaths, *bundle.Bundle) error{
+		applyJobTransformers,
+		applyPipelineTransformers,
+		applyArtifactTransformers,
+	} {
+		err := fn(m, b)
 		if err != nil {
-			return fmt.Errorf("unable to determine directory for job %s: %w", key, err)
-		}
-
-		// Do not translate job task paths if using git source
-		if job.GitSource != nil {
-			continue
-		}
-
-		for i := 0; i < len(job.Tasks); i++ {
-			err := m.translateJobTask(dir, b, &job.Tasks[i])
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	for key, pipeline := range b.Config.Resources.Pipelines {
-		dir, err := pipeline.ConfigFileDirectory()
-		if err != nil {
-			return fmt.Errorf("unable to determine directory for pipeline %s: %w", key, err)
-		}
-
-		for i := 0; i < len(pipeline.Libraries); i++ {
-			err := m.translatePipelineLibrary(dir, b, &pipeline.Libraries[i])
-			if err != nil {
-				return err
-			}
+			return err
 		}
 	}
 
diff --git a/bundle/config/mutator/translate_paths_artifacts.go b/bundle/config/mutator/translate_paths_artifacts.go
new file mode 100644
index 000000000..91e8397cb
--- /dev/null
+++ b/bundle/config/mutator/translate_paths_artifacts.go
@@ -0,0 +1,42 @@
+package mutator
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config"
+)
+
+func transformArtifactPath(resource any, dir string) *transformer {
+	artifact, ok := resource.(*config.Artifact)
+	if !ok {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&artifact.Path,
+		"artifacts.path",
+		translateNoOp,
+	}
+}
+
+func applyArtifactTransformers(m *translatePaths, b *bundle.Bundle) error {
+	artifactTransformers := []transformFunc{
+		transformArtifactPath,
+	}
+
+	for key, artifact := range b.Config.Artifacts {
+		dir, err := artifact.ConfigFileDirectory()
+		if err != nil {
+			return fmt.Errorf("unable to determine directory for artifact %s: %w", key, err)
+		}
+
+		err = m.applyTransformers(artifactTransformers, b, artifact, dir)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/bundle/config/mutator/translate_paths_jobs.go b/bundle/config/mutator/translate_paths_jobs.go
new file mode 100644
index 000000000..b94df5e2e
--- /dev/null
+++ b/bundle/config/mutator/translate_paths_jobs.go
@@ -0,0 +1,103 @@
+package mutator
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/jobs"
+)
+
+func transformNotebookTask(resource any, dir string) *transformer {
+	task, ok := resource.(*jobs.Task)
+	if !ok || task.NotebookTask == nil {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&task.NotebookTask.NotebookPath,
+		"tasks.notebook_task.notebook_path",
+		translateNotebookPath,
+	}
+}
+
+func transformSparkTask(resource any, dir string) *transformer {
+	task, ok := resource.(*jobs.Task)
+	if !ok || task.SparkPythonTask == nil {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&task.SparkPythonTask.PythonFile,
+		"tasks.spark_python_task.python_file",
+		translateFilePath,
+	}
+}
+
+func transformWhlLibrary(resource any, dir string) *transformer {
+	library, ok := resource.(*compute.Library)
+	if !ok || library.Whl == "" {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&library.Whl,
+		"libraries.whl",
+		translateNoOp,
+	}
+}
+
+func transformJarLibrary(resource any, dir string) *transformer {
+	library, ok := resource.(*compute.Library)
+	if !ok || library.Jar == "" {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&library.Jar,
+		"libraries.jar",
+		translateFilePath,
+	}
+}
+
+func applyJobTransformers(m *translatePaths, b *bundle.Bundle) error {
+	jobTransformers := []transformFunc{
+		transformNotebookTask,
+		transformSparkTask,
+		transformWhlLibrary,
+		transformJarLibrary,
+	}
+
+	for key, job := range b.Config.Resources.Jobs {
+		dir, err := job.ConfigFileDirectory()
+		if err != nil {
+			return fmt.Errorf("unable to determine directory for job %s: %w", key, err)
+		}
+
+		// Do not translate job task paths if using git source
+		if job.GitSource != nil {
+			continue
+		}
+
+		for i := 0; i < len(job.Tasks); i++ {
+			task := &job.Tasks[i]
+			err := m.applyTransformers(jobTransformers, b, task, dir)
+			if err != nil {
+				return err
+			}
+			for j := 0; j < len(task.Libraries); j++ {
+				library := &task.Libraries[j]
+				err := m.applyTransformers(jobTransformers, b, library, dir)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/bundle/config/mutator/translate_paths_pipelines.go b/bundle/config/mutator/translate_paths_pipelines.go
new file mode 100644
index 000000000..1afdb9d51
--- /dev/null
+++ b/bundle/config/mutator/translate_paths_pipelines.go
@@ -0,0 +1,60 @@
+package mutator
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
+)
+
+func transformLibraryNotebook(resource any, dir string) *transformer {
+	library, ok := resource.(*pipelines.PipelineLibrary)
+	if !ok || library.Notebook == nil {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&library.Notebook.Path,
+		"libraries.notebook.path",
+		translateNotebookPath,
+	}
+}
+
+func transformLibraryFile(resource any, dir string) *transformer {
+	library, ok := resource.(*pipelines.PipelineLibrary)
+	if !ok || library.File == nil {
+		return nil
+	}
+
+	return &transformer{
+		dir,
+		&library.File.Path,
+		"libraries.file.path",
+		translateFilePath,
+	}
+}
+
+func applyPipelineTransformers(m *translatePaths, b *bundle.Bundle) error {
+	pipelineTransformers := []transformFunc{
+		transformLibraryNotebook,
+		transformLibraryFile,
+	}
+
+	for key, pipeline := range b.Config.Resources.Pipelines {
+		dir, err := pipeline.ConfigFileDirectory()
+		if err != nil {
+			return fmt.Errorf("unable to determine directory for pipeline %s: %w", key, err)
+		}
+
+		for i := 0; i < len(pipeline.Libraries); i++ {
+			library := &pipeline.Libraries[i]
+			err := m.applyTransformers(pipelineTransformers, b, library, dir)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/bundle/config/mutator/translate_paths_test.go b/bundle/config/mutator/translate_paths_test.go
index b87f4f676..e7ac5e8af 100644
--- a/bundle/config/mutator/translate_paths_test.go
+++ b/bundle/config/mutator/translate_paths_test.go
@@ -9,7 +9,9 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/pipelines"
 	"github.com/stretchr/testify/assert"
@@ -43,7 +45,7 @@ func TestTranslatePathsSkippedWithGitSource(t *testing.T) {
 				Jobs: map[string]*resources.Job{
 					"job": {
 
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -103,6 +105,7 @@ func TestTranslatePaths(t *testing.T) {
 	touchNotebookFile(t, filepath.Join(dir, "my_job_notebook.py"))
 	touchNotebookFile(t, filepath.Join(dir, "my_pipeline_notebook.py"))
 	touchEmptyFile(t, filepath.Join(dir, "my_python_file.py"))
+	touchEmptyFile(t, filepath.Join(dir, "dist", "task.jar"))
 
 	bundle := &bundle.Bundle{
 		Config: config.Root{
@@ -113,7 +116,7 @@ func TestTranslatePaths(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -122,6 +125,9 @@ func TestTranslatePaths(t *testing.T) {
 									NotebookTask: &jobs.NotebookTask{
 										NotebookPath: "./my_job_notebook.py",
 									},
+									Libraries: []compute.Library{
+										{Whl: "./dist/task.whl"},
+									},
 								},
 								{
 									NotebookTask: &jobs.NotebookTask{
@@ -143,13 +149,29 @@ func TestTranslatePaths(t *testing.T) {
 										PythonFile: "./my_python_file.py",
 									},
 								},
+								{
+									SparkJarTask: &jobs.SparkJarTask{
+										MainClassName: "HelloWorld",
+									},
+									Libraries: []compute.Library{
+										{Jar: "./dist/task.jar"},
+									},
+								},
+								{
+									SparkJarTask: &jobs.SparkJarTask{
+										MainClassName: "HelloWorldRemote",
+									},
+									Libraries: []compute.Library{
+										{Jar: "dbfs:///bundle/dist/task_remote.jar"},
+									},
+								},
 							},
 						},
 					},
 				},
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						PipelineSpec: &pipelines.PipelineSpec{
@@ -194,6 +216,11 @@ func TestTranslatePaths(t *testing.T) {
 		"/bundle/my_job_notebook",
 		bundle.Config.Resources.Jobs["job"].Tasks[0].NotebookTask.NotebookPath,
 	)
+	assert.Equal(
+		t,
+		filepath.Join("dist", "task.whl"),
+		bundle.Config.Resources.Jobs["job"].Tasks[0].Libraries[0].Whl,
+	)
 	assert.Equal(
 		t,
 		"/Users/jane.doe@databricks.com/doesnt_exist.py",
@@ -209,6 +236,16 @@ func TestTranslatePaths(t *testing.T) {
 		"/bundle/my_python_file.py",
 		bundle.Config.Resources.Jobs["job"].Tasks[4].SparkPythonTask.PythonFile,
 	)
+	assert.Equal(
+		t,
+		"/bundle/dist/task.jar",
+		bundle.Config.Resources.Jobs["job"].Tasks[5].Libraries[0].Jar,
+	)
+	assert.Equal(
+		t,
+		"dbfs:///bundle/dist/task_remote.jar",
+		bundle.Config.Resources.Jobs["job"].Tasks[6].Libraries[0].Jar,
+	)
 
 	// Assert that the path in the libraries now refer to the artifact.
 	assert.Equal(
@@ -236,6 +273,7 @@ func TestTranslatePaths(t *testing.T) {
 func TestTranslatePathsInSubdirectories(t *testing.T) {
 	dir := t.TempDir()
 	touchEmptyFile(t, filepath.Join(dir, "job", "my_python_file.py"))
+	touchEmptyFile(t, filepath.Join(dir, "job", "dist", "task.jar"))
 	touchEmptyFile(t, filepath.Join(dir, "pipeline", "my_python_file.py"))
 
 	bundle := &bundle.Bundle{
@@ -247,7 +285,7 @@ func TestTranslatePathsInSubdirectories(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "job/resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -257,13 +295,21 @@ func TestTranslatePathsInSubdirectories(t *testing.T) {
 										PythonFile: "./my_python_file.py",
 									},
 								},
+								{
+									SparkJarTask: &jobs.SparkJarTask{
+										MainClassName: "HelloWorld",
+									},
+									Libraries: []compute.Library{
+										{Jar: "./dist/task.jar"},
+									},
+								},
 							},
 						},
 					},
 				},
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "pipeline/resource.yml"),
 						},
 
@@ -290,6 +336,11 @@ func TestTranslatePathsInSubdirectories(t *testing.T) {
 		"/bundle/job/my_python_file.py",
 		bundle.Config.Resources.Jobs["job"].Tasks[0].SparkPythonTask.PythonFile,
 	)
+	assert.Equal(
+		t,
+		"/bundle/job/dist/task.jar",
+		bundle.Config.Resources.Jobs["job"].Tasks[1].Libraries[0].Jar,
+	)
 
 	assert.Equal(
 		t,
@@ -310,7 +361,7 @@ func TestTranslatePathsOutsideBundleRoot(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "../resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -341,7 +392,7 @@ func TestJobNotebookDoesNotExistError(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "fake.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -372,7 +423,7 @@ func TestJobFileDoesNotExistError(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "fake.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -403,7 +454,7 @@ func TestPipelineNotebookDoesNotExistError(t *testing.T) {
 			Resources: config.Resources{
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "fake.yml"),
 						},
 						PipelineSpec: &pipelines.PipelineSpec{
@@ -434,7 +485,7 @@ func TestPipelineFileDoesNotExistError(t *testing.T) {
 			Resources: config.Resources{
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "fake.yml"),
 						},
 						PipelineSpec: &pipelines.PipelineSpec{
@@ -469,7 +520,7 @@ func TestJobSparkPythonTaskWithNotebookSourceError(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -504,7 +555,7 @@ func TestJobNotebookTaskWithFileSourceError(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						JobSettings: &jobs.JobSettings{
@@ -539,7 +590,7 @@ func TestPipelineNotebookLibraryWithFileSourceError(t *testing.T) {
 			Resources: config.Resources{
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						PipelineSpec: &pipelines.PipelineSpec{
@@ -574,7 +625,7 @@ func TestPipelineFileLibraryWithNotebookSourceError(t *testing.T) {
 			Resources: config.Resources{
 				Pipelines: map[string]*resources.Pipeline{
 					"pipeline": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: filepath.Join(dir, "resource.yml"),
 						},
 						PipelineSpec: &pipelines.PipelineSpec{
diff --git a/bundle/config/resources/pkg.go b/bundle/config/paths/paths.go
similarity index 95%
rename from bundle/config/resources/pkg.go
rename to bundle/config/paths/paths.go
index 5cf54a06b..c2cbcb7dd 100644
--- a/bundle/config/resources/pkg.go
+++ b/bundle/config/paths/paths.go
@@ -1,4 +1,4 @@
-package resources
+package paths
 
 import (
 	"fmt"
diff --git a/bundle/config/resources/job.go b/bundle/config/resources/job.go
index 6200062a8..66705afb2 100644
--- a/bundle/config/resources/job.go
+++ b/bundle/config/resources/job.go
@@ -1,6 +1,7 @@
 package resources
 
 import (
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/imdario/mergo"
 )
@@ -9,7 +10,7 @@ type Job struct {
 	ID          string       `json:"id,omitempty" bundle:"readonly"`
 	Permissions []Permission `json:"permissions,omitempty"`
 
-	Paths
+	paths.Paths
 
 	*jobs.JobSettings
 }
diff --git a/bundle/config/resources/mlflow_experiment.go b/bundle/config/resources/mlflow_experiment.go
index ebef039a8..d843cf226 100644
--- a/bundle/config/resources/mlflow_experiment.go
+++ b/bundle/config/resources/mlflow_experiment.go
@@ -1,11 +1,14 @@
 package resources
 
-import "github.com/databricks/databricks-sdk-go/service/ml"
+import (
+	"github.com/databricks/cli/bundle/config/paths"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
 
 type MlflowExperiment struct {
 	Permissions []Permission `json:"permissions,omitempty"`
 
-	Paths
+	paths.Paths
 
 	*ml.Experiment
 }
diff --git a/bundle/config/resources/mlflow_model.go b/bundle/config/resources/mlflow_model.go
index 31c72f6b0..92617c95a 100644
--- a/bundle/config/resources/mlflow_model.go
+++ b/bundle/config/resources/mlflow_model.go
@@ -1,11 +1,14 @@
 package resources
 
-import "github.com/databricks/databricks-sdk-go/service/ml"
+import (
+	"github.com/databricks/cli/bundle/config/paths"
+	"github.com/databricks/databricks-sdk-go/service/ml"
+)
 
 type MlflowModel struct {
 	Permissions []Permission `json:"permissions,omitempty"`
 
-	Paths
+	paths.Paths
 
 	*ml.Model
 }
diff --git a/bundle/config/resources/pipeline.go b/bundle/config/resources/pipeline.go
index 96efc2c4f..d3a51c575 100644
--- a/bundle/config/resources/pipeline.go
+++ b/bundle/config/resources/pipeline.go
@@ -1,12 +1,15 @@
 package resources
 
-import "github.com/databricks/databricks-sdk-go/service/pipelines"
+import (
+	"github.com/databricks/cli/bundle/config/paths"
+	"github.com/databricks/databricks-sdk-go/service/pipelines"
+)
 
 type Pipeline struct {
 	ID          string       `json:"id,omitempty" bundle:"readonly"`
 	Permissions []Permission `json:"permissions,omitempty"`
 
-	Paths
+	paths.Paths
 
 	*pipelines.PipelineSpec
 }
diff --git a/bundle/config/resources_test.go b/bundle/config/resources_test.go
index 63285bf94..82cb9f454 100644
--- a/bundle/config/resources_test.go
+++ b/bundle/config/resources_test.go
@@ -3,6 +3,7 @@ package config
 import (
 	"testing"
 
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/stretchr/testify/assert"
 )
@@ -11,21 +12,21 @@ func TestVerifyUniqueResourceIdentifiers(t *testing.T) {
 	r := Resources{
 		Jobs: map[string]*resources.Job{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo.yml",
 				},
 			},
 		},
 		Models: map[string]*resources.MlflowModel{
 			"bar": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "bar.yml",
 				},
 			},
 		},
 		Experiments: map[string]*resources.MlflowExperiment{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo2.yml",
 				},
 			},
@@ -39,14 +40,14 @@ func TestVerifySafeMerge(t *testing.T) {
 	r := Resources{
 		Jobs: map[string]*resources.Job{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo.yml",
 				},
 			},
 		},
 		Models: map[string]*resources.MlflowModel{
 			"bar": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "bar.yml",
 				},
 			},
@@ -55,7 +56,7 @@ func TestVerifySafeMerge(t *testing.T) {
 	other := Resources{
 		Pipelines: map[string]*resources.Pipeline{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo2.yml",
 				},
 			},
@@ -69,14 +70,14 @@ func TestVerifySafeMergeForSameResourceType(t *testing.T) {
 	r := Resources{
 		Jobs: map[string]*resources.Job{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo.yml",
 				},
 			},
 		},
 		Models: map[string]*resources.MlflowModel{
 			"bar": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "bar.yml",
 				},
 			},
@@ -85,7 +86,7 @@ func TestVerifySafeMergeForSameResourceType(t *testing.T) {
 	other := Resources{
 		Jobs: map[string]*resources.Job{
 			"foo": {
-				Paths: resources.Paths{
+				Paths: paths.Paths{
 					ConfigFilePath: "foo2.yml",
 				},
 			},
diff --git a/bundle/config/root.go b/bundle/config/root.go
index 1275dab48..99ea33ad6 100644
--- a/bundle/config/root.go
+++ b/bundle/config/root.go
@@ -64,7 +64,7 @@ type Root struct {
 	Workspace Workspace `json:"workspace,omitempty"`
 
 	// Artifacts contains a description of all code artifacts in this bundle.
-	Artifacts map[string]*Artifact `json:"artifacts,omitempty"`
+	Artifacts Artifacts `json:"artifacts,omitempty"`
 
 	// Resources contains a description of all Databricks resources
 	// to deploy in this bundle (e.g. jobs, pipelines, etc.).
@@ -113,6 +113,10 @@ func Load(path string) (*Root, error) {
 // was loaded from in configuration leafs that require it.
 func (r *Root) SetConfigFilePath(path string) {
 	r.Resources.SetConfigFilePath(path)
+	if r.Artifacts != nil {
+		r.Artifacts.SetConfigFilePath(path)
+	}
+
 	if r.Targets != nil {
 		for _, env := range r.Targets {
 			if env == nil {
@@ -121,6 +125,9 @@ func (r *Root) SetConfigFilePath(path string) {
 			if env.Resources != nil {
 				env.Resources.SetConfigFilePath(path)
 			}
+			if env.Artifacts != nil {
+				env.Artifacts.SetConfigFilePath(path)
+			}
 		}
 	}
 }
@@ -175,11 +182,17 @@ func (r *Root) Load(path string) error {
 }
 
 func (r *Root) Merge(other *Root) error {
+	err := r.Sync.Merge(r, other)
+	if err != nil {
+		return err
+	}
+	other.Sync = Sync{}
+
 	// TODO: when hooking into merge semantics, disallow setting path on the target instance.
 	other.Path = ""
 
