`bundle plan` perpetually reports `update` on catalog/schema/volume `.grants` sub-resources even when live state is confirmed converged

[carlosalzate74]

Describe the issue

databricks bundle plan consistently reports update actions on every catalog, schema, and volume .grants sub-resource in our bundle, on every single run — including immediately after a clean bundle deploy with no configuration changes since.

Configuration

We've ruled out actual configuration drift through direct verification:

1. Captured databricks grants get catalog <name> --profile <profile> -o json before a deploy.
2. Ran databricks bundle deploy --target <target> --profile <profile>.
3. Captured grants get again immediately after.
4. Compare-Object on the two JSON outputs shows zero difference — live grants state is identical before and after the deploy.
5. Ran bundle plan again anyway — still reports update catalogs.<name>.grants, update schemas.<name>.grants, update volumes.<name>.grants for every grants-bearing resource in the bundle.
6. Deleted the local state snapshot (.databricks/bundle/<target>/resources.json) and redeployed to force a fresh snapshot — behavior unchanged.

This affects all grants-bearing resource types uniformly (catalogs, schemas, volumes), not a specific one, and persists regardless of whether the grants were declared purely via yml or partially applied via manual databricks grants update calls that were later reconciled to match yml exactly.

Steps to reproduce the behavior

1. Define a catalog (or schema/volume) resource with a grants: block in a bundle using engine: direct.
2. databricks bundle deploy --target <target>
3. databricks bundle plan --target <target> — observe update reported for the .grants sub-resource despite no changes.
4. Confirm via databricks grants get <securable_type> <full_name> that live state matches the declared grants exactly.
5. Repeat bundle plan — update persists indefinitely.

Expected behavior
bundle plan should report no pending action for a .grants sub-resource when live state matches the declared configuration and the most recent deployment snapshot.

Actual behavior
.grants sub-resources are always shown as update, regardless of actual state, on every plan invocation.

OS and CLI version

CLI version: 1.8.0
Engine: direct (engine: direct in databricks.yml)
Windows

Is this a regression?

Unknown — we only tested on CLI 1.8.0 (upgraded from 0.299.0 mid-project specifically to gain direct-engine support for catalog/schema resources, which 0.299.0 didn't recognize at all — unknown field: engine warning, no converter for resource type catalogs on bind). We have not tested this specific grants-drift behavior on an earlier direct-engine-capable version, so we can't confirm whether this is a new regression or has been present since direct-engine catalog/grants support was introduced.

Debug Logs

Output logs if you run the command with debug logs enabled. Example: databricks bundle deploy --log-level=debug. Redact if needed