How can I grant the Service Principal User role to a user on a specific service principal using the Databricks CLI?
To grant the Service Principal User role to a user on a specific service principal using the Databricks CLI, you can follow these steps:

1. Get the current rule set for the service principal by running the following command:

   ```
   databricks account access-control get-rule-set accounts/<account-id>/servicePrincipals/<application-id>/ruleSets/default <etag>
   ```

   Replace `<account-id>` with the account ID, `<application-id>` with the service principal application ID, and `<etag>` with “”.

2. Copy the `etag` field from the response body for later use.

3. Make updates locally when you decide on the final state of the rules and then update the rule set using the `etag`. To grant the Service Principal User role to the user `user2@example.com`, run the following:

   ```
   databricks account access-control update-rule-set --json '{ "name": "accounts/<account-id>/servicePrincipals/<application-id>/ruleSets/default", "rule_set": { "name": "accounts/<account-id>/servicePrincipals/<application-id>/ruleSets/default", "grant_rules": [ { "role": "roles/servicePrincipal.user", "principals": ["users/user2@example.com"] } ], "etag": "<etag>" } }'
   ```

   Replace `<account-id>` with the account ID, `<application-id>` with the service principal application ID, and `<etag>` with the `etag` that you copied from the last response.

Note: Because this is a PUT method, all existing roles are overwritten. To keep any existing roles, you must add them to the `grant_roles` array.