 	// Check for safe merge, protecting against duplicate resource identifiers
-	err := r.Resources.VerifySafeMerge(&other.Resources)
+	err = r.Resources.VerifySafeMerge(&other.Resources)
 	if err != nil {
 		return err
 	}
diff --git a/bundle/config/sync.go b/bundle/config/sync.go
index 0580e4c4f..6ba2603c4 100644
--- a/bundle/config/sync.go
+++ b/bundle/config/sync.go
@@ -1,5 +1,7 @@
 package config
 
+import "path/filepath"
+
 type Sync struct {
 	// Include contains a list of globs evaluated relative to the bundle root path
 	// to explicitly include files that were excluded by the user's gitignore.
@@ -11,3 +13,19 @@ type Sync struct {
 	// 2) the `Include` field above.
 	Exclude []string `json:"exclude,omitempty"`
 }
+
+func (s *Sync) Merge(root *Root, other *Root) error {
+	path, err := filepath.Rel(root.Path, other.Path)
+	if err != nil {
+		return err
+	}
+	for _, include := range other.Sync.Include {
+		s.Include = append(s.Include, filepath.Join(path, include))
+	}
+
+	for _, exclude := range other.Sync.Exclude {
+		s.Exclude = append(s.Exclude, filepath.Join(path, exclude))
+	}
+
+	return nil
+}
diff --git a/bundle/config/target.go b/bundle/config/target.go
index 6a45fdb85..2489efc33 100644
--- a/bundle/config/target.go
+++ b/bundle/config/target.go
@@ -23,7 +23,7 @@ type Target struct {
 
 	Workspace *Workspace `json:"workspace,omitempty"`
 
-	Artifacts map[string]*Artifact `json:"artifacts,omitempty"`
+	Artifacts Artifacts `json:"artifacts,omitempty"`
 
 	Resources *Resources `json:"resources,omitempty"`
 
diff --git a/bundle/python/wheel_task_wrappers.go b/bundle/python/wheel_task_wrappers.go
index 27c790665..c70a01122 100644
--- a/bundle/python/wheel_task_wrappers.go
+++ b/bundle/python/wheel_task_wrappers.go
@@ -16,6 +16,8 @@ const NOTEBOOK_TEMPLATE = `# Databricks notebook source
 %pip install --force-reinstall {{.Whl}}
 {{end}}
 
+dbutils.library.restartPython()
+
 try:
 	from importlib import metadata
 except ImportError: # for Python<3.8
diff --git a/bundle/python/wheel_task_wrappers_test.go b/bundle/python/wheel_task_wrappers_test.go
index fb2c23e42..a9f57db8e 100644
--- a/bundle/python/wheel_task_wrappers_test.go
+++ b/bundle/python/wheel_task_wrappers_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/config/paths"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/stretchr/testify/require"
@@ -112,7 +113,7 @@ func TestNoPanicWithNoPythonWheelTasks(t *testing.T) {
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"test": {
-						Paths: resources.Paths{
+						Paths: paths.Paths{
 							ConfigFilePath: tmpDir,
 						},
 						JobSettings: &jobs.JobSettings{
diff --git a/bundle/tests/relative_path_with_includes/bundle.yml b/bundle/tests/relative_path_with_includes/bundle.yml
new file mode 100644
index 000000000..36474c754
--- /dev/null
+++ b/bundle/tests/relative_path_with_includes/bundle.yml
@@ -0,0 +1,25 @@
+bundle:
+  name: sync_include
+
+include:
+  - "*/*.yml"
+
+sync:
+  include:
+    - ./folder_a/*.*
+  exclude:
+    - ./folder_b/*.*
+
+artifacts:
+  test_a:
+    type: whl
+    path: ./artifact_a
+
+resources:
+  jobs:
+    job_a:
+      name: "job_a"
+      tasks:
+        - task_key: "task_a"
+          libraries:
+            - whl: ./dist/job_a.whl
diff --git a/bundle/tests/relative_path_with_includes/subfolder/include.yml b/bundle/tests/relative_path_with_includes/subfolder/include.yml
new file mode 100644
index 000000000..597abe3bf
--- /dev/null
+++ b/bundle/tests/relative_path_with_includes/subfolder/include.yml
@@ -0,0 +1,20 @@
+sync:
+  include:
+    - ./folder_c/*.*
+  exclude:
+    - ./folder_d/*.*
+
+artifacts:
+  test_b:
+    type: whl
+    path: ./artifact_b
+
+
+resources:
+  jobs:
+    job_b:
+      name: "job_b"
+      tasks:
+        - task_key: "task_a"
+          libraries:
+            - whl: ./dist/job_b.whl
diff --git a/bundle/tests/relative_path_with_includes_test.go b/bundle/tests/relative_path_with_includes_test.go
new file mode 100644
index 000000000..92249c412
--- /dev/null
+++ b/bundle/tests/relative_path_with_includes_test.go
@@ -0,0 +1,28 @@
+package config_tests
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/bundle/config/mutator"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRelativePathsWithIncludes(t *testing.T) {
+	b := load(t, "./relative_path_with_includes")
+
+	m := mutator.TranslatePaths()
+	err := bundle.Apply(context.Background(), b, m)
+	assert.NoError(t, err)
+
+	assert.Equal(t, "artifact_a", b.Config.Artifacts["test_a"].Path)
+	assert.Equal(t, filepath.Join("subfolder", "artifact_b"), b.Config.Artifacts["test_b"].Path)
+
+	assert.ElementsMatch(t, []string{"./folder_a/*.*", filepath.Join("subfolder", "folder_c", "*.*")}, b.Config.Sync.Include)
+	assert.ElementsMatch(t, []string{"./folder_b/*.*", filepath.Join("subfolder", "folder_d", "*.*")}, b.Config.Sync.Exclude)
+
+	assert.Equal(t, filepath.Join("dist", "job_a.whl"), b.Config.Resources.Jobs["job_a"].Tasks[0].Libraries[0].Whl)
+	assert.Equal(t, filepath.Join("subfolder", "dist", "job_b.whl"), b.Config.Resources.Jobs["job_b"].Tasks[0].Libraries[0].Whl)
+}
diff --git a/cmd/account/custom-app-integration/custom-app-integration.go b/cmd/account/custom-app-integration/custom-app-integration.go
index d7269bf47..e58688095 100755
--- a/cmd/account/custom-app-integration/custom-app-integration.go
+++ b/cmd/account/custom-app-integration/custom-app-integration.go
@@ -60,6 +60,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().BoolVar(&createReq.Confidential, "confidential", createReq.Confidential, `indicates if an oauth client-secret should be generated.`)
+	// TODO: array: scopes
 	// TODO: complex arg: token_access_policy
 
 	cmd.Use = "create"
diff --git a/cmd/account/groups/groups.go b/cmd/account/groups/groups.go
index 04298b49c..6e3b98c00 100755
--- a/cmd/account/groups/groups.go
+++ b/cmd/account/groups/groups.go
@@ -368,7 +368,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update group details.`
diff --git a/cmd/account/log-delivery/log-delivery.go b/cmd/account/log-delivery/log-delivery.go
index a7ed39dca..6323e0ddd 100755
--- a/cmd/account/log-delivery/log-delivery.go
+++ b/cmd/account/log-delivery/log-delivery.go
@@ -34,22 +34,21 @@ func New() *cobra.Command {
   
   1. **Create storage**: In AWS, [create a new AWS S3 bucket] with a specific
   bucket policy. Using Databricks APIs, call the Account API to create a
-  [storage configuration object](#operation/create-storage-config) that uses the
-  bucket name. 2. **Create credentials**: In AWS, create the appropriate AWS IAM
-  role. For full details, including the required IAM role policies and trust
+  [storage configuration object](:method:Storage/Create) that uses the bucket
+  name. 2. **Create credentials**: In AWS, create the appropriate AWS IAM role.
+  For full details, including the required IAM role policies and trust
   relationship, see [Billable usage log delivery]. Using Databricks APIs, call
   the Account API to create a [credential configuration
-  object](#operation/create-credential-config) that uses the IAM role's ARN. 3.
-  **Create log delivery configuration**: Using Databricks APIs, call the Account
-  API to [create a log delivery
-  configuration](#operation/create-log-delivery-config) that uses the credential
-  and storage configuration objects from previous steps. You can specify if the
-  logs should include all events of that log type in your account (_Account
-  level_ delivery) or only events for a specific set of workspaces (_workspace
-  level_ delivery). Account level log delivery applies to all current and future
-  workspaces plus account level logs, while workspace level log delivery solely
-  delivers logs related to the specified workspaces. You can create multiple
-  types of delivery configurations per account.
+  object](:method:Credentials/Create) that uses the IAM role"s ARN. 3. **Create
+  log delivery configuration**: Using Databricks APIs, call the Account API to
+  [create a log delivery configuration](:method:LogDelivery/Create) that uses
+  the credential and storage configuration objects from previous steps. You can
+  specify if the logs should include all events of that log type in your account
+  (_Account level_ delivery) or only events for a specific set of workspaces
+  (_workspace level_ delivery). Account level log delivery applies to all
+  current and future workspaces plus account level logs, while workspace level
+  log delivery solely delivers logs related to the specified workspaces. You can
+  create multiple types of delivery configurations per account.
   
   For billable usage delivery: * For more information about billable usage logs,
   see [Billable usage log delivery]. For the CSV schema, see the [Usage page]. *
@@ -120,10 +119,9 @@ func newCreate() *cobra.Command {
   
   Creates a new Databricks log delivery configuration to enable delivery of the
   specified type of logs to your storage location. This requires that you
-  already created a [credential object](#operation/create-credential-config)
-  (which encapsulates a cross-account service IAM role) and a [storage
-  configuration object](#operation/create-storage-config) (which encapsulates an
-  S3 bucket).
+  already created a [credential object](:method:Credentials/Create) (which
+  encapsulates a cross-account service IAM role) and a [storage configuration
+  object](:method:Storage/Create) (which encapsulates an S3 bucket).
   
   For full details, including the required IAM role policies and bucket
   policies, see [Deliver and access billable usage logs] or [Configure audit
@@ -140,7 +138,7 @@ func newCreate() *cobra.Command {
   
   You cannot delete a log delivery configuration, but you can disable it (see
   [Enable or disable log delivery
-  configuration](#operation/patch-log-delivery-config-status)).
+  configuration](:method:LogDelivery/PatchStatus)).
   
   [Configure audit logging]: https://docs.databricks.com/administration-guide/account-settings/audit-logs.html
   [Deliver and access billable usage logs]: https://docs.databricks.com/administration-guide/account-settings/billable-usage-delivery.html`
@@ -368,7 +366,7 @@ func newPatchStatus() *cobra.Command {
   configurations is not supported, so disable log delivery configurations that
   are no longer needed. Note that you can't re-enable a delivery configuration
   if this would violate the delivery configuration limits described under
-  [Create log delivery](#operation/create-log-delivery-config).`
+  [Create log delivery](:method:LogDelivery/Create).`
 
 	cmd.Annotations = make(map[string]string)
 
diff --git a/cmd/account/metastores/metastores.go b/cmd/account/metastores/metastores.go
index 185f3642b..726b779d8 100755
--- a/cmd/account/metastores/metastores.go
+++ b/cmd/account/metastores/metastores.go
@@ -255,7 +255,7 @@ func newList() *cobra.Command {
 	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
 		ctx := cmd.Context()
 		a := root.AccountClient(ctx)
-		response, err := a.Metastores.List(ctx)
+		response, err := a.Metastores.ListAll(ctx)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/account/service-principals/service-principals.go b/cmd/account/service-principals/service-principals.go
index 481af9789..f5823c692 100755
--- a/cmd/account/service-principals/service-principals.go
+++ b/cmd/account/service-principals/service-principals.go
@@ -367,7 +367,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update service principal details.`
diff --git a/cmd/account/users/users.go b/cmd/account/users/users.go
index 7e84f90f7..375dd5b5b 100755
--- a/cmd/account/users/users.go
+++ b/cmd/account/users/users.go
@@ -375,7 +375,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update user details.`
diff --git a/cmd/account/workspaces/workspaces.go b/cmd/account/workspaces/workspaces.go
index 96ac33b69..60142a8a0 100755
--- a/cmd/account/workspaces/workspaces.go
+++ b/cmd/account/workspaces/workspaces.go
@@ -70,7 +70,10 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.Cloud, "cloud", createReq.Cloud, `The cloud provider which the workspace uses.`)
 	// TODO: complex arg: cloud_resource_container
 	cmd.Flags().StringVar(&createReq.CredentialsId, "credentials-id", createReq.CredentialsId, `ID of the workspace's credential configuration object.`)
+	// TODO: map via StringToStringVar: custom_tags
 	cmd.Flags().StringVar(&createReq.DeploymentName, "deployment-name", createReq.DeploymentName, `The deployment name defines part of the subdomain for the workspace.`)
+	// TODO: complex arg: gcp_managed_network_config
+	// TODO: complex arg: gke_config
 	cmd.Flags().StringVar(&createReq.Location, "location", createReq.Location, `The Google Cloud region of the workspace data plane in your Google account.`)
 	cmd.Flags().StringVar(&createReq.ManagedServicesCustomerManagedKeyId, "managed-services-customer-managed-key-id", createReq.ManagedServicesCustomerManagedKeyId, `The ID of the workspace's managed services encryption key configuration object.`)
 	cmd.Flags().StringVar(&createReq.NetworkId, "network-id", createReq.NetworkId, ``)
@@ -391,6 +394,7 @@ func newUpdate() *cobra.Command {
 	cmd := &cobra.Command{}
 
 	var updateReq provisioning.UpdateWorkspaceRequest
+	var updateJson flags.JsonFlag
 
 	var updateSkipWait bool
 	var updateTimeout time.Duration
@@ -398,9 +402,11 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().BoolVar(&updateSkipWait, "no-wait", updateSkipWait, `do not wait to reach RUNNING state`)
 	cmd.Flags().DurationVar(&updateTimeout, "timeout", 20*time.Minute, `maximum amount of time to reach RUNNING state`)
 	// TODO: short flags
+	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	cmd.Flags().StringVar(&updateReq.AwsRegion, "aws-region", updateReq.AwsRegion, `The AWS region of the workspace's data plane (for example, us-west-2).`)
 	cmd.Flags().StringVar(&updateReq.CredentialsId, "credentials-id", updateReq.CredentialsId, `ID of the workspace's credential configuration object.`)
+	// TODO: map via StringToStringVar: custom_tags
 	cmd.Flags().StringVar(&updateReq.ManagedServicesCustomerManagedKeyId, "managed-services-customer-managed-key-id", updateReq.ManagedServicesCustomerManagedKeyId, `The ID of the workspace's managed services encryption key configuration object.`)
 	cmd.Flags().StringVar(&updateReq.NetworkId, "network-id", updateReq.NetworkId, `The ID of the workspace's network configuration object.`)
 	cmd.Flags().StringVar(&updateReq.StorageConfigurationId, "storage-configuration-id", updateReq.StorageConfigurationId, `The ID of the workspace's storage configuration object.`)
@@ -435,7 +441,8 @@ func newUpdate() *cobra.Command {
   support. You can add or update the private access settings ID to upgrade a
   workspace to add support for front-end, back-end, or both types of
   connectivity. You cannot remove (downgrade) any existing front-end or back-end
-  PrivateLink support on a workspace.
+  PrivateLink support on a workspace. - Custom tags. Given you provide an empty
+  custom tags, the update would not be applied.
   
   After calling the PATCH operation to update the workspace configuration,
   make repeated GET requests with the workspace ID and check the workspace
@@ -473,7 +480,8 @@ func newUpdate() *cobra.Command {
   PrivateLink support. You can add or update the private access settings ID to
   upgrade a workspace to add support for front-end, back-end, or both types of
   connectivity. You cannot remove (downgrade) any existing front-end or back-end
-  PrivateLink support on a workspace.
+  PrivateLink support on a workspace. - Custom tags. Given you provide an empty
+  custom tags, the update would not be applied.
   
   **Important**: To update a running workspace, your workspace must have no
   running compute resources that run in your workspace's VPC in the Classic data
@@ -529,6 +537,12 @@ func newUpdate() *cobra.Command {
 		ctx := cmd.Context()
 		a := root.AccountClient(ctx)
 
+		if cmd.Flags().Changed("json") {
+			err = updateJson.Unmarshal(&updateReq)
+			if err != nil {
+				return err
+			}
+		}
 		if len(args) == 0 {
 			promptSpinner := cmdio.Spinner(ctx)
 			promptSpinner <- "No WORKSPACE_ID argument specified. Loading names for Workspaces drop-down."
diff --git a/cmd/api/api.go b/cmd/api/api.go
index 698781e63..11a5e3e36 100644
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -60,7 +60,8 @@ func makeCommand(method string) *cobra.Command {
 			}
 
 			var response any
-			err = api.Do(cmd.Context(), method, path, request, &response)
+			headers := map[string]string{"Content-Type": "application/json"}
+			err = api.Do(cmd.Context(), method, path, headers, request, &response)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/bundle/init.go b/cmd/bundle/init.go
index 2127a7bc4..9a11eb257 100644
--- a/cmd/bundle/init.go
+++ b/cmd/bundle/init.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/git"
 	"github.com/databricks/cli/libs/template"
 	"github.com/spf13/cobra"
@@ -57,9 +58,6 @@ func newInitCommand() *cobra.Command {
 		if len(args) > 0 {
 			templatePath = args[0]
 		} else {
-			return errors.New("please specify a template")
-
-			/* TODO: propose to use default-python (once template is ready)
 			var err error
 			if !cmdio.IsOutTTY(ctx) || !cmdio.IsInTTY(ctx) {
 				return errors.New("please specify a template")
@@ -68,7 +66,6 @@ func newInitCommand() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			*/
 		}
 
 		if !isRepoUrl(templatePath) {
diff --git a/cmd/cmd.go b/cmd/cmd.go
index 04d7cc804..032fde5cd 100644
--- a/cmd/cmd.go
+++ b/cmd/cmd.go
@@ -1,6 +1,8 @@
 package cmd
 
 import (
+	"strings"
+
 	"github.com/databricks/cli/cmd/account"
 	"github.com/databricks/cli/cmd/api"
 	"github.com/databricks/cli/cmd/auth"
@@ -14,6 +16,11 @@ import (
 	"github.com/spf13/cobra"
 )
 
+const (
+	mainGroup        = "main"
+	permissionsGroup = "permissions"
+)
+
 func New() *cobra.Command {
 	cli := root.New()
 
@@ -22,6 +29,31 @@ func New() *cobra.Command {
 
 	// Add workspace subcommands.
 	for _, cmd := range workspace.All() {
+		// Built-in groups for the workspace commands.
+		groups := []cobra.Group{
+			{
+				ID:    mainGroup,
+				Title: "Available Commands",
+			},
+			{
+				ID:    permissionsGroup,
+				Title: "Permission Commands",
+			},
+		}
+		for i := range groups {
+			cmd.AddGroup(&groups[i])
+		}
+
+		// Order the permissions subcommands after the main commands.
+		for _, sub := range cmd.Commands() {
+			switch {
+			case strings.HasSuffix(sub.Name(), "-permissions"), strings.HasSuffix(sub.Name(), "-permission-levels"):
+				sub.GroupID = permissionsGroup
+			default:
+				sub.GroupID = mainGroup
+			}
+		}
+
 		cli.AddCommand(cmd)
 	}
 
diff --git a/cmd/root/auth.go b/cmd/root/auth.go
index e56074ef4..d4c9a31b9 100644
--- a/cmd/root/auth.go
+++ b/cmd/root/auth.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 
 	"github.com/databricks/cli/bundle"
@@ -11,7 +12,6 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
-	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/manifoldco/promptui"
 	"github.com/spf13/cobra"
 )
@@ -19,7 +19,6 @@ import (
 // Placeholders to use as unique keys in context.Context.
 var workspaceClient int
 var accountClient int
-var currentUser int
 
 func initProfileFlag(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringP("profile", "p", "", "~/.databrickscfg profile")
@@ -94,8 +93,7 @@ TRY_AUTH: // or try picking a config profile dynamically
 	if err != nil {
 		return err
 	}
-	// get current user identity also to verify validity of configuration
-	me, err := w.CurrentUser.Me(ctx)
+	err = w.Config.Authenticate(emptyHttpRequest(ctx))
 	if cmdio.IsInteractive(ctx) && errors.Is(err, config.ErrCannotConfigureAuth) {
 		profile, err := askForWorkspaceProfile()
 		if err != nil {
@@ -107,7 +105,6 @@ TRY_AUTH: // or try picking a config profile dynamically
 	if err != nil {
 		return err
 	}
-	ctx = context.WithValue(ctx, &currentUser, me)
 	ctx = context.WithValue(ctx, &workspaceClient, w)
 	cmd.SetContext(ctx)
 	return nil
@@ -194,6 +191,17 @@ func askForAccountProfile() (string, error) {
 	return profiles[i].Name, nil
 }
 
+// To verify that a client is configured correctly, we pass an empty HTTP request
+// to a client's `config.Authenticate` function. Note: this functionality
+// should be supported by the SDK itself.
+func emptyHttpRequest(ctx context.Context) *http.Request {
+	req, err := http.NewRequestWithContext(ctx, "", "", nil)
+	if err != nil {
+		panic(err)
+	}
+	return req
+}
+
 func WorkspaceClient(ctx context.Context) *databricks.WorkspaceClient {
 	w, ok := ctx.Value(&workspaceClient).(*databricks.WorkspaceClient)
 	if !ok {
@@ -209,11 +217,3 @@ func AccountClient(ctx context.Context) *databricks.AccountClient {
 	}
 	return a
 }
-
-func Me(ctx context.Context) *iam.User {
-	me, ok := ctx.Value(&currentUser).(*iam.User)
-	if !ok {
-		panic("cannot get current user. Please report it as a bug")
-	}
-	return me
-}
diff --git a/cmd/root/auth_test.go b/cmd/root/auth_test.go
new file mode 100644
index 000000000..75d255b58
--- /dev/null
+++ b/cmd/root/auth_test.go
@@ -0,0 +1,14 @@
+package root
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEmptyHttpRequest(t *testing.T) {
+	ctx, _ := context.WithCancel(context.Background())
+	req := emptyHttpRequest(ctx)
+	assert.Equal(t, req.Context(), ctx)
+}
diff --git a/cmd/workspace/artifact-allowlists/artifact-allowlists.go b/cmd/workspace/artifact-allowlists/artifact-allowlists.go
new file mode 100755
index 000000000..9f9b9be1c
--- /dev/null
+++ b/cmd/workspace/artifact-allowlists/artifact-allowlists.go
@@ -0,0 +1,172 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package artifact_allowlists
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "artifact-allowlists",
+		Short: `In Databricks Runtime 13.3 and above, you can add libraries and init scripts to the allowlist in UC so that users can leverage these artifacts on compute configured with shared access mode.`,
+		Long: `In Databricks Runtime 13.3 and above, you can add libraries and init scripts
+  to the allowlist in UC so that users can leverage these artifacts on compute
+  configured with shared access mode.`,
+		GroupID: "catalog",
+		Annotations: map[string]string{
+			"package": "catalog",
+		},
+	}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start get command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getOverrides []func(
+	*cobra.Command,
+	*catalog.GetArtifactAllowlistRequest,
+)
+
+func newGet() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getReq catalog.GetArtifactAllowlistRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get ARTIFACT_TYPE"
+	cmd.Short = `Get an artifact allowlist.`
+	cmd.Long = `Get an artifact allowlist.
+  
+  Get the artifact allowlist of a certain artifact type. The caller must be a
+  metastore admin.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		_, err = fmt.Sscan(args[0], &getReq.ArtifactType)
+		if err != nil {
+			return fmt.Errorf("invalid ARTIFACT_TYPE: %s", args[0])
+		}
+
+		response, err := w.ArtifactAllowlists.Get(ctx, getReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getOverrides {
+		fn(cmd, &getReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGet())
+	})
+}
+
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*catalog.SetArtifactAllowlist,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq catalog.SetArtifactAllowlist
+	var updateJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update"
+	cmd.Short = `Set an artifact allowlist.`
+	cmd.Long = `Set an artifact allowlist.
+  
+  Set the artifact allowlist of a certain artifact type. The whole artifact
+  allowlist is replaced with the new allowlist. The caller must be a metastore
+  admin.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updateJson.Unmarshal(&updateReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.ArtifactAllowlists.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdate())
+	})
+}
+
+// end service ArtifactAllowlists
diff --git a/cmd/workspace/catalogs/catalogs.go b/cmd/workspace/catalogs/catalogs.go
index c17f6c22e..5e06977c4 100755
--- a/cmd/workspace/catalogs/catalogs.go
+++ b/cmd/workspace/catalogs/catalogs.go
@@ -60,6 +60,7 @@ func newCreate() *cobra.Command {
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
 	cmd.Flags().StringVar(&createReq.ConnectionName, "connection-name", createReq.ConnectionName, `The name of the connection to an external data source.`)
+	// TODO: map via StringToStringVar: options
 	// TODO: map via StringToStringVar: properties
 	cmd.Flags().StringVar(&createReq.ProviderName, "provider-name", createReq.ProviderName, `The name of delta sharing provider.`)
 	cmd.Flags().StringVar(&createReq.ShareName, "share-name", createReq.ShareName, `The name of the share under the share provider.`)
@@ -321,6 +322,7 @@ func newUpdate() *cobra.Command {
 	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `User-provided free-form text description.`)
 	cmd.Flags().Var(&updateReq.IsolationMode, "isolation-mode", `Whether the current securable is accessible from all workspaces or a specific set of workspaces.`)
 	cmd.Flags().StringVar(&updateReq.Name, "name", updateReq.Name, `Name of catalog.`)
+	// TODO: map via StringToStringVar: options
 	cmd.Flags().StringVar(&updateReq.Owner, "owner", updateReq.Owner, `Username of current owner of catalog.`)
 	// TODO: map via StringToStringVar: properties
 
diff --git a/cmd/workspace/cluster-policies/cluster-policies.go b/cmd/workspace/cluster-policies/cluster-policies.go
index 74a092cdb..0e3091945 100755
--- a/cmd/workspace/cluster-policies/cluster-policies.go
+++ b/cmd/workspace/cluster-policies/cluster-policies.go
@@ -318,8 +318,8 @@ func newGet() *cobra.Command {
 	// TODO: short flags
 
 	cmd.Use = "get POLICY_ID"
-	cmd.Short = `Get entity.`
-	cmd.Long = `Get entity.
+	cmd.Short = `Get a cluster policy.`
+	cmd.Long = `Get a cluster policy.
   
   Get a cluster policy entity. Creation and editing is available to admins only.`
 
@@ -374,6 +374,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*compute.GetClusterPolicyPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq compute.GetClusterPolicyPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels CLUSTER_POLICY_ID"
+	cmd.Short = `Get cluster policy permission levels.`
+	cmd.Long = `Get cluster policy permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_POLICY_ID argument specified. Loading names for Cluster Policies drop-down."
+			names, err := w.ClusterPolicies.PolicyNameToPolicyIdMap(ctx, compute.ListClusterPoliciesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Cluster Policies drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster policy for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.ClusterPolicyId = args[0]
+
+		response, err := w.ClusterPolicies.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.GetClusterPolicyPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq compute.GetClusterPolicyPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions CLUSTER_POLICY_ID"
+	cmd.Short = `Get cluster policy permissions.`
+	cmd.Long = `Get cluster policy permissions.
+  
+  Gets the permissions of a cluster policy. Cluster policies can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_POLICY_ID argument specified. Loading names for Cluster Policies drop-down."
+			names, err := w.ClusterPolicies.PolicyNameToPolicyIdMap(ctx, compute.ListClusterPoliciesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Cluster Policies drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster policy for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+		}
+		getPermissionsReq.ClusterPolicyId = args[0]
+
+		response, err := w.ClusterPolicies.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -396,8 +543,8 @@ func newList() *cobra.Command {
 	cmd.Flags().Var(&listReq.SortOrder, "sort-order", `The order in which the policies get listed.`)
 
 	cmd.Use = "list"
-	cmd.Short = `Get a cluster policy.`
-	cmd.Long = `Get a cluster policy.
+	cmd.Short = `List cluster policies.`
+	cmd.Long = `List cluster policies.
   
   Returns a list of policies accessible by the requesting user.`
 
@@ -449,4 +596,172 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.ClusterPolicyPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq compute.ClusterPolicyPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions CLUSTER_POLICY_ID"
+	cmd.Short = `Set cluster policy permissions.`
+	cmd.Long = `Set cluster policy permissions.
+  
+  Sets permissions on a cluster policy. Cluster policies can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_POLICY_ID argument specified. Loading names for Cluster Policies drop-down."
+			names, err := w.ClusterPolicies.PolicyNameToPolicyIdMap(ctx, compute.ListClusterPoliciesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Cluster Policies drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster policy for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+		}
+		setPermissionsReq.ClusterPolicyId = args[0]
+
+		response, err := w.ClusterPolicies.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*compute.ClusterPolicyPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq compute.ClusterPolicyPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions CLUSTER_POLICY_ID"
+	cmd.Short = `Update cluster policy permissions.`
+	cmd.Long = `Update cluster policy permissions.
+  
+  Updates the permissions on a cluster policy. Cluster policies can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_POLICY_ID argument specified. Loading names for Cluster Policies drop-down."
+			names, err := w.ClusterPolicies.PolicyNameToPolicyIdMap(ctx, compute.ListClusterPoliciesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Cluster Policies drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster policy for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster policy for which to get or manage permissions")
+		}
+		updatePermissionsReq.ClusterPolicyId = args[0]
+
+		response, err := w.ClusterPolicies.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service ClusterPolicies
diff --git a/cmd/workspace/clusters/clusters.go b/cmd/workspace/clusters/clusters.go
index 861730632..dce6753df 100755
--- a/cmd/workspace/clusters/clusters.go
+++ b/cmd/workspace/clusters/clusters.go
@@ -169,6 +169,8 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.ClusterName, "cluster-name", createReq.ClusterName, `Cluster name requested by the user.`)
 	cmd.Flags().Var(&createReq.ClusterSource, "cluster-source", `Determines whether the cluster was created by a user through the UI, created by the Databricks Jobs Scheduler, or through an API request.`)
 	// TODO: map via StringToStringVar: custom_tags
+	cmd.Flags().Var(&createReq.DataSecurityMode, "data-security-mode", `This describes an enum.`)
+	// TODO: complex arg: docker_image
 	cmd.Flags().StringVar(&createReq.DriverInstancePoolId, "driver-instance-pool-id", createReq.DriverInstancePoolId, `The optional ID of the instance pool for the driver of the cluster belongs.`)
 	cmd.Flags().StringVar(&createReq.DriverNodeTypeId, "driver-node-type-id", createReq.DriverNodeTypeId, `The node type of the Spark driver.`)
 	cmd.Flags().BoolVar(&createReq.EnableElasticDisk, "enable-elastic-disk", createReq.EnableElasticDisk, `Autoscaling Local Storage: when enabled, this cluster will dynamically acquire additional disk space when its Spark workers are running low on disk space.`)
@@ -180,6 +182,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().IntVar(&createReq.NumWorkers, "num-workers", createReq.NumWorkers, `Number of worker nodes that this cluster should have.`)
 	cmd.Flags().StringVar(&createReq.PolicyId, "policy-id", createReq.PolicyId, `The ID of the cluster policy used to create the cluster if applicable.`)
 	cmd.Flags().Var(&createReq.RuntimeEngine, "runtime-engine", `Decides which runtime engine to be use, e.g.`)
+	cmd.Flags().StringVar(&createReq.SingleUserName, "single-user-name", createReq.SingleUserName, `Single user name if data_security_mode is SINGLE_USER.`)
 	// TODO: map via StringToStringVar: spark_conf
 	// TODO: map via StringToStringVar: spark_env_vars
 	// TODO: array: ssh_public_keys
@@ -661,6 +664,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*compute.GetClusterPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq compute.GetClusterPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels CLUSTER_ID"
+	cmd.Short = `Get cluster permission levels.`
+	cmd.Long = `Get cluster permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_ID argument specified. Loading names for Clusters drop-down."
+			names, err := w.Clusters.ClusterDetailsClusterNameToClusterIdMap(ctx, compute.ListClustersRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Clusters drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.ClusterId = args[0]
+
+		response, err := w.Clusters.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.GetClusterPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq compute.GetClusterPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions CLUSTER_ID"
+	cmd.Short = `Get cluster permissions.`
+	cmd.Long = `Get cluster permissions.
+  
+  Gets the permissions of a cluster. Clusters can inherit permissions from their
+  root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_ID argument specified. Loading names for Clusters drop-down."
+			names, err := w.Clusters.ClusterDetailsClusterNameToClusterIdMap(ctx, compute.ListClustersRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Clusters drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+		}
+		getPermissionsReq.ClusterId = args[0]
+
+		response, err := w.Clusters.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -1217,6 +1367,90 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.ClusterPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq compute.ClusterPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions CLUSTER_ID"
+	cmd.Short = `Set cluster permissions.`
+	cmd.Long = `Set cluster permissions.
+  
+  Sets permissions on a cluster. Clusters can inherit permissions from their
+  root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_ID argument specified. Loading names for Clusters drop-down."
+			names, err := w.Clusters.ClusterDetailsClusterNameToClusterIdMap(ctx, compute.ListClustersRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Clusters drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+		}
+		setPermissionsReq.ClusterId = args[0]
+
+		response, err := w.Clusters.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start spark-versions command
 
 // Slice with functions to override default command behavior.
@@ -1456,4 +1690,88 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*compute.ClusterPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq compute.ClusterPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions CLUSTER_ID"
+	cmd.Short = `Update cluster permissions.`
+	cmd.Long = `Update cluster permissions.
+  
+  Updates the permissions on a cluster. Clusters can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No CLUSTER_ID argument specified. Loading names for Clusters drop-down."
+			names, err := w.Clusters.ClusterDetailsClusterNameToClusterIdMap(ctx, compute.ListClustersRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Clusters drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The cluster for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the cluster for which to get or manage permissions")
+		}
+		updatePermissionsReq.ClusterId = args[0]
+
+		response, err := w.Clusters.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Clusters
diff --git a/cmd/workspace/cmd.go b/cmd/workspace/cmd.go
index 74dcc3a58..495d8066d 100755
--- a/cmd/workspace/cmd.go
+++ b/cmd/workspace/cmd.go
@@ -4,12 +4,14 @@ package workspace
 
 import (
 	alerts "github.com/databricks/cli/cmd/workspace/alerts"
+	artifact_allowlists "github.com/databricks/cli/cmd/workspace/artifact-allowlists"
 	catalogs "github.com/databricks/cli/cmd/workspace/catalogs"
 	clean_rooms "github.com/databricks/cli/cmd/workspace/clean-rooms"
 	cluster_policies "github.com/databricks/cli/cmd/workspace/cluster-policies"
 	clusters "github.com/databricks/cli/cmd/workspace/clusters"
 	connections "github.com/databricks/cli/cmd/workspace/connections"
 	current_user "github.com/databricks/cli/cmd/workspace/current-user"
+	dashboard_widgets "github.com/databricks/cli/cmd/workspace/dashboard-widgets"
 	dashboards "github.com/databricks/cli/cmd/workspace/dashboards"
 	data_sources "github.com/databricks/cli/cmd/workspace/data-sources"
 	experiments "github.com/databricks/cli/cmd/workspace/experiments"
@@ -26,14 +28,17 @@ import (
 	libraries "github.com/databricks/cli/cmd/workspace/libraries"
 	metastores "github.com/databricks/cli/cmd/workspace/metastores"
 	model_registry "github.com/databricks/cli/cmd/workspace/model-registry"
+	model_versions "github.com/databricks/cli/cmd/workspace/model-versions"
 	permissions "github.com/databricks/cli/cmd/workspace/permissions"
 	pipelines "github.com/databricks/cli/cmd/workspace/pipelines"
 	policy_families "github.com/databricks/cli/cmd/workspace/policy-families"
 	providers "github.com/databricks/cli/cmd/workspace/providers"
 	queries "github.com/databricks/cli/cmd/workspace/queries"
 	query_history "github.com/databricks/cli/cmd/workspace/query-history"
+	query_visualizations "github.com/databricks/cli/cmd/workspace/query-visualizations"
 	recipient_activation "github.com/databricks/cli/cmd/workspace/recipient-activation"
 	recipients "github.com/databricks/cli/cmd/workspace/recipients"
+	registered_models "github.com/databricks/cli/cmd/workspace/registered-models"
 	repos "github.com/databricks/cli/cmd/workspace/repos"
 	schemas "github.com/databricks/cli/cmd/workspace/schemas"
 	secrets "github.com/databricks/cli/cmd/workspace/secrets"
@@ -59,12 +64,14 @@ func All() []*cobra.Command {
 	var out []*cobra.Command
 
 	out = append(out, alerts.New())
+	out = append(out, artifact_allowlists.New())
 	out = append(out, catalogs.New())
 	out = append(out, clean_rooms.New())
 	out = append(out, cluster_policies.New())
 	out = append(out, clusters.New())
 	out = append(out, connections.New())
 	out = append(out, current_user.New())
+	out = append(out, dashboard_widgets.New())
 	out = append(out, dashboards.New())
 	out = append(out, data_sources.New())
 	out = append(out, experiments.New())
@@ -81,14 +88,17 @@ func All() []*cobra.Command {
 	out = append(out, libraries.New())
 	out = append(out, metastores.New())
 	out = append(out, model_registry.New())
+	out = append(out, model_versions.New())
 	out = append(out, permissions.New())
 	out = append(out, pipelines.New())
 	out = append(out, policy_families.New())
 	out = append(out, providers.New())
 	out = append(out, queries.New())
 	out = append(out, query_history.New())
+	out = append(out, query_visualizations.New())
 	out = append(out, recipient_activation.New())
 	out = append(out, recipients.New())
+	out = append(out, registered_models.New())
 	out = append(out, repos.New())
 	out = append(out, schemas.New())
 	out = append(out, secrets.New())
diff --git a/cmd/workspace/connections/connections.go b/cmd/workspace/connections/connections.go
index 7783b9eb7..c25825c9d 100755
--- a/cmd/workspace/connections/connections.go
+++ b/cmd/workspace/connections/connections.go
@@ -65,7 +65,7 @@ func newCreate() *cobra.Command {
 
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `User-provided free-form text description.`)
 	cmd.Flags().StringVar(&createReq.Owner, "owner", createReq.Owner, `Username of current owner of the connection.`)
-	// TODO: map via StringToStringVar: properties_kvpairs
+	// TODO: map via StringToStringVar: properties
 	cmd.Flags().BoolVar(&createReq.ReadOnly, "read-only", createReq.ReadOnly, `If the connection is read only.`)
 
 	cmd.Use = "create"
diff --git a/cmd/workspace/dashboard-widgets/dashboard-widgets.go b/cmd/workspace/dashboard-widgets/dashboard-widgets.go
new file mode 100755
index 000000000..63e8d120c
--- /dev/null
+++ b/cmd/workspace/dashboard-widgets/dashboard-widgets.go
@@ -0,0 +1,228 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package dashboard_widgets
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "dashboard-widgets",
+		Short: `This is an evolving API that facilitates the addition and removal of widgets from existing dashboards within the Databricks Workspace.`,
+		Long: `This is an evolving API that facilitates the addition and removal of widgets
+  from existing dashboards within the Databricks Workspace. Data structures may
+  change over time.`,
+		GroupID: "sql",
+		Annotations: map[string]string{
+			"package": "sql",
+		},
+
+		// This service is being previewed; hide from help output.
+		Hidden: true,
+	}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createOverrides []func(
+	*cobra.Command,
+	*sql.CreateWidget,
+)
+
+func newCreate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createReq sql.CreateWidget
+	var createJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "create"
+	cmd.Short = `Add widget to a dashboard.`
+	cmd.Long = `Add widget to a dashboard.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = createJson.Unmarshal(&createReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.DashboardWidgets.Create(ctx, createReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createOverrides {
+		fn(cmd, &createReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newCreate())
+	})
+}
+
+// start delete command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteOverrides []func(
+	*cobra.Command,
+	*sql.DeleteDashboardWidgetRequest,
+)
+
+func newDelete() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteReq sql.DeleteDashboardWidgetRequest
+
+	// TODO: short flags
+
+	cmd.Use = "delete ID"
+	cmd.Short = `Remove widget.`
+	cmd.Long = `Remove widget.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		deleteReq.Id = args[0]
+
+		err = w.DashboardWidgets.Delete(ctx, deleteReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteOverrides {
+		fn(cmd, &deleteReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDelete())
+	})
+}
+
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*sql.CreateWidget,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq sql.CreateWidget
+	var updateJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update"
+	cmd.Short = `Update existing widget.`
+	cmd.Long = `Update existing widget.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updateJson.Unmarshal(&updateReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.DashboardWidgets.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdate())
+	})
+}
+
+// end service DashboardWidgets
diff --git a/cmd/workspace/dashboards/dashboards.go b/cmd/workspace/dashboards/dashboards.go
index 3c48dc1b7..2335ee28e 100755
--- a/cmd/workspace/dashboards/dashboards.go
+++ b/cmd/workspace/dashboards/dashboards.go
@@ -58,14 +58,14 @@ func newCreate() *cobra.Command {
 	// TODO: short flags
 	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
-	cmd.Use = "create"
+	cmd.Use = "create NAME"
 	cmd.Short = `Create a dashboard object.`
 	cmd.Long = `Create a dashboard object.`
 
 	cmd.Annotations = make(map[string]string)
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
-		check := cobra.ExactArgs(0)
+		check := cobra.ExactArgs(1)
 		if cmd.Flags().Changed("json") {
 			check = cobra.ExactArgs(0)
 		}
diff --git a/cmd/workspace/experiments/experiments.go b/cmd/workspace/experiments/experiments.go
index 1e2ff9fa1..13087029d 100755
--- a/cmd/workspace/experiments/experiments.go
+++ b/cmd/workspace/experiments/experiments.go
@@ -352,6 +352,86 @@ func init() {
 	})
 }
 
+// start delete-runs command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteRunsOverrides []func(
+	*cobra.Command,
+	*ml.DeleteRuns,
+)
+
+func newDeleteRuns() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteRunsReq ml.DeleteRuns
+	var deleteRunsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&deleteRunsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().IntVar(&deleteRunsReq.MaxRuns, "max-runs", deleteRunsReq.MaxRuns, `An optional positive integer indicating the maximum number of runs to delete.`)
+
+	cmd.Use = "delete-runs EXPERIMENT_ID MAX_TIMESTAMP_MILLIS"
+	cmd.Short = `Delete runs by creation time.`
+	cmd.Long = `Delete runs by creation time.
+  
+  Bulk delete runs in an experiment that were created prior to or at the
+  specified timestamp. Deletes at most max_runs per request.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = deleteRunsJson.Unmarshal(&deleteRunsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			deleteRunsReq.ExperimentId = args[0]
+			_, err = fmt.Sscan(args[1], &deleteRunsReq.MaxTimestampMillis)
+			if err != nil {
+				return fmt.Errorf("invalid MAX_TIMESTAMP_MILLIS: %s", args[1])
+			}
+		}
+
+		response, err := w.Experiments.DeleteRuns(ctx, deleteRunsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteRunsOverrides {
+		fn(cmd, &deleteRunsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDeleteRuns())
+	})
+}
+
 // start delete-tag command
 
 // Slice with functions to override default command behavior.
@@ -598,7 +678,7 @@ func newGetHistory() *cobra.Command {
 
 		getHistoryReq.MetricKey = args[0]
 
-		response, err := w.Experiments.GetHistory(ctx, getHistoryReq)
+		response, err := w.Experiments.GetHistoryAll(ctx, getHistoryReq)
 		if err != nil {
 			return err
 		}
@@ -623,6 +703,129 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*ml.GetExperimentPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq ml.GetExperimentPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels EXPERIMENT_ID"
+	cmd.Short = `Get experiment permission levels.`
+	cmd.Long = `Get experiment permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.ExperimentId = args[0]
+
+		response, err := w.Experiments.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*ml.GetExperimentPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq ml.GetExperimentPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions EXPERIMENT_ID"
+	cmd.Short = `Get experiment permissions.`
+	cmd.Long = `Get experiment permissions.
+  
+  Gets the permissions of an experiment. Experiments can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionsReq.ExperimentId = args[0]
+
+		response, err := w.Experiments.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start get-run command
 
 // Slice with functions to override default command behavior.
@@ -1428,6 +1631,86 @@ func init() {
 	})
 }
 
+// start restore-runs command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var restoreRunsOverrides []func(
+	*cobra.Command,
+	*ml.RestoreRuns,
+)
+
+func newRestoreRuns() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var restoreRunsReq ml.RestoreRuns
+	var restoreRunsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&restoreRunsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().IntVar(&restoreRunsReq.MaxRuns, "max-runs", restoreRunsReq.MaxRuns, `An optional positive integer indicating the maximum number of runs to restore.`)
+
+	cmd.Use = "restore-runs EXPERIMENT_ID MIN_TIMESTAMP_MILLIS"
+	cmd.Short = `Restore runs by deletion time.`
+	cmd.Long = `Restore runs by deletion time.
+  
+  Bulk restore runs in an experiment that were deleted no earlier than the
+  specified timestamp. Restores at most max_runs per request.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = restoreRunsJson.Unmarshal(&restoreRunsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			restoreRunsReq.ExperimentId = args[0]
+			_, err = fmt.Sscan(args[1], &restoreRunsReq.MinTimestampMillis)
+			if err != nil {
+				return fmt.Errorf("invalid MIN_TIMESTAMP_MILLIS: %s", args[1])
+			}
+		}
+
+		response, err := w.Experiments.RestoreRuns(ctx, restoreRunsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range restoreRunsOverrides {
+		fn(cmd, &restoreRunsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newRestoreRuns())
+	})
+}
+
 // start search-experiments command
 
 // Slice with functions to override default command behavior.
@@ -1662,6 +1945,78 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*ml.ExperimentPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq ml.ExperimentPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions EXPERIMENT_ID"
+	cmd.Short = `Set experiment permissions.`
+	cmd.Long = `Set experiment permissions.
+  
+  Sets permissions on an experiment. Experiments can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		setPermissionsReq.ExperimentId = args[0]
+
+		response, err := w.Experiments.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start set-tag command
 
 // Slice with functions to override default command behavior.
@@ -1815,6 +2170,78 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*ml.ExperimentPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq ml.ExperimentPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions EXPERIMENT_ID"
+	cmd.Short = `Update experiment permissions.`
+	cmd.Long = `Update experiment permissions.
+  
+  Updates the permissions on an experiment. Experiments can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		updatePermissionsReq.ExperimentId = args[0]
+
+		response, err := w.Experiments.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // start update-run command
 
 // Slice with functions to override default command behavior.
diff --git a/cmd/workspace/groups/groups.go b/cmd/workspace/groups/groups.go
index 48a9c9c68..3f46abbc8 100755
--- a/cmd/workspace/groups/groups.go
+++ b/cmd/workspace/groups/groups.go
@@ -368,7 +368,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update group details.`
diff --git a/cmd/workspace/instance-pools/instance-pools.go b/cmd/workspace/instance-pools/instance-pools.go
index 2a95437fb..9e7805aef 100755
--- a/cmd/workspace/instance-pools/instance-pools.go
+++ b/cmd/workspace/instance-pools/instance-pools.go
@@ -77,7 +77,6 @@ func newCreate() *cobra.Command {
 	cmd.Flags().BoolVar(&createReq.EnableElasticDisk, "enable-elastic-disk", createReq.EnableElasticDisk, `Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire additional disk space when its Spark workers are running low on disk space.`)
 	// TODO: complex arg: gcp_attributes
 	cmd.Flags().IntVar(&createReq.IdleInstanceAutoterminationMinutes, "idle-instance-autotermination-minutes", createReq.IdleInstanceAutoterminationMinutes, `Automatically terminates the extra instances in the pool cache after they are inactive for this time in minutes if min_idle_instances requirement is already met.`)
-	// TODO: complex arg: instance_pool_fleet_attributes
 	cmd.Flags().IntVar(&createReq.MaxCapacity, "max-capacity", createReq.MaxCapacity, `Maximum number of outstanding instances to keep in the pool, including both instances used by clusters and idle instances.`)
 	cmd.Flags().IntVar(&createReq.MinIdleInstances, "min-idle-instances", createReq.MinIdleInstances, `Minimum number of idle instances to keep in the instance pool.`)
 	// TODO: array: preloaded_docker_images
@@ -247,7 +246,6 @@ func newEdit() *cobra.Command {
 	cmd.Flags().BoolVar(&editReq.EnableElasticDisk, "enable-elastic-disk", editReq.EnableElasticDisk, `Autoscaling Local Storage: when enabled, this instances in this pool will dynamically acquire additional disk space when its Spark workers are running low on disk space.`)
 	// TODO: complex arg: gcp_attributes
 	cmd.Flags().IntVar(&editReq.IdleInstanceAutoterminationMinutes, "idle-instance-autotermination-minutes", editReq.IdleInstanceAutoterminationMinutes, `Automatically terminates the extra instances in the pool cache after they are inactive for this time in minutes if min_idle_instances requirement is already met.`)
-	// TODO: complex arg: instance_pool_fleet_attributes
 	cmd.Flags().IntVar(&editReq.MaxCapacity, "max-capacity", editReq.MaxCapacity, `Maximum number of outstanding instances to keep in the pool, including both instances used by clusters and idle instances.`)
 	cmd.Flags().IntVar(&editReq.MinIdleInstances, "min-idle-instances", editReq.MinIdleInstances, `Minimum number of idle instances to keep in the instance pool.`)
 	// TODO: array: preloaded_docker_images
@@ -383,6 +381,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*compute.GetInstancePoolPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq compute.GetInstancePoolPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels INSTANCE_POOL_ID"
+	cmd.Short = `Get instance pool permission levels.`
+	cmd.Long = `Get instance pool permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No INSTANCE_POOL_ID argument specified. Loading names for Instance Pools drop-down."
+			names, err := w.InstancePools.InstancePoolAndStatsInstancePoolNameToInstancePoolIdMap(ctx)
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Instance Pools drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The instance pool for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.InstancePoolId = args[0]
+
+		response, err := w.InstancePools.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.GetInstancePoolPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq compute.GetInstancePoolPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions INSTANCE_POOL_ID"
+	cmd.Short = `Get instance pool permissions.`
+	cmd.Long = `Get instance pool permissions.
+  
+  Gets the permissions of an instance pool. Instance pools can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No INSTANCE_POOL_ID argument specified. Loading names for Instance Pools drop-down."
+			names, err := w.InstancePools.InstancePoolAndStatsInstancePoolNameToInstancePoolIdMap(ctx)
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Instance Pools drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The instance pool for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+		}
+		getPermissionsReq.InstancePoolId = args[0]
+
+		response, err := w.InstancePools.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -431,4 +576,172 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*compute.InstancePoolPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq compute.InstancePoolPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions INSTANCE_POOL_ID"
+	cmd.Short = `Set instance pool permissions.`
+	cmd.Long = `Set instance pool permissions.
+  
+  Sets permissions on an instance pool. Instance pools can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No INSTANCE_POOL_ID argument specified. Loading names for Instance Pools drop-down."
+			names, err := w.InstancePools.InstancePoolAndStatsInstancePoolNameToInstancePoolIdMap(ctx)
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Instance Pools drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The instance pool for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+		}
+		setPermissionsReq.InstancePoolId = args[0]
+
+		response, err := w.InstancePools.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*compute.InstancePoolPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq compute.InstancePoolPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions INSTANCE_POOL_ID"
+	cmd.Short = `Update instance pool permissions.`
+	cmd.Long = `Update instance pool permissions.
+  
+  Updates the permissions on an instance pool. Instance pools can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No INSTANCE_POOL_ID argument specified. Loading names for Instance Pools drop-down."
+			names, err := w.InstancePools.InstancePoolAndStatsInstancePoolNameToInstancePoolIdMap(ctx)
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Instance Pools drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The instance pool for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the instance pool for which to get or manage permissions")
+		}
+		updatePermissionsReq.InstancePoolId = args[0]
+
+		response, err := w.InstancePools.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service InstancePools
diff --git a/cmd/workspace/jobs/jobs.go b/cmd/workspace/jobs/jobs.go
index 640f40016..7670ebb77 100755
--- a/cmd/workspace/jobs/jobs.go
+++ b/cmd/workspace/jobs/jobs.go
@@ -646,6 +646,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*jobs.GetJobPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq jobs.GetJobPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels JOB_ID"
+	cmd.Short = `Get job permission levels.`
+	cmd.Long = `Get job permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No JOB_ID argument specified. Loading names for Jobs drop-down."
+			names, err := w.Jobs.BaseJobSettingsNameToJobIdMap(ctx, jobs.ListJobsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Jobs drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The job for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.JobId = args[0]
+
+		response, err := w.Jobs.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*jobs.GetJobPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq jobs.GetJobPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions JOB_ID"
+	cmd.Short = `Get job permissions.`
+	cmd.Long = `Get job permissions.
+  
+  Gets the permissions of a job. Jobs can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No JOB_ID argument specified. Loading names for Jobs drop-down."
+			names, err := w.Jobs.BaseJobSettingsNameToJobIdMap(ctx, jobs.ListJobsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Jobs drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The job for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+		}
+		getPermissionsReq.JobId = args[0]
+
+		response, err := w.Jobs.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start get-run command
 
 // Slice with functions to override default command behavior.
@@ -1285,6 +1432,90 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*jobs.JobPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq jobs.JobPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions JOB_ID"
+	cmd.Short = `Set job permissions.`
+	cmd.Long = `Set job permissions.
+  
+  Sets permissions on a job. Jobs can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No JOB_ID argument specified. Loading names for Jobs drop-down."
+			names, err := w.Jobs.BaseJobSettingsNameToJobIdMap(ctx, jobs.ListJobsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Jobs drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The job for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+		}
+		setPermissionsReq.JobId = args[0]
+
+		response, err := w.Jobs.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start submit command
 
 // Slice with functions to override default command behavior.
@@ -1484,4 +1715,88 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*jobs.JobPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq jobs.JobPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions JOB_ID"
+	cmd.Short = `Update job permissions.`
+	cmd.Long = `Update job permissions.
+  
+  Updates the permissions on a job. Jobs can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No JOB_ID argument specified. Loading names for Jobs drop-down."
+			names, err := w.Jobs.BaseJobSettingsNameToJobIdMap(ctx, jobs.ListJobsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Jobs drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The job for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the job for which to get or manage permissions")
+		}
+		updatePermissionsReq.JobId = args[0]
+
+		response, err := w.Jobs.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Jobs
diff --git a/cmd/workspace/libraries/libraries.go b/cmd/workspace/libraries/libraries.go
index e230bfb02..92671dc3e 100755
--- a/cmd/workspace/libraries/libraries.go
+++ b/cmd/workspace/libraries/libraries.go
@@ -154,7 +154,7 @@ func newClusterStatus() *cobra.Command {
 
 		clusterStatusReq.ClusterId = args[0]
 
-		response, err := w.Libraries.ClusterStatus(ctx, clusterStatusReq)
+		response, err := w.Libraries.ClusterStatusAll(ctx, clusterStatusReq)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/workspace/model-registry/model-registry.go b/cmd/workspace/model-registry/model-registry.go
index d944e0d98..e2e552255 100755
--- a/cmd/workspace/model-registry/model-registry.go
+++ b/cmd/workspace/model-registry/model-registry.go
@@ -1226,6 +1226,129 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*ml.GetRegisteredModelPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq ml.GetRegisteredModelPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels REGISTERED_MODEL_ID"
+	cmd.Short = `Get registered model permission levels.`
+	cmd.Long = `Get registered model permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.RegisteredModelId = args[0]
+
+		response, err := w.ModelRegistry.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*ml.GetRegisteredModelPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq ml.GetRegisteredModelPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions REGISTERED_MODEL_ID"
+	cmd.Short = `Get registered model permissions.`
+	cmd.Long = `Get registered model permissions.
+  
+  Gets the permissions of a registered model. Registered models can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionsReq.RegisteredModelId = args[0]
+
+		response, err := w.ModelRegistry.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list-models command
 
 // Slice with functions to override default command behavior.
@@ -1902,6 +2025,78 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*ml.RegisteredModelPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq ml.RegisteredModelPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions REGISTERED_MODEL_ID"
+	cmd.Short = `Set registered model permissions.`
+	cmd.Long = `Set registered model permissions.
+  
+  Sets permissions on a registered model. Registered models can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		setPermissionsReq.RegisteredModelId = args[0]
+
+		response, err := w.ModelRegistry.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start test-registry-webhook command
 
 // Slice with functions to override default command behavior.
@@ -2292,6 +2487,78 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*ml.RegisteredModelPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq ml.RegisteredModelPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions REGISTERED_MODEL_ID"
+	cmd.Short = `Update registered model permissions.`
+	cmd.Long = `Update registered model permissions.
+  
+  Updates the permissions on a registered model. Registered models can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		updatePermissionsReq.RegisteredModelId = args[0]
+
+		response, err := w.ModelRegistry.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // start update-webhook command
 
 // Slice with functions to override default command behavior.
diff --git a/cmd/workspace/model-versions/model-versions.go b/cmd/workspace/model-versions/model-versions.go
new file mode 100755
index 000000000..f62cddab0
--- /dev/null
+++ b/cmd/workspace/model-versions/model-versions.go
@@ -0,0 +1,400 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package model_versions
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "model-versions",
+		Short: `Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.`,
+		Long: `Databricks provides a hosted version of MLflow Model Registry in Unity
+  Catalog. Models in Unity Catalog provide centralized access control, auditing,
+  lineage, and discovery of ML models across Databricks workspaces.
+  
+  This API reference documents the REST endpoints for managing model versions in
+  Unity Catalog. For more details, see the [registered models API
+  docs](/api/workspace/registeredmodels).`,
+		GroupID: "catalog",
+		Annotations: map[string]string{
+			"package": "catalog",
+		},
+	}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start delete command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteModelVersionRequest,
+)
+
+func newDelete() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteReq catalog.DeleteModelVersionRequest
+
+	// TODO: short flags
+
+	cmd.Use = "delete FULL_NAME VERSION"
+	cmd.Short = `Delete a Model Version.`
+	cmd.Long = `Delete a Model Version.
+  
+  Deletes a model version from the specified registered model. Any aliases
+  assigned to the model version will also be deleted.
+  
+  The caller must be a metastore admin or an owner of the parent registered
+  model. For the latter case, the caller must also be the owner or have the
+  **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA**
+  privilege on the parent schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		deleteReq.FullName = args[0]
+		_, err = fmt.Sscan(args[1], &deleteReq.Version)
+		if err != nil {
+			return fmt.Errorf("invalid VERSION: %s", args[1])
+		}
+
+		err = w.ModelVersions.Delete(ctx, deleteReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteOverrides {
+		fn(cmd, &deleteReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDelete())
+	})
+}
+
+// start get command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getOverrides []func(
+	*cobra.Command,
+	*catalog.GetModelVersionRequest,
+)
+
+func newGet() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getReq catalog.GetModelVersionRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get FULL_NAME VERSION"
+	cmd.Short = `Get a Model Version.`
+	cmd.Long = `Get a Model Version.
+  
+  Get a model version.
+  
+  The caller must be a metastore admin or an owner of (or have the **EXECUTE**
+  privilege on) the parent registered model. For the latter case, the caller
+  must also be the owner or have the **USE_CATALOG** privilege on the parent
+  catalog and the **USE_SCHEMA** privilege on the parent schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getReq.FullName = args[0]
+		_, err = fmt.Sscan(args[1], &getReq.Version)
+		if err != nil {
+			return fmt.Errorf("invalid VERSION: %s", args[1])
+		}
+
+		response, err := w.ModelVersions.Get(ctx, getReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getOverrides {
+		fn(cmd, &getReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGet())
+	})
+}
+
+// start get-by-alias command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getByAliasOverrides []func(
+	*cobra.Command,
+	*catalog.GetByAliasRequest,
+)
+
+func newGetByAlias() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getByAliasReq catalog.GetByAliasRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-by-alias FULL_NAME ALIAS"
+	cmd.Short = `Get Model Version By Alias.`
+	cmd.Long = `Get Model Version By Alias.
+  
+  Get a model version by alias.
+  
+  The caller must be a metastore admin or an owner of (or have the **EXECUTE**
+  privilege on) the registered model. For the latter case, the caller must also
+  be the owner or have the **USE_CATALOG** privilege on the parent catalog and
+  the **USE_SCHEMA** privilege on the parent schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getByAliasReq.FullName = args[0]
+		getByAliasReq.Alias = args[1]
+
+		response, err := w.ModelVersions.GetByAlias(ctx, getByAliasReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getByAliasOverrides {
+		fn(cmd, &getByAliasReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetByAlias())
+	})
+}
+
+// start list command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listOverrides []func(
+	*cobra.Command,
+	*catalog.ListModelVersionsRequest,
+)
+
+func newList() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listReq catalog.ListModelVersionsRequest
+
+	// TODO: short flags
+
+	cmd.Flags().IntVar(&listReq.MaxResults, "max-results", listReq.MaxResults, `Max number of model versions to return.`)
+	cmd.Flags().StringVar(&listReq.PageToken, "page-token", listReq.PageToken, `Opaque token to send for the next page of results (pagination).`)
+
+	cmd.Use = "list FULL_NAME"
+	cmd.Short = `List Model Versions.`
+	cmd.Long = `List Model Versions.
+  
+  List model versions. You can list model versions under a particular schema, or
+  list all model versions in the current metastore.
+  
+  The returned models are filtered based on the privileges of the calling user.
+  For example, the metastore admin is able to list all the model versions. A
+  regular user needs to be the owner or have the **EXECUTE** privilege on the
+  parent registered model to recieve the model versions in the response. For the
+  latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.
+  
+  There is no guarantee of a specific ordering of the elements in the response.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		listReq.FullName = args[0]
+
+		response, err := w.ModelVersions.ListAll(ctx, listReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listOverrides {
+		fn(cmd, &listReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newList())
+	})
+}
+
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateModelVersionRequest,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq catalog.UpdateModelVersionRequest
+
+	// TODO: short flags
+
+	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `The comment attached to the model version.`)
+
+	cmd.Use = "update FULL_NAME VERSION"
+	cmd.Short = `Update a Model Version.`
+	cmd.Long = `Update a Model Version.
+  
+  Updates the specified model version.
+  
+  The caller must be a metastore admin or an owner of the parent registered
+  model. For the latter case, the caller must also be the owner or have the
+  **USE_CATALOG** privilege on the parent catalog and the **USE_SCHEMA**
+  privilege on the parent schema.
+  
+  Currently only the comment of the model version can be updated.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		updateReq.FullName = args[0]
+		_, err = fmt.Sscan(args[1], &updateReq.Version)
+		if err != nil {
+			return fmt.Errorf("invalid VERSION: %s", args[1])
+		}
+
+		response, err := w.ModelVersions.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdate())
+	})
+}
+
+// end service ModelVersions
diff --git a/cmd/workspace/permissions/permissions.go b/cmd/workspace/permissions/permissions.go
index 39454b248..c168a1a48 100755
--- a/cmd/workspace/permissions/permissions.go
+++ b/cmd/workspace/permissions/permissions.go
@@ -19,7 +19,52 @@ func New() *cobra.Command {
 		Use:   "permissions",
 		Short: `Permissions API are used to create read, write, edit, update and manage access for various users on different objects and endpoints.`,
 		Long: `Permissions API are used to create read, write, edit, update and manage access
-  for various users on different objects and endpoints.`,
+  for various users on different objects and endpoints.
+  
+  * **[Cluster permissions](:service:clusters)** — Manage which users can
+  manage, restart, or attach to clusters.
+  
+  * **[Cluster policy permissions](:service:clusterpolicies)** — Manage which
+  users can use cluster policies.
+  
+  * **[Delta Live Tables pipeline permissions](:service:pipelines)** — Manage
+  which users can view, manage, run, cancel, or own a Delta Live Tables
+  pipeline.
+  
+  * **[Job permissions](:service:jobs)** — Manage which users can view,
+  manage, trigger, cancel, or own a job.
+  
+  * **[MLflow experiment permissions](:service:experiments)** — Manage which
+  users can read, edit, or manage MLflow experiments.
+  
+  * **[MLflow registered model permissions](:service:modelregistry)** — Manage
+  which users can read, edit, or manage MLflow registered models.
+  
+  * **[Password permissions](:service:users)** — Manage which users can use
+  password login when SSO is enabled.
+  
+  * **[Instance Pool permissions](:service:instancepools)** — Manage which
+  users can manage or attach to pools.
+  
+  * **[Repo permissions](repos)** — Manage which users can read, run, edit, or
+  manage a repo.
+  
+  * **[Serving endpoint permissions](:service:servingendpoints)** — Manage
+  which users can view, query, or manage a serving endpoint.
+  
+  * **[SQL warehouse permissions](:service:warehouses)** — Manage which users
+  can use or manage SQL warehouses.
+  
+  * **[Token permissions](:service:tokenmanagement)** — Manage which users can
+  create or use tokens.
+  
+  * **[Workspace object permissions](:service:workspace)** — Manage which
+  users can read, run, edit, or manage directories, files, and notebooks.
+  
+  For the mapping of the required permissions for specific actions or abilities
+  and other important information, see [Access Control].
+  
+  [Access Control]: https://docs.databricks.com/security/auth-authz/access-control/index.html`,
 		GroupID: "iam",
 		Annotations: map[string]string{
 			"package": "iam",
@@ -54,8 +99,8 @@ func newGet() *cobra.Command {
 	cmd.Short = `Get object permissions.`
 	cmd.Long = `Get object permissions.
   
-  Gets the permission of an object. Objects can inherit permissions from their
-  parent objects or root objects.`
+  Gets the permissions of an object. Objects can inherit permissions from their
+  parent objects or root object.`
 
 	cmd.Annotations = make(map[string]string)
 
@@ -114,8 +159,8 @@ func newGetPermissionLevels() *cobra.Command {
 	// TODO: short flags
 
 	cmd.Use = "get-permission-levels REQUEST_OBJECT_TYPE REQUEST_OBJECT_ID"
-	cmd.Short = `Get permission levels.`
-	cmd.Long = `Get permission levels.
+	cmd.Short = `Get object permission levels.`
+	cmd.Long = `Get object permission levels.
   
   Gets the permission levels that a user can have on an object.`
 
@@ -180,11 +225,11 @@ func newSet() *cobra.Command {
 	// TODO: array: access_control_list
 
 	cmd.Use = "set REQUEST_OBJECT_TYPE REQUEST_OBJECT_ID"
-	cmd.Short = `Set permissions.`
-	cmd.Long = `Set permissions.
+	cmd.Short = `Set object permissions.`
+	cmd.Long = `Set object permissions.
   
-  Sets permissions on object. Objects can inherit permissions from their parent
-  objects and root objects.`
+  Sets permissions on an object. Objects can inherit permissions from their
+  parent objects or root object.`
 
 	cmd.Annotations = make(map[string]string)
 
@@ -207,11 +252,11 @@ func newSet() *cobra.Command {
 		setReq.RequestObjectType = args[0]
 		setReq.RequestObjectId = args[1]
 
-		err = w.Permissions.Set(ctx, setReq)
+		response, err := w.Permissions.Set(ctx, setReq)
 		if err != nil {
 			return err
 		}
-		return nil
+		return cmdio.Render(ctx, response)
 	}
 
 	// Disable completions since they are not applicable.
@@ -253,10 +298,11 @@ func newUpdate() *cobra.Command {
 	// TODO: array: access_control_list
 
 	cmd.Use = "update REQUEST_OBJECT_TYPE REQUEST_OBJECT_ID"
-	cmd.Short = `Update permission.`
-	cmd.Long = `Update permission.
+	cmd.Short = `Update object permissions.`
+	cmd.Long = `Update object permissions.
   
-  Updates the permissions on an object.`
+  Updates the permissions on an object. Objects can inherit permissions from
+  their parent objects or root object.`
 
 	cmd.Annotations = make(map[string]string)
 
@@ -279,11 +325,11 @@ func newUpdate() *cobra.Command {
 		updateReq.RequestObjectType = args[0]
 		updateReq.RequestObjectId = args[1]
 
-		err = w.Permissions.Update(ctx, updateReq)
+		response, err := w.Permissions.Update(ctx, updateReq)
 		if err != nil {
 			return err
 		}
-		return nil
+		return cmdio.Render(ctx, response)
 	}
 
 	// Disable completions since they are not applicable.
diff --git a/cmd/workspace/pipelines/pipelines.go b/cmd/workspace/pipelines/pipelines.go
index 708343b2e..10bcc226e 100755
--- a/cmd/workspace/pipelines/pipelines.go
+++ b/cmd/workspace/pipelines/pipelines.go
@@ -272,6 +272,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*pipelines.GetPipelinePermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq pipelines.GetPipelinePermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels PIPELINE_ID"
+	cmd.Short = `Get pipeline permission levels.`
+	cmd.Long = `Get pipeline permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No PIPELINE_ID argument specified. Loading names for Pipelines drop-down."
+			names, err := w.Pipelines.PipelineStateInfoNameToPipelineIdMap(ctx, pipelines.ListPipelinesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Pipelines drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The pipeline for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.PipelineId = args[0]
+
+		response, err := w.Pipelines.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*pipelines.GetPipelinePermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq pipelines.GetPipelinePermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions PIPELINE_ID"
+	cmd.Short = `Get pipeline permissions.`
+	cmd.Long = `Get pipeline permissions.
+  
+  Gets the permissions of a pipeline. Pipelines can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No PIPELINE_ID argument specified. Loading names for Pipelines drop-down."
+			names, err := w.Pipelines.PipelineStateInfoNameToPipelineIdMap(ctx, pipelines.ListPipelinesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Pipelines drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The pipeline for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+		}
+		getPermissionsReq.PipelineId = args[0]
+
+		response, err := w.Pipelines.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start get-update command
 
 // Slice with functions to override default command behavior.
@@ -664,6 +811,90 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*pipelines.PipelinePermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq pipelines.PipelinePermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions PIPELINE_ID"
+	cmd.Short = `Set pipeline permissions.`
+	cmd.Long = `Set pipeline permissions.
+  
+  Sets permissions on a pipeline. Pipelines can inherit permissions from their
+  root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No PIPELINE_ID argument specified. Loading names for Pipelines drop-down."
+			names, err := w.Pipelines.PipelineStateInfoNameToPipelineIdMap(ctx, pipelines.ListPipelinesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Pipelines drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The pipeline for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+		}
+		setPermissionsReq.PipelineId = args[0]
+
+		response, err := w.Pipelines.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start start-update command
 
 // Slice with functions to override default command behavior.
@@ -942,4 +1173,88 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*pipelines.PipelinePermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq pipelines.PipelinePermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions PIPELINE_ID"
+	cmd.Short = `Update pipeline permissions.`
+	cmd.Long = `Update pipeline permissions.
+  
+  Updates the permissions on a pipeline. Pipelines can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No PIPELINE_ID argument specified. Loading names for Pipelines drop-down."
+			names, err := w.Pipelines.PipelineStateInfoNameToPipelineIdMap(ctx, pipelines.ListPipelinesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Pipelines drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The pipeline for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the pipeline for which to get or manage permissions")
+		}
+		updatePermissionsReq.PipelineId = args[0]
+
+		response, err := w.Pipelines.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Pipelines
diff --git a/cmd/workspace/query-visualizations/query-visualizations.go b/cmd/workspace/query-visualizations/query-visualizations.go
new file mode 100755
index 000000000..fae0f9341
--- /dev/null
+++ b/cmd/workspace/query-visualizations/query-visualizations.go
@@ -0,0 +1,236 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package query_visualizations
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/sql"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "query-visualizations",
+		Short: `This is an evolving API that facilitates the addition and removal of vizualisations from existing queries within the Databricks Workspace.`,
+		Long: `This is an evolving API that facilitates the addition and removal of
+  vizualisations from existing queries within the Databricks Workspace. Data
+  structures may change over time.`,
+		GroupID: "sql",
+		Annotations: map[string]string{
+			"package": "sql",
+		},
+
+		// This service is being previewed; hide from help output.
+		Hidden: true,
+	}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createOverrides []func(
+	*cobra.Command,
+	*sql.CreateQueryVisualizationRequest,
+)
+
+func newCreate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createReq sql.CreateQueryVisualizationRequest
+	var createJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "create"
+	cmd.Short = `Add visualization to a query.`
+	cmd.Long = `Add visualization to a query.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = createJson.Unmarshal(&createReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.QueryVisualizations.Create(ctx, createReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createOverrides {
+		fn(cmd, &createReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newCreate())
+	})
+}
+
+// start delete command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteOverrides []func(
+	*cobra.Command,
+	*sql.DeleteQueryVisualizationRequest,
+)
+
+func newDelete() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteReq sql.DeleteQueryVisualizationRequest
+
+	// TODO: short flags
+
+	cmd.Use = "delete ID"
+	cmd.Short = `Remove visualization.`
+	cmd.Long = `Remove visualization.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		deleteReq.Id = args[0]
+
+		err = w.QueryVisualizations.Delete(ctx, deleteReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteOverrides {
+		fn(cmd, &deleteReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDelete())
+	})
+}
+
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*sql.Visualization,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq sql.Visualization
+	var updateJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updateJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "update ID"
+	cmd.Short = `Edit existing visualization.`
+	cmd.Long = `Edit existing visualization.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updateJson.Unmarshal(&updateReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			return fmt.Errorf("please provide command input in JSON format by specifying the --json flag")
+		}
+
+		response, err := w.QueryVisualizations.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdate())
+	})
+}
+
+// end service QueryVisualizations
diff --git a/cmd/workspace/registered-models/registered-models.go b/cmd/workspace/registered-models/registered-models.go
new file mode 100755
index 000000000..cc7822531
--- /dev/null
+++ b/cmd/workspace/registered-models/registered-models.go
@@ -0,0 +1,635 @@
+// Code generated from OpenAPI specs by Databricks SDK Generator. DO NOT EDIT.
+
+package registered_models
+
+import (
+	"fmt"
+
+	"github.com/databricks/cli/cmd/root"
+	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/flags"
+	"github.com/databricks/databricks-sdk-go/service/catalog"
+	"github.com/spf13/cobra"
+)
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var cmdOverrides []func(*cobra.Command)
+
+func New() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "registered-models",
+		Short: `Databricks provides a hosted version of MLflow Model Registry in Unity Catalog.`,
+		Long: `Databricks provides a hosted version of MLflow Model Registry in Unity
+  Catalog. Models in Unity Catalog provide centralized access control, auditing,
+  lineage, and discovery of ML models across Databricks workspaces.
+  
+  An MLflow registered model resides in the third layer of Unity Catalog’s
+  three-level namespace. Registered models contain model versions, which
+  correspond to actual ML models (MLflow models). Creating new model versions
+  currently requires use of the MLflow Python client. Once model versions are
+  created, you can load them for batch inference using MLflow Python client
+  APIs, or deploy them for real-time serving using Databricks Model Serving.
+  
+  All operations on registered models and model versions require USE_CATALOG
+  permissions on the enclosing catalog and USE_SCHEMA permissions on the
+  enclosing schema. In addition, the following additional privileges are
+  required for various operations:
+  
+  * To create a registered model, users must additionally have the CREATE_MODEL
+  permission on the target schema. * To view registered model or model version
+  metadata, model version data files, or invoke a model version, users must
+  additionally have the EXECUTE permission on the registered model * To update
+  registered model or model version tags, users must additionally have APPLY TAG
+  permissions on the registered model * To update other registered model or
+  model version metadata (comments, aliases) create a new model version, or
+  update permissions on the registered model, users must be owners of the
+  registered model.
+  
+  Note: The securable type for models is "FUNCTION". When using REST APIs (e.g.
+  tagging, grants) that specify a securable type, use "FUNCTION" as the
+  securable type.`,
+		GroupID: "catalog",
+		Annotations: map[string]string{
+			"package": "catalog",
+		},
+	}
+
+	// Apply optional overrides to this command.
+	for _, fn := range cmdOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+// start create command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var createOverrides []func(
+	*cobra.Command,
+	*catalog.CreateRegisteredModelRequest,
+)
+
+func newCreate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var createReq catalog.CreateRegisteredModelRequest
+	var createJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&createJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `The comment attached to the registered model.`)
+	cmd.Flags().StringVar(&createReq.StorageLocation, "storage-location", createReq.StorageLocation, `The storage location on the cloud under which model version data files are stored.`)
+
+	cmd.Use = "create CATALOG_NAME SCHEMA_NAME NAME"
+	cmd.Short = `Create a Registered Model.`
+	cmd.Long = `Create a Registered Model.
+  
+  Creates a new registered model in Unity Catalog.
+  
+  File storage for model versions in the registered model will be located in the
+  default location which is specified by the parent schema, or the parent
+  catalog, or the Metastore.
+  
+  For registered model creation to succeed, the user must satisfy the following
+  conditions: - The caller must be a metastore admin, or be the owner of the
+  parent catalog and schema, or have the **USE_CATALOG** privilege on the parent
+  catalog and the **USE_SCHEMA** privilege on the parent schema. - The caller
+  must have the **CREATE MODEL** or **CREATE FUNCTION** privilege on the parent
+  schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(3)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = createJson.Unmarshal(&createReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			createReq.CatalogName = args[0]
+			createReq.SchemaName = args[1]
+			createReq.Name = args[2]
+		}
+
+		response, err := w.RegisteredModels.Create(ctx, createReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range createOverrides {
+		fn(cmd, &createReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newCreate())
+	})
+}
+
+// start delete command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteRegisteredModelRequest,
+)
+
+func newDelete() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteReq catalog.DeleteRegisteredModelRequest
+
+	// TODO: short flags
+
+	cmd.Use = "delete FULL_NAME"
+	cmd.Short = `Delete a Registered Model.`
+	cmd.Long = `Delete a Registered Model.
+  
+  Deletes a registered model and all its model versions from the specified
+  parent catalog and schema.
+  
+  The caller must be a metastore admin or an owner of the registered model. For
+  the latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No FULL_NAME argument specified. Loading names for Registered Models drop-down."
+			names, err := w.RegisteredModels.RegisteredModelInfoNameToFullNameMap(ctx, catalog.ListRegisteredModelsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Registered Models drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The three-level (fully qualified) name of the registered model")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+		}
+		deleteReq.FullName = args[0]
+
+		err = w.RegisteredModels.Delete(ctx, deleteReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteOverrides {
+		fn(cmd, &deleteReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDelete())
+	})
+}
+
+// start delete-alias command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var deleteAliasOverrides []func(
+	*cobra.Command,
+	*catalog.DeleteAliasRequest,
+)
+
+func newDeleteAlias() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var deleteAliasReq catalog.DeleteAliasRequest
+
+	// TODO: short flags
+
+	cmd.Use = "delete-alias FULL_NAME ALIAS"
+	cmd.Short = `Delete a Registered Model Alias.`
+	cmd.Long = `Delete a Registered Model Alias.
+  
+  Deletes a registered model alias.
+  
+  The caller must be a metastore admin or an owner of the registered model. For
+  the latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		deleteAliasReq.FullName = args[0]
+		deleteAliasReq.Alias = args[1]
+
+		err = w.RegisteredModels.DeleteAlias(ctx, deleteAliasReq)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range deleteAliasOverrides {
+		fn(cmd, &deleteAliasReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newDeleteAlias())
+	})
+}
+
+// start get command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getOverrides []func(
+	*cobra.Command,
+	*catalog.GetRegisteredModelRequest,
+)
+
+func newGet() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getReq catalog.GetRegisteredModelRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get FULL_NAME"
+	cmd.Short = `Get a Registered Model.`
+	cmd.Long = `Get a Registered Model.
+  
+  Get a registered model.
+  
+  The caller must be a metastore admin or an owner of (or have the **EXECUTE**
+  privilege on) the registered model. For the latter case, the caller must also
+  be the owner or have the **USE_CATALOG** privilege on the parent catalog and
+  the **USE_SCHEMA** privilege on the parent schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No FULL_NAME argument specified. Loading names for Registered Models drop-down."
+			names, err := w.RegisteredModels.RegisteredModelInfoNameToFullNameMap(ctx, catalog.ListRegisteredModelsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Registered Models drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The three-level (fully qualified) name of the registered model")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+		}
+		getReq.FullName = args[0]
+
+		response, err := w.RegisteredModels.Get(ctx, getReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getOverrides {
+		fn(cmd, &getReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGet())
+	})
+}
+
+// start list command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var listOverrides []func(
+	*cobra.Command,
+	*catalog.ListRegisteredModelsRequest,
+)
+
+func newList() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var listReq catalog.ListRegisteredModelsRequest
+	var listJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&listJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Flags().StringVar(&listReq.CatalogName, "catalog-name", listReq.CatalogName, `The identifier of the catalog under which to list registered models.`)
+	cmd.Flags().IntVar(&listReq.MaxResults, "max-results", listReq.MaxResults, `Max number of registered models to return.`)
+	cmd.Flags().StringVar(&listReq.PageToken, "page-token", listReq.PageToken, `Opaque token to send for the next page of results (pagination).`)
+	cmd.Flags().StringVar(&listReq.SchemaName, "schema-name", listReq.SchemaName, `The identifier of the schema under which to list registered models.`)
+
+	cmd.Use = "list"
+	cmd.Short = `List Registered Models.`
+	cmd.Long = `List Registered Models.
+  
+  List registered models. You can list registered models under a particular
+  schema, or list all registered models in the current metastore.
+  
+  The returned models are filtered based on the privileges of the calling user.
+  For example, the metastore admin is able to list all the registered models. A
+  regular user needs to be the owner or have the **EXECUTE** privilege on the
+  registered model to recieve the registered models in the response. For the
+  latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.
+  
+  There is no guarantee of a specific ordering of the elements in the response.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(0)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = listJson.Unmarshal(&listReq)
+			if err != nil {
+				return err
+			}
+		} else {
+		}
+
+		response, err := w.RegisteredModels.ListAll(ctx, listReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range listOverrides {
+		fn(cmd, &listReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newList())
+	})
+}
+
+// start set-alias command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setAliasOverrides []func(
+	*cobra.Command,
+	*catalog.SetRegisteredModelAliasRequest,
+)
+
+func newSetAlias() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setAliasReq catalog.SetRegisteredModelAliasRequest
+	var setAliasJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setAliasJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	cmd.Use = "set-alias FULL_NAME ALIAS VERSION_NUM"
+	cmd.Short = `Set a Registered Model Alias.`
+	cmd.Long = `Set a Registered Model Alias.
+  
+  Set an alias on the specified registered model.
+  
+  The caller must be a metastore admin or an owner of the registered model. For
+  the latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(3)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setAliasJson.Unmarshal(&setAliasReq)
+			if err != nil {
+				return err
+			}
+		} else {
+			setAliasReq.FullName = args[0]
+			setAliasReq.Alias = args[1]
+			_, err = fmt.Sscan(args[2], &setAliasReq.VersionNum)
+			if err != nil {
+				return fmt.Errorf("invalid VERSION_NUM: %s", args[2])
+			}
+		}
+
+		response, err := w.RegisteredModels.SetAlias(ctx, setAliasReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setAliasOverrides {
+		fn(cmd, &setAliasReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetAlias())
+	})
+}
+
+// start update command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updateOverrides []func(
+	*cobra.Command,
+	*catalog.UpdateRegisteredModelRequest,
+)
+
+func newUpdate() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updateReq catalog.UpdateRegisteredModelRequest
+
+	// TODO: short flags
+
+	cmd.Flags().StringVar(&updateReq.Comment, "comment", updateReq.Comment, `The comment attached to the registered model.`)
+	cmd.Flags().StringVar(&updateReq.Name, "name", updateReq.Name, `The name of the registered model.`)
+	cmd.Flags().StringVar(&updateReq.Owner, "owner", updateReq.Owner, `The identifier of the user who owns the registered model.`)
+
+	cmd.Use = "update FULL_NAME"
+	cmd.Short = `Update a Registered Model.`
+	cmd.Long = `Update a Registered Model.
+  
+  Updates the specified registered model.
+  
+  The caller must be a metastore admin or an owner of the registered model. For
+  the latter case, the caller must also be the owner or have the **USE_CATALOG**
+  privilege on the parent catalog and the **USE_SCHEMA** privilege on the parent
+  schema.
+  
+  Currently only the name, the owner or the comment of the registered model can
+  be updated.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No FULL_NAME argument specified. Loading names for Registered Models drop-down."
+			names, err := w.RegisteredModels.RegisteredModelInfoNameToFullNameMap(ctx, catalog.ListRegisteredModelsRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Registered Models drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The three-level (fully qualified) name of the registered model")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the three-level (fully qualified) name of the registered model")
+		}
+		updateReq.FullName = args[0]
+
+		response, err := w.RegisteredModels.Update(ctx, updateReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updateOverrides {
+		fn(cmd, &updateReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdate())
+	})
+}
+
+// end service RegisteredModels
diff --git a/cmd/workspace/repos/repos.go b/cmd/workspace/repos/repos.go
index b1e003717..2d510e904 100755
--- a/cmd/workspace/repos/repos.go
+++ b/cmd/workspace/repos/repos.go
@@ -275,6 +275,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*workspace.GetRepoPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq workspace.GetRepoPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels REPO_ID"
+	cmd.Short = `Get repo permission levels.`
+	cmd.Long = `Get repo permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No REPO_ID argument specified. Loading names for Repos drop-down."
+			names, err := w.Repos.RepoInfoPathToIdMap(ctx, workspace.ListReposRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Repos drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The repo for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.RepoId = args[0]
+
+		response, err := w.Repos.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.GetRepoPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq workspace.GetRepoPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions REPO_ID"
+	cmd.Short = `Get repo permissions.`
+	cmd.Long = `Get repo permissions.
+  
+  Gets the permissions of a repo. Repos can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No REPO_ID argument specified. Loading names for Repos drop-down."
+			names, err := w.Repos.RepoInfoPathToIdMap(ctx, workspace.ListReposRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Repos drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The repo for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+		}
+		getPermissionsReq.RepoId = args[0]
+
+		response, err := w.Repos.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -351,6 +498,90 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.RepoPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq workspace.RepoPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions REPO_ID"
+	cmd.Short = `Set repo permissions.`
+	cmd.Long = `Set repo permissions.
+  
+  Sets permissions on a repo. Repos can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No REPO_ID argument specified. Loading names for Repos drop-down."
+			names, err := w.Repos.RepoInfoPathToIdMap(ctx, workspace.ListReposRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Repos drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The repo for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+		}
+		setPermissionsReq.RepoId = args[0]
+
+		response, err := w.Repos.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start update command
 
 // Slice with functions to override default command behavior.
@@ -440,4 +671,88 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.RepoPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq workspace.RepoPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions REPO_ID"
+	cmd.Short = `Update repo permissions.`
+	cmd.Long = `Update repo permissions.
+  
+  Updates the permissions on a repo. Repos can inherit permissions from their
+  root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No REPO_ID argument specified. Loading names for Repos drop-down."
+			names, err := w.Repos.RepoInfoPathToIdMap(ctx, workspace.ListReposRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Repos drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The repo for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the repo for which to get or manage permissions")
+		}
+		updatePermissionsReq.RepoId = args[0]
+
+		response, err := w.Repos.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Repos
diff --git a/cmd/workspace/secrets/secrets.go b/cmd/workspace/secrets/secrets.go
index a8b907ac4..5425da90c 100755
--- a/cmd/workspace/secrets/secrets.go
+++ b/cmd/workspace/secrets/secrets.go
@@ -427,6 +427,79 @@ func init() {
 	})
 }
 
+// start get-secret command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getSecretOverrides []func(
+	*cobra.Command,
+	*workspace.GetSecretRequest,
+)
+
+func newGetSecret() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getSecretReq workspace.GetSecretRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-secret SCOPE KEY"
+	cmd.Short = `Get a secret.`
+	cmd.Long = `Get a secret.
+  
+  Gets the bytes representation of a secret value for the specified scope and
+  key.
+  
+  Users need the READ permission to make this call.
+  
+  Note that the secret value returned is in bytes. The interpretation of the
+  bytes is determined by the caller in DBUtils and the type the data is decoded
+  into.
+  
+  Throws PERMISSION_DENIED if the user does not have permission to make this
+  API call. Throws RESOURCE_DOES_NOT_EXIST if no such secret or secret scope
+  exists.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getSecretReq.Scope = args[0]
+		getSecretReq.Key = args[1]
+
+		response, err := w.Secrets.GetSecret(ctx, getSecretReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getSecretOverrides {
+		fn(cmd, &getSecretReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetSecret())
+	})
+}
+
 // start list-acls command
 
 // Slice with functions to override default command behavior.
diff --git a/cmd/workspace/service-principals/service-principals.go b/cmd/workspace/service-principals/service-principals.go
index f30a92d4b..1958dd21b 100755
--- a/cmd/workspace/service-principals/service-principals.go
+++ b/cmd/workspace/service-principals/service-principals.go
@@ -367,7 +367,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update service principal details.`
diff --git a/cmd/workspace/serving-endpoints/serving-endpoints.go b/cmd/workspace/serving-endpoints/serving-endpoints.go
index 33b0abac7..e22a38443 100755
--- a/cmd/workspace/serving-endpoints/serving-endpoints.go
+++ b/cmd/workspace/serving-endpoints/serving-endpoints.go
@@ -374,6 +374,129 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*serving.GetServingEndpointPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq serving.GetServingEndpointPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels SERVING_ENDPOINT_ID"
+	cmd.Short = `Get serving endpoint permission levels.`
+	cmd.Long = `Get serving endpoint permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.ServingEndpointId = args[0]
+
+		response, err := w.ServingEndpoints.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*serving.GetServingEndpointPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq serving.GetServingEndpointPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions SERVING_ENDPOINT_ID"
+	cmd.Short = `Get serving endpoint permissions.`
+	cmd.Long = `Get serving endpoint permissions.
+  
+  Gets the permissions of a serving endpoint. Serving endpoints can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionsReq.ServingEndpointId = args[0]
+
+		response, err := w.ServingEndpoints.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -542,6 +665,78 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*serving.ServingEndpointPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq serving.ServingEndpointPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions SERVING_ENDPOINT_ID"
+	cmd.Short = `Set serving endpoint permissions.`
+	cmd.Long = `Set serving endpoint permissions.
+  
+  Sets permissions on a serving endpoint. Serving endpoints can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		setPermissionsReq.ServingEndpointId = args[0]
+
+		response, err := w.ServingEndpoints.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start update-config command
 
 // Slice with functions to override default command behavior.
@@ -630,4 +825,76 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*serving.ServingEndpointPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq serving.ServingEndpointPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions SERVING_ENDPOINT_ID"
+	cmd.Short = `Update serving endpoint permissions.`
+	cmd.Long = `Update serving endpoint permissions.
+  
+  Updates the permissions on a serving endpoint. Serving endpoints can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(1)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		updatePermissionsReq.ServingEndpointId = args[0]
+
+		response, err := w.ServingEndpoints.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service ServingEndpoints
diff --git a/cmd/workspace/token-management/token-management.go b/cmd/workspace/token-management/token-management.go
index dcee2f0ee..b934e2640 100755
--- a/cmd/workspace/token-management/token-management.go
+++ b/cmd/workspace/token-management/token-management.go
@@ -262,6 +262,103 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	cmd.Use = "get-permission-levels"
+	cmd.Short = `Get token permission levels.`
+	cmd.Long = `Get token permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+		response, err := w.TokenManagement.GetPermissionLevels(ctx)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	cmd.Use = "get-permissions"
+	cmd.Short = `Get token permissions.`
+	cmd.Long = `Get token permissions.
+  
+  Gets the permissions of all tokens. Tokens can inherit permissions from their
+  root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+		response, err := w.TokenManagement.GetPermissions(ctx)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -337,4 +434,154 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*settings.TokenPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq settings.TokenPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions"
+	cmd.Short = `Set token permissions.`
+	cmd.Long = `Set token permissions.
+  
+  Sets permissions on all tokens. Tokens can inherit permissions from their root
+  object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(0)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+		}
+
+		response, err := w.TokenManagement.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*settings.TokenPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq settings.TokenPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions"
+	cmd.Short = `Update token permissions.`
+	cmd.Long = `Update token permissions.
+  
+  Updates the permissions on all tokens. Tokens can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(0)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+		}
+
+		response, err := w.TokenManagement.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service TokenManagement
diff --git a/cmd/workspace/users/users.go b/cmd/workspace/users/users.go
index 2dfbf6e86..b1a8b0572 100755
--- a/cmd/workspace/users/users.go
+++ b/cmd/workspace/users/users.go
@@ -276,6 +276,103 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	cmd.Use = "get-permission-levels"
+	cmd.Short = `Get password permission levels.`
+	cmd.Long = `Get password permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+		response, err := w.Users.GetPermissionLevels(ctx)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	cmd.Use = "get-permissions"
+	cmd.Short = `Get password permissions.`
+	cmd.Long = `Get password permissions.
+  
+  Gets the permissions of all passwords. Passwords can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+		response, err := w.Users.GetPermissions(ctx)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start list command
 
 // Slice with functions to override default command behavior.
@@ -375,7 +472,7 @@ func newPatch() *cobra.Command {
 	cmd.Flags().Var(&patchJson, "json", `either inline JSON string or @path/to/file.json with request body`)
 
 	// TODO: array: Operations
-	// TODO: array: schema
+	// TODO: array: schemas
 
 	cmd.Use = "patch ID"
 	cmd.Short = `Update user details.`
@@ -441,6 +538,81 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*iam.PasswordPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq iam.PasswordPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions"
+	cmd.Short = `Set password permissions.`
+	cmd.Long = `Set password permissions.
+  
+  Sets permissions on all passwords. Passwords can inherit permissions from
+  their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(0)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+		}
+
+		response, err := w.Users.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start update command
 
 // Slice with functions to override default command behavior.
@@ -534,4 +706,79 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*iam.PasswordPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq iam.PasswordPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions"
+	cmd.Short = `Update password permissions.`
+	cmd.Long = `Update password permissions.
+  
+  Updates the permissions on all passwords. Passwords can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(0)
+		if cmd.Flags().Changed("json") {
+			check = cobra.ExactArgs(0)
+		}
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		} else {
+		}
+
+		response, err := w.Users.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Users
diff --git a/cmd/workspace/volumes/volumes.go b/cmd/workspace/volumes/volumes.go
index 2d2026820..4dbfc5856 100755
--- a/cmd/workspace/volumes/volumes.go
+++ b/cmd/workspace/volumes/volumes.go
@@ -32,9 +32,6 @@ func New() *cobra.Command {
 		Annotations: map[string]string{
 			"package": "catalog",
 		},
-
-		// This service is being previewed; hide from help output.
-		Hidden: true,
 	}
 
 	// Apply optional overrides to this command.
@@ -66,7 +63,7 @@ func newCreate() *cobra.Command {
 	cmd.Flags().StringVar(&createReq.Comment, "comment", createReq.Comment, `The comment attached to the volume.`)
 	cmd.Flags().StringVar(&createReq.StorageLocation, "storage-location", createReq.StorageLocation, `The storage location on the cloud.`)
 
-	cmd.Use = "create CATALOG_NAME NAME SCHEMA_NAME VOLUME_TYPE"
+	cmd.Use = "create CATALOG_NAME SCHEMA_NAME NAME VOLUME_TYPE"
 	cmd.Short = `Create a Volume.`
 	cmd.Long = `Create a Volume.
   
@@ -111,8 +108,8 @@ func newCreate() *cobra.Command {
 			}
 		} else {
 			createReq.CatalogName = args[0]
-			createReq.Name = args[1]
-			createReq.SchemaName = args[2]
+			createReq.SchemaName = args[1]
+			createReq.Name = args[2]
 			_, err = fmt.Sscan(args[3], &createReq.VolumeType)
 			if err != nil {
 				return fmt.Errorf("invalid VOLUME_TYPE: %s", args[3])
@@ -253,6 +250,9 @@ func newList() *cobra.Command {
   
   There is no guarantee of a specific ordering of the elements in the array.`
 
+	// This command is being previewed; hide from help output.
+	cmd.Hidden = true
+
 	cmd.Annotations = make(map[string]string)
 
 	cmd.Args = func(cmd *cobra.Command, args []string) error {
diff --git a/cmd/workspace/warehouses/warehouses.go b/cmd/workspace/warehouses/warehouses.go
index 378b931db..c64e0e0b5 100755
--- a/cmd/workspace/warehouses/warehouses.go
+++ b/cmd/workspace/warehouses/warehouses.go
@@ -418,6 +418,153 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*sql.GetWarehousePermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq sql.GetWarehousePermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels WAREHOUSE_ID"
+	cmd.Short = `Get SQL warehouse permission levels.`
+	cmd.Long = `Get SQL warehouse permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No WAREHOUSE_ID argument specified. Loading names for Warehouses drop-down."
+			names, err := w.Warehouses.EndpointInfoNameToIdMap(ctx, sql.ListWarehousesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Warehouses drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The SQL warehouse for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+		}
+		getPermissionLevelsReq.WarehouseId = args[0]
+
+		response, err := w.Warehouses.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*sql.GetWarehousePermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq sql.GetWarehousePermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions WAREHOUSE_ID"
+	cmd.Short = `Get SQL warehouse permissions.`
+	cmd.Long = `Get SQL warehouse permissions.
+  
+  Gets the permissions of a SQL warehouse. SQL warehouses can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No WAREHOUSE_ID argument specified. Loading names for Warehouses drop-down."
+			names, err := w.Warehouses.EndpointInfoNameToIdMap(ctx, sql.ListWarehousesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Warehouses drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The SQL warehouse for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+		}
+		getPermissionsReq.WarehouseId = args[0]
+
+		response, err := w.Warehouses.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start get-workspace-warehouse-config command
 
 // Slice with functions to override default command behavior.
@@ -541,6 +688,90 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*sql.WarehousePermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq sql.WarehousePermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions WAREHOUSE_ID"
+	cmd.Short = `Set SQL warehouse permissions.`
+	cmd.Long = `Set SQL warehouse permissions.
+  
+  Sets permissions on a SQL warehouse. SQL warehouses can inherit permissions
+  from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No WAREHOUSE_ID argument specified. Loading names for Warehouses drop-down."
+			names, err := w.Warehouses.EndpointInfoNameToIdMap(ctx, sql.ListWarehousesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Warehouses drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The SQL warehouse for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+		}
+		setPermissionsReq.WarehouseId = args[0]
+
+		response, err := w.Warehouses.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
 // start set-workspace-warehouse-config command
 
 // Slice with functions to override default command behavior.
@@ -818,4 +1049,88 @@ func init() {
 	})
 }
 
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*sql.WarehousePermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq sql.WarehousePermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions WAREHOUSE_ID"
+	cmd.Short = `Update SQL warehouse permissions.`
+	cmd.Long = `Update SQL warehouse permissions.
+  
+  Updates the permissions on a SQL warehouse. SQL warehouses can inherit
+  permissions from their root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		if len(args) == 0 {
+			promptSpinner := cmdio.Spinner(ctx)
+			promptSpinner <- "No WAREHOUSE_ID argument specified. Loading names for Warehouses drop-down."
+			names, err := w.Warehouses.EndpointInfoNameToIdMap(ctx, sql.ListWarehousesRequest{})
+			close(promptSpinner)
+			if err != nil {
+				return fmt.Errorf("failed to load names for Warehouses drop-down. Please manually specify required arguments. Original error: %w", err)
+			}
+			id, err := cmdio.Select(ctx, names, "The SQL warehouse for which to get or manage permissions")
+			if err != nil {
+				return err
+			}
+			args = append(args, id)
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("expected to have the sql warehouse for which to get or manage permissions")
+		}
+		updatePermissionsReq.WarehouseId = args[0]
+
+		response, err := w.Warehouses.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Warehouses
diff --git a/cmd/workspace/workspace/workspace.go b/cmd/workspace/workspace/workspace.go
index aeca95253..124680f0b 100755
--- a/cmd/workspace/workspace/workspace.go
+++ b/cmd/workspace/workspace/workspace.go
@@ -212,6 +212,131 @@ func init() {
 	})
 }
 
+// start get-permission-levels command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionLevelsOverrides []func(
+	*cobra.Command,
+	*workspace.GetWorkspaceObjectPermissionLevelsRequest,
+)
+
+func newGetPermissionLevels() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionLevelsReq workspace.GetWorkspaceObjectPermissionLevelsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permission-levels WORKSPACE_OBJECT_TYPE WORKSPACE_OBJECT_ID"
+	cmd.Short = `Get workspace object permission levels.`
+	cmd.Long = `Get workspace object permission levels.
+  
+  Gets the permission levels that a user can have on an object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionLevelsReq.WorkspaceObjectType = args[0]
+		getPermissionLevelsReq.WorkspaceObjectId = args[1]
+
+		response, err := w.Workspace.GetPermissionLevels(ctx, getPermissionLevelsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionLevelsOverrides {
+		fn(cmd, &getPermissionLevelsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissionLevels())
+	})
+}
+
+// start get-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var getPermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.GetWorkspaceObjectPermissionsRequest,
+)
+
+func newGetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var getPermissionsReq workspace.GetWorkspaceObjectPermissionsRequest
+
+	// TODO: short flags
+
+	cmd.Use = "get-permissions WORKSPACE_OBJECT_TYPE WORKSPACE_OBJECT_ID"
+	cmd.Short = `Get workspace object permissions.`
+	cmd.Long = `Get workspace object permissions.
+  
+  Gets the permissions of a workspace object. Workspace objects can inherit
+  permissions from their parent objects or root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		getPermissionsReq.WorkspaceObjectType = args[0]
+		getPermissionsReq.WorkspaceObjectId = args[1]
+
+		response, err := w.Workspace.GetPermissions(ctx, getPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range getPermissionsOverrides {
+		fn(cmd, &getPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newGetPermissions())
+	})
+}
+
 // start get-status command
 
 // Slice with functions to override default command behavior.
@@ -507,4 +632,150 @@ func init() {
 	})
 }
 
+// start set-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var setPermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.WorkspaceObjectPermissionsRequest,
+)
+
+func newSetPermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var setPermissionsReq workspace.WorkspaceObjectPermissionsRequest
+	var setPermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&setPermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "set-permissions WORKSPACE_OBJECT_TYPE WORKSPACE_OBJECT_ID"
+	cmd.Short = `Set workspace object permissions.`
+	cmd.Long = `Set workspace object permissions.
+  
+  Sets permissions on a workspace object. Workspace objects can inherit
+  permissions from their parent objects or root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = setPermissionsJson.Unmarshal(&setPermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		setPermissionsReq.WorkspaceObjectType = args[0]
+		setPermissionsReq.WorkspaceObjectId = args[1]
+
+		response, err := w.Workspace.SetPermissions(ctx, setPermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range setPermissionsOverrides {
+		fn(cmd, &setPermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newSetPermissions())
+	})
+}
+
+// start update-permissions command
+
+// Slice with functions to override default command behavior.
+// Functions can be added from the `init()` function in manually curated files in this directory.
+var updatePermissionsOverrides []func(
+	*cobra.Command,
+	*workspace.WorkspaceObjectPermissionsRequest,
+)
+
+func newUpdatePermissions() *cobra.Command {
+	cmd := &cobra.Command{}
+
+	var updatePermissionsReq workspace.WorkspaceObjectPermissionsRequest
+	var updatePermissionsJson flags.JsonFlag
+
+	// TODO: short flags
+	cmd.Flags().Var(&updatePermissionsJson, "json", `either inline JSON string or @path/to/file.json with request body`)
+
+	// TODO: array: access_control_list
+
+	cmd.Use = "update-permissions WORKSPACE_OBJECT_TYPE WORKSPACE_OBJECT_ID"
+	cmd.Short = `Update workspace object permissions.`
+	cmd.Long = `Update workspace object permissions.
+  
+  Updates the permissions on a workspace object. Workspace objects can inherit
+  permissions from their parent objects or root object.`
+
+	cmd.Annotations = make(map[string]string)
+
+	cmd.Args = func(cmd *cobra.Command, args []string) error {
+		check := cobra.ExactArgs(2)
+		return check(cmd, args)
+	}
+
+	cmd.PreRunE = root.MustWorkspaceClient
+	cmd.RunE = func(cmd *cobra.Command, args []string) (err error) {
+		ctx := cmd.Context()
+		w := root.WorkspaceClient(ctx)
+
+		if cmd.Flags().Changed("json") {
+			err = updatePermissionsJson.Unmarshal(&updatePermissionsReq)
+			if err != nil {
+				return err
+			}
+		}
+		updatePermissionsReq.WorkspaceObjectType = args[0]
+		updatePermissionsReq.WorkspaceObjectId = args[1]
+
+		response, err := w.Workspace.UpdatePermissions(ctx, updatePermissionsReq)
+		if err != nil {
+			return err
+		}
+		return cmdio.Render(ctx, response)
+	}
+
+	// Disable completions since they are not applicable.
+	// Can be overridden by manual implementation in `override.go`.
+	cmd.ValidArgsFunction = cobra.NoFileCompletions
+
+	// Apply optional overrides to this command.
+	for _, fn := range updatePermissionsOverrides {
+		fn(cmd, &updatePermissionsReq)
+	}
+
+	return cmd
+}
+
+func init() {
+	cmdOverrides = append(cmdOverrides, func(cmd *cobra.Command) {
+		cmd.AddCommand(newUpdatePermissions())
+	})
+}
+
 // end service Workspace
diff --git a/go.mod b/go.mod
index 9534a4c9d..7e24b0db2 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.21
 
 require (
 	github.com/briandowns/spinner v1.23.0 // Apache 2.0
-	github.com/databricks/databricks-sdk-go v0.14.1 // Apache 2.0
+	github.com/databricks/databricks-sdk-go v0.19.0 // Apache 2.0
 	github.com/fatih/color v1.15.0 // MIT
 	github.com/ghodss/yaml v1.0.0 // MIT + NOTICE
 	github.com/google/uuid v1.3.0 // BSD-3-Clause
@@ -32,7 +32,7 @@ require (
 )
 
 require (
-	cloud.google.com/go/compute v1.20.1 // indirect
+	cloud.google.com/go/compute v1.23.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
@@ -42,7 +42,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
+	github.com/google/s2a-go v0.1.5 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -54,10 +54,10 @@ require (
 	golang.org/x/net v0.14.0 // indirect
 	golang.org/x/sys v0.11.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/api v0.131.0 // indirect
+	google.golang.org/api v0.138.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
-	google.golang.org/grpc v1.56.2 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 // indirect
+	google.golang.org/grpc v1.57.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index b8c90e5e6..83bb01b62 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
-cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
+cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
+cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -36,8 +36,8 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/databricks/databricks-sdk-go v0.14.1 h1:s9x18c2i6XbJxem6zKdTrrwEUXQX/Nzn0iVM+qGlRus=
-github.com/databricks/databricks-sdk-go v0.14.1/go.mod h1:0iuEtPIoD6oqw7OuFbPskhlEryt2FPH+Ies1UYiiDy8=
+github.com/databricks/databricks-sdk-go v0.19.0 h1:Xh5A90/+8ehW7fTqoQbQK5xZu7a/akv3Xwv8UdWB4GU=
+github.com/databricks/databricks-sdk-go v0.19.0/go.mod h1:Bt/3i3ry/rQdE6Y+psvkAENlp+LzJHaQK5PsLIstQb4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -93,8 +93,8 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
-github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/s2a-go v0.1.5 h1:8IYp3w9nysqv3JH+NJgXJzGbDHzLOTj43BmSkp+O7qg=
+github.com/google/s2a-go v0.1.5/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -257,8 +257,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.131.0 h1:AcgWS2edQ4chVEt/SxgDKubVu/9/idCJy00tBGuGB4M=
-google.golang.org/api v0.131.0/go.mod h1:7vtkbKv2REjJbxmHSkBTBQ5LUGvPdAqjjvt84XAfhpA=
+google.golang.org/api v0.138.0 h1:K/tVp05MxNVbHShRw9m7e9VJGdagNeTdMzqPH7AUqr0=
+google.golang.org/api v0.138.0/go.mod h1:4xyob8CxC+0GChNBvEUAk8VBKNvYOTWM9T3v3UfRxuY=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
@@ -267,8 +267,8 @@ google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoA
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 h1:2FZP5XuJY9zQyGM5N0rtovnoXjiMUEIUMvw0m9wlpLc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 h1:wukfNtZmZUurLN/atp2hiIeTKn7QJWIQdHzqmsOnAOk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
@@ -277,8 +277,8 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.56.2 h1:fVRFRnXvU+x6C4IlHZewvJOVHoOv1TUuQyoRsYnB4bI=
-google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/internal/fs_mkdir_test.go b/internal/fs_mkdir_test.go
index 83417c136..25117d532 100644
--- a/internal/fs_mkdir_test.go
+++ b/internal/fs_mkdir_test.go
@@ -112,6 +112,6 @@ func TestAccFsMkdirWhenFileExistsAtPath(t *testing.T) {
 	// assert run fails
 	_, _, err = RequireErrorRun(t, "fs", "mkdir", "dbfs:"+path.Join(tmpDir, "hello"))
 	// Different cloud providers return different errors.
-	regex := regexp.MustCompile(`^Path is a file: .*$|^Cannot create directory .* because .* is an existing file\.$|^mkdirs\(hadoopPath: .*, permission: rwxrwxrwx\): failed$`)
+	regex := regexp.MustCompile(`(^|: )Path is a file: .*$|(^|: )Cannot create directory .* because .* is an existing file\.$|(^|: )mkdirs\(hadoopPath: .*, permission: rwxrwxrwx\): failed$`)
 	assert.Regexp(t, regex, err.Error())
 }
diff --git a/internal/sync_test.go b/internal/sync_test.go
index 66b5fd3ca..bc1cbd914 100644
--- a/internal/sync_test.go
+++ b/internal/sync_test.go
@@ -159,7 +159,7 @@ func (a *syncTest) remoteFileContent(ctx context.Context, relativePath string, e
 
 	var res []byte
 	a.c.Eventually(func() bool {
-		err = apiClient.Do(ctx, http.MethodGet, urlPath, nil, &res)
+		err = apiClient.Do(ctx, http.MethodGet, urlPath, nil, nil, &res)
 		require.NoError(a.t, err)
 		actualContent := string(res)
 		return actualContent == expectedContent
diff --git a/libs/auth/service_principal.go b/libs/auth/service_principal.go
index a6740b503..cb488d16e 100644
--- a/libs/auth/service_principal.go
+++ b/libs/auth/service_principal.go
@@ -1,20 +1,15 @@
 package auth
 
 import (
-	"context"
-
-	"github.com/databricks/databricks-sdk-go"
-	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/google/uuid"
 )
 
 // Determines whether a given user id is a service principal.
-// This function uses a heuristic: if no user exists with this id, we assume
-// it's a service principal. Unfortunately, the standard service principal API is too
-// slow for our purposes.
-func IsServicePrincipal(ctx context.Context, ws *databricks.WorkspaceClient, userId string) (bool, error) {
-	_, err := ws.Users.GetById(ctx, userId)
-	if apierr.IsMissing(err) {
-		return true, nil
-	}
-	return false, err
+// This function uses a heuristic: if the user id is a UUID, then we assume
+// it's a service principal. Unfortunately, the service principal listing API is too
+// slow for our purposes. And the "users" and "service principals get" APIs
+// only allow access by workspace admins.
+func IsServicePrincipal(userId string) bool {
+	_, err := uuid.Parse(userId)
+	return err == nil
 }
diff --git a/libs/auth/service_principal_test.go b/libs/auth/service_principal_test.go
new file mode 100644
index 000000000..95e8ab5cb
--- /dev/null
+++ b/libs/auth/service_principal_test.go
@@ -0,0 +1,19 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsServicePrincipal_ValidUUID(t *testing.T) {
+	userId := "8b948b2e-d2b5-4b9e-8274-11b596f3b652"
+	isSP := IsServicePrincipal(userId)
+	assert.True(t, isSP, "Expected user ID to be recognized as a service principal")
+}
+
+func TestIsServicePrincipal_InvalidUUID(t *testing.T) {
+	userId := "invalid"
+	isSP := IsServicePrincipal(userId)
+	assert.False(t, isSP, "Expected user ID to not be recognized as a service principal")
+}
diff --git a/libs/filer/files_client.go b/libs/filer/files_client.go
index 285338b66..17884d573 100644
--- a/libs/filer/files_client.go
+++ b/libs/filer/files_client.go
@@ -104,11 +104,8 @@ func (w *FilesClient) Write(ctx context.Context, name string, reader io.Reader,
 
 	overwrite := slices.Contains(mode, OverwriteIfExists)
 	urlPath = fmt.Sprintf("%s?overwrite=%t", urlPath, overwrite)
-	err = w.apiClient.Do(ctx, http.MethodPut, urlPath, reader, nil,
-		func(r *http.Request) error {
-			r.Header.Set("Content-Type", "application/octet-stream")
-			return nil
-		})
+	headers := map[string]string{"Content-Type": "application/octet-stream"}
+	err = w.apiClient.Do(ctx, http.MethodPut, urlPath, headers, reader, nil)
 
 	// Return early on success.
 	if err == nil {
@@ -136,7 +133,7 @@ func (w *FilesClient) Read(ctx context.Context, name string) (io.ReadCloser, err
 	}
 
 	var buf bytes.Buffer
-	err = w.apiClient.Do(ctx, http.MethodGet, urlPath, nil, &buf)
+	err = w.apiClient.Do(ctx, http.MethodGet, urlPath, nil, nil, &buf)
 
 	// Return early on success.
 	if err == nil {
@@ -168,7 +165,7 @@ func (w *FilesClient) Delete(ctx context.Context, name string, mode ...DeleteMod
 		return CannotDeleteRootError{}
 	}
 
-	err = w.apiClient.Do(ctx, http.MethodDelete, urlPath, nil, nil)
+	err = w.apiClient.Do(ctx, http.MethodDelete, urlPath, nil, nil, nil)
 
 	// Return early on success.
 	if err == nil {
@@ -210,11 +207,7 @@ func (w *FilesClient) Stat(ctx context.Context, name string) (fs.FileInfo, error
 		return nil, err
 	}
 
-	err = w.apiClient.Do(ctx, http.MethodHead, urlPath, nil, nil,
-		func(r *http.Request) error {
-			r.Header.Del("Content-Type")
-			return nil
-		})
+	err = w.apiClient.Do(ctx, http.MethodHead, urlPath, nil, nil, nil)
 
 	// If the HEAD requests succeeds, the file exists.
 	if err == nil {
diff --git a/libs/filer/workspace_files_client.go b/libs/filer/workspace_files_client.go
index ed4ad7a2b..41e35d9d1 100644
--- a/libs/filer/workspace_files_client.go
+++ b/libs/filer/workspace_files_client.go
@@ -115,7 +115,7 @@ func (w *WorkspaceFilesClient) Write(ctx context.Context, name string, reader io
 		return err
 	}
 
-	err = w.apiClient.Do(ctx, http.MethodPost, urlPath, body, nil)
+	err = w.apiClient.Do(ctx, http.MethodPost, urlPath, nil, body, nil)
 
 	// Return early on success.
 	if err == nil {
diff --git a/libs/jsonschema/extension.go b/libs/jsonschema/extension.go
new file mode 100644
index 000000000..bbbde695b
--- /dev/null
+++ b/libs/jsonschema/extension.go
@@ -0,0 +1,14 @@
+package jsonschema
+
+// Extension defines our custom JSON schema extensions.
+//
+// JSON schema supports custom extensions through vocabularies:
+// https://json-schema.org/understanding-json-schema/reference/schema.html#vocabularies.
+// We don't (yet?) define a meta-schema for the extensions below.
+// It's not a big issue because the reach/scope of these extensions is limited.
+type Extension struct {
+	// Order defines the order of a field with respect to other fields.
+	// If not defined, the field is ordered alphabetically after all fields
+	// that do have an order defined.
+	Order *int `json:"order,omitempty"`
+}
diff --git a/libs/jsonschema/schema.go b/libs/jsonschema/schema.go
index c0d1736c1..87e9acd56 100644
--- a/libs/jsonschema/schema.go
+++ b/libs/jsonschema/schema.go
@@ -40,6 +40,9 @@ type Schema struct {
 
 	// Default value for the property / object
 	Default any `json:"default,omitempty"`
+
+	// Extension embeds our custom JSON schema extensions.
+	Extension
 }
 
 type Type string
diff --git a/libs/jsonschema/schema_order.go b/libs/jsonschema/schema_order.go
new file mode 100644
index 000000000..3bc3e7d00
--- /dev/null
+++ b/libs/jsonschema/schema_order.go
@@ -0,0 +1,57 @@
+package jsonschema
+
+import (
+	"slices"
+	"strings"
+)
+
+// Property defines a single property of a struct schema.
+// This type is not used in the schema itself but rather to
+// return the pair of a property name and its schema.
+type Property struct {
+	Name   string
+	Schema *Schema
+}
+
+// OrderedProperties returns the properties of the schema ordered according
+// to the value of their `order` extension. If this extension is not set, the
+// properties are ordered alphabetically.
+func (s *Schema) OrderedProperties() []Property {
+	order := make(map[string]*int)
+	out := make([]Property, 0, len(s.Properties))
+	for key, property := range s.Properties {
+		order[key] = property.Order
+		out = append(out, Property{
+			Name:   key,
+			Schema: property,
+		})
+	}
+
+	// Sort the properties by order and then by name.
+	slices.SortFunc(out, func(a, b Property) int {
+		oa := order[a.Name]
+		ob := order[b.Name]
+		cmp := 0
+		switch {
+		case oa != nil && ob != nil:
+			// Compare the order values if both are set.
+			cmp = *oa - *ob
+		case oa == nil && ob != nil:
+			// If only one is set, the one that is set comes first.
+			cmp = 1
+		case oa != nil && ob == nil:
+			// If only one is set, the one that is set comes first.
+			cmp = -1
+		}
+
+		// If we have a non-zero comparison, return it.
+		if cmp != 0 {
+			return cmp
+		}
+
+		// If the order is the same, compare by name.
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	return out
+}
diff --git a/libs/jsonschema/schema_order_test.go b/libs/jsonschema/schema_order_test.go
new file mode 100644
index 000000000..56d4d6355
--- /dev/null
+++ b/libs/jsonschema/schema_order_test.go
@@ -0,0 +1,60 @@
+package jsonschema
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestOrderedProperties(t *testing.T) {
+	newInt := func(i int) *int {
+		return &i
+	}
+
+	s := Schema{
+		Properties: map[string]*Schema{
+			"bbb": {
+				Type: StringType,
+			},
+			"ccc": {
+				Type: StringType,
+			},
+			"ddd": {
+				Type: StringType,
+			},
+			"zzz1": {
+				Type: StringType,
+				Extension: Extension{
+					Order: newInt(-1),
+				},
+			},
+			"zzz2": {
+				Type: StringType,
+				Extension: Extension{
+					Order: newInt(-2),
+				},
+			},
+			"aaa1": {
+				Type: StringType,
+				Extension: Extension{
+					Order: newInt(1),
+				},
+			},
+			"aaa2": {
+				Type: StringType,
+				Extension: Extension{
+					Order: newInt(2),
+				},
+			},
+		},
+	}
+
+	// Test that the properties are ordered by order and then by name.
+	properties := s.OrderedProperties()
+	names := make([]string, len(properties))
+	for i, property := range properties {
+		names[i] = property.Name
+	}
+
+	assert.Equal(t, []string{"zzz2", "zzz1", "aaa1", "aaa2", "bbb", "ccc", "ddd"}, names)
+}
diff --git a/libs/template/config.go b/libs/template/config.go
index 302a13619..8a1ed6c82 100644
--- a/libs/template/config.go
+++ b/libs/template/config.go
@@ -117,7 +117,10 @@ func (c *config) assignDefaultValues() error {
 
 // Prompts user for values for properties that do not have a value set yet
 func (c *config) promptForValues() error {
-	for name, property := range c.schema.Properties {
+	for _, p := range c.schema.OrderedProperties() {
+		name := p.Name
+		property := p.Schema
+
 		// Config already has a value assigned
 		if _, ok := c.values[name]; ok {
 			continue
diff --git a/libs/template/helpers.go b/libs/template/helpers.go
index f947d9ba8..29abbe21c 100644
--- a/libs/template/helpers.go
+++ b/libs/template/helpers.go
@@ -104,10 +104,7 @@ func loadHelpers(ctx context.Context) template.FuncMap {
 					return false, err
 				}
 			}
-			result, err := auth.IsServicePrincipal(ctx, w, user.Id)
-			if err != nil {
-				return false, err
-			}
+			result := auth.IsServicePrincipal(user.Id)
 			is_service_principal = &result
 			return result, nil
 		},
diff --git a/libs/template/templates/default-python/databricks_template_schema.json b/libs/template/templates/default-python/databricks_template_schema.json
index b680c5fbb..3220e9a6f 100644
--- a/libs/template/templates/default-python/databricks_template_schema.json
+++ b/libs/template/templates/default-python/databricks_template_schema.json
@@ -3,7 +3,7 @@
         "project_name": {
             "type": "string",
             "default": "my_project",
-            "description": "Name of the directory"
+            "description": "Unique name for this project"
         }
     }
 }
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/.gitignore b/libs/template/templates/default-python/template/{{.project_name}}/.gitignore
new file mode 100644
index 000000000..aa87f0198
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/.gitignore
@@ -0,0 +1,9 @@
+
+.databricks/
+build/
+dist/
+__pycache__/
+*.egg-info
+.venv/
+scratch/**
+!scratch/README.md
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/.vscode/__builtins__.pyi b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/__builtins__.pyi
new file mode 100644
index 000000000..0edd5181b
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/__builtins__.pyi
@@ -0,0 +1,3 @@
+# Typings for Pylance in Visual Studio Code
+# see https://github.com/microsoft/pyright/blob/main/docs/builtins.md
+from databricks.sdk.runtime import *
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/.vscode/extensions.json b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/extensions.json
new file mode 100644
index 000000000..5d15eba36
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/extensions.json
@@ -0,0 +1,7 @@
+{
+    "recommendations": [
+        "databricks.databricks",
+        "ms-python.vscode-pylance",
+        "redhat.vscode-yaml"
+    ]
+}
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/.vscode/settings.json b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/settings.json
new file mode 100644
index 000000000..16cb2c96a
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/.vscode/settings.json
@@ -0,0 +1,14 @@
+{
+    "python.analysis.stubPath": ".vscode",
+    "databricks.python.envFile": "${workspaceFolder}/.env",
+    "jupyter.interactiveWindow.cellMarker.codeRegex": "^# COMMAND ----------|^# Databricks notebook source|^(#\\s*%%|#\\s*\\<codecell\\>|#\\s*In\\[\\d*?\\]|#\\s*In\\[ \\])",
+    "jupyter.interactiveWindow.cellMarker.default": "# COMMAND ----------",
+    "python.testing.pytestArgs": [
+        "."
+    ],
+    "python.testing.unittestEnabled": false,
+    "python.testing.pytestEnabled": true,
+    "files.exclude": {
+        "**/*.egg-info": true
+    },
+}
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/README.md b/libs/template/templates/default-python/template/{{.project_name}}/README.md
deleted file mode 100644
index 3187b9ed0..000000000
--- a/libs/template/templates/default-python/template/{{.project_name}}/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# {{.project_name}}
-
-The '{{.project_name}}' bundle was generated using the default-python template.
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/README.md.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/README.md.tmpl
new file mode 100644
index 000000000..4c89435b4
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/README.md.tmpl
@@ -0,0 +1,37 @@
+# {{.project_name}}
+
+The '{{.project_name}}' project was generated by using the default-python template.
+
+## Getting started
+
+1. Install the Databricks CLI from https://docs.databricks.com/dev-tools/cli/databricks-cli.html
+
+2. Authenticate to your Databricks workspace:
+    ```
+    $ databricks configure
+    ```
+
+3. To deploy a development copy of this project, type:
+    ```
+    $ databricks bundle deploy --target dev
+    ```
+    (Note that "dev" is the default target, so the `--target` parameter
+    is optional here.)
+
+    This deploys everything that's defined for this project.
+    For example, the default template would deploy a job called
+    `[dev yourname] {{.project_name}}-job` to your workspace.
+    You can find that job by opening your workpace and clicking on **Workflows**.
+
+4. Similarly, to deploy a production copy, type:
+   ```
+   $ databricks bundle deploy --target prod
+   ```
+
+5. Optionally, install developer tools such as the Databricks extension for Visual Studio Code from
+   https://docs.databricks.com/dev-tools/vscode-ext.html. Or read the "getting started" documentation for
+   **Databricks Connect** for instructions on running the included Python code from a different IDE.
+
+6. For documentation on the Databricks asset bundles format used
+   for this project, and for CI/CD configuration, see
+   https://docs.databricks.com/dev-tools/bundles/index.html.
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/databricks.yml.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/databricks.yml.tmpl
new file mode 100644
index 000000000..48aef0ea3
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/databricks.yml.tmpl
@@ -0,0 +1,52 @@
+# This is a Databricks asset bundle definition for {{.project_name}}.
+# See https://docs.databricks.com/dev-tools/bundles/index.html for documentation.
+bundle:
+  name: {{.project_name}}
+
+include:
+  - resources/*.yml
+
+targets:
+  # The 'dev' target, used development purposes.
+  # Whenever a developer deploys using 'dev', they get their own copy.
+  dev:
+    # We use 'mode: development' to make everything deployed to this target gets a prefix
+    # like '[dev my_user_name]'. Setting this mode also disables any schedules and
+    # automatic triggers for jobs and enables the 'development' mode for Delta Live Tables pipelines.
+    mode: development
+    default: true
+    workspace:
+      host: {{workspace_host}}
+
+  # Optionally, there could be a 'staging' target here.
+  # (See Databricks docs on CI/CD at https://docs.databricks.com/dev-tools/bundles/index.html.)
+  #
+  # staging:
+  #  workspace:
+  #    host: {{workspace_host}}
+
+  # The 'prod' target, used for production deployment.
+  prod:
+    # For production deployments, we only have a single copy, so we override the
+    # workspace.root_path default of
+    # /Users/${workspace.current_user.userName}/.bundle/${bundle.target}/${bundle.name}
+    # to a path that is not specific to the current user.
+    {{- /*
+    Explaining 'mode: production' isn't as pressing as explaining 'mode: development'.
+    As we already talked about the other mode above, users can just
+    look at documentation or ask the assistant about 'mode: production'.
+    #
+    # By making use of 'mode: production' we enable strict checks
+    # to make sure we have correctly configured this target.
+    */}}
+    mode: production
+    workspace:
+      host: {{workspace_host}}
+      root_path: /Shared/.bundle/prod/${bundle.name}
+    {{- if not is_service_principal}}
+    run_as:
+      # This runs as {{user_name}} in production. Alternatively,
+      # a service principal could be used here using service_principal_name
+      # (see Databricks documentation).
+      user_name: {{user_name}}
+    {{end -}}
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/fixtures/.gitkeep.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/fixtures/.gitkeep.tmpl
new file mode 100644
index 000000000..361c681f9
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/fixtures/.gitkeep.tmpl
@@ -0,0 +1,27 @@
+# Fixtures
+{{- /*
+We don't want to have too many README.md files, since they
+stand out so much. But we do need to have a file here to make
+sure the folder is added to Git.
+*/}}
+
+This folder is reserved for fixtures, such as CSV files.
+
+Below is an example of how to load fixtures as a data frame:
+
+```
+import pandas as pd
+import os
+
+def get_absolute_path(*relative_parts):
+    if 'dbutils' in globals():
+        base_dir = os.path.dirname(dbutils.notebook.entry_point.getDbutils().notebook().getContext().notebookPath().get()) # type: ignore
+        path = os.path.normpath(os.path.join(base_dir, *relative_parts))
+        return path if path.startswith("/Workspace") else os.path.join("/Workspace", path)
+    else:
+        return os.path.join(*relative_parts)
+
+csv_file = get_absolute_path("..", "fixtures", "mycsv.csv")
+df = pd.read_csv(csv_file)
+display(df)
+```
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/pytest.ini b/libs/template/templates/default-python/template/{{.project_name}}/pytest.ini
new file mode 100644
index 000000000..80432c220
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/pytest.ini
@@ -0,0 +1,3 @@
+[pytest]
+testpaths = tests
+pythonpath = src
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/resources/{{.project_name}}_job.yml.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/resources/{{.project_name}}_job.yml.tmpl
new file mode 100644
index 000000000..f8116cdfc
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/resources/{{.project_name}}_job.yml.tmpl
@@ -0,0 +1,42 @@
+# The main job for {{.project_name}}
+resources:
+
+  jobs:
+    {{.project_name}}_job:
+      name: {{.project_name}}_job
+
+      schedule:
+        quartz_cron_expression: '44 37 8 * * ?'
+        timezone_id: Europe/Amsterdam
+
+      {{- if not is_service_principal}}
+      email_notifications:
+        on_failure:
+          - {{user_name}}
+      {{end -}}
+
+      tasks:
+        - task_key: notebook_task
+          job_cluster_key: job_cluster
+          notebook_task:
+            notebook_path: ../src/notebook.ipynb
+
+        - task_key: python_wheel_task
+          depends_on:
+            - task_key: notebook_task
+          job_cluster_key: job_cluster
+          python_wheel_task:
+            package_name: {{.project_name}}
+            entry_point: main
+          libraries:
+            - whl: ../dist/*.whl
+
+      job_clusters:
+        - job_cluster_key: job_cluster
+          new_cluster:
+            {{- /* we should always use an LTS version in our templates */}}
+            spark_version: 13.3.x-scala2.12
+            node_type_id: {{smallest_node_type}}
+            autoscale:
+                min_workers: 1
+                max_workers: 4
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/scratch/README.md b/libs/template/templates/default-python/template/{{.project_name}}/scratch/README.md
new file mode 100644
index 000000000..e6cfb81b4
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/scratch/README.md
@@ -0,0 +1,4 @@
+# scratch
+
+This folder is reserved for personal, exploratory notebooks.
+By default these are not committed to Git, as 'scratch' is listed in .gitignore.
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/scratch/exploration.ipynb b/libs/template/templates/default-python/template/{{.project_name}}/scratch/exploration.ipynb
new file mode 100644
index 000000000..2ee36c3c1
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/scratch/exploration.ipynb
@@ -0,0 +1,50 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {
+      "byteLimit": 2048000,
+      "rowLimit": 10000
+     },
+     "inputWidgets": {},
+     "nuid": "6bca260b-13d1-448f-8082-30b60a85c9ae",
+     "showTitle": false,
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "import sys\n",
+    "sys.path.append('../src')\n",
+    "from project import main\n",
+    "\n",
+    "main.taxis.show(10)"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "dashboards": [],
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "ipynb-notebook",
+   "widgets": {}
+  },
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3.11.4"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/setup.py.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/setup.py.tmpl
new file mode 100644
index 000000000..93f4e9ff9
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/setup.py.tmpl
@@ -0,0 +1,24 @@
+"""
+Setup script for {{.project_name}}.
+
+This script packages and distributes the associated wheel file(s).
+Source code is in ./src/. Run 'python setup.py sdist bdist_wheel' to build.
+"""
+from setuptools import setup, find_packages
+
+import sys
+sys.path.append('./src')
+
+import {{.project_name}}
+
+setup(
+    name="{{.project_name}}",
+    version={{.project_name}}.__version__,
+    url="https://databricks.com",
+    author="{{.user_name}}",
+    description="my test wheel",
+    packages=find_packages(where='./src'),
+    package_dir={'': 'src'},
+    entry_points={"entry_points": "main={{.project_name}}.main:main"},
+    install_requires=["setuptools"],
+)
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/src/notebook.ipynb.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/src/notebook.ipynb.tmpl
new file mode 100644
index 000000000..26c743032
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/src/notebook.ipynb.tmpl
@@ -0,0 +1,65 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {},
+     "inputWidgets": {},
+     "nuid": "ee353e42-ff58-4955-9608-12865bd0950e",
+     "showTitle": false,
+     "title": ""
+    }
+   },
+   "source": [
+    "# Default notebook\n",
+    "\n",
+    "This default notebook is executed using Databricks Workflows as defined in resources/{{.my_project}}_job.yml."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 0,
+   "metadata": {
+    "application/vnd.databricks.v1+cell": {
+     "cellMetadata": {
+      "byteLimit": 2048000,
+      "rowLimit": 10000
+     },
+     "inputWidgets": {},
+     "nuid": "6bca260b-13d1-448f-8082-30b60a85c9ae",
+     "showTitle": false,
+     "title": ""
+    }
+   },
+   "outputs": [],
+   "source": [
+    "from {{.project_name}} import main\n",
+    "\n",
+    "main.get_taxis().show(10)\n"
+   ]
+  }
+ ],
+ "metadata": {
+  "application/vnd.databricks.v1+notebook": {
+   "dashboards": [],
+   "language": "python",
+   "notebookMetadata": {
+    "pythonIndentUnit": 2
+   },
+   "notebookName": "notebook",
+   "widgets": {}
+  },
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3.11.4"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 0
+}
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/__init__.py b/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/__init__.py
new file mode 100644
index 000000000..f102a9cad
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/__init__.py
@@ -0,0 +1 @@
+__version__ = "0.0.1"
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl
new file mode 100644
index 000000000..4fe5ac8f4
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/src/{{.project_name}}/main.py.tmpl
@@ -0,0 +1,16 @@
+{{- /*
+We use pyspark.sql rather than DatabricksSession.builder.getOrCreate()
+for compatibility with older runtimes. With a new runtime, it's
+equivalent to DatabricksSession.builder.getOrCreate().
+*/ -}}
+from pyspark.sql import SparkSession
+
+def get_taxis():
+  spark = SparkSession.builder.getOrCreate()
+  return spark.read.table("samples.nyctaxi.trips")
+
+def main():
+  get_taxis().show(5)
+
+if __name__ == '__main__':
+  main()
diff --git a/libs/template/templates/default-python/template/{{.project_name}}/tests/main_test.py.tmpl b/libs/template/templates/default-python/template/{{.project_name}}/tests/main_test.py.tmpl
new file mode 100644
index 000000000..92afccc6c
--- /dev/null
+++ b/libs/template/templates/default-python/template/{{.project_name}}/tests/main_test.py.tmpl
@@ -0,0 +1,5 @@
+from {{.project_name}} import main
+
+def test_main():
+    taxis = main.get_taxis()
+    assert taxis.count() == 5