@@ -68,6 +68,11 @@ func convertSecretAclNameToScopeKey(name string) string {
 	return "resources.secret_scopes." + name + ".permissions"
 }
 
+// isCreateDeleteMix returns true if one action is Create and the other is Delete (in either order).
+func isCreateDeleteMix(a, b deployplan.ActionType) bool {
+	return (a == deployplan.Create && b == deployplan.Delete) || (a == deployplan.Delete && b == deployplan.Create)
+}
+
 // populatePlan populates a deployplan.Plan from Terraform resource changes.
 func populatePlan(ctx context.Context, plan *deployplan.Plan, changes []*tfjson.ResourceChange) {
 	for _, rc := range changes {
@@ -110,7 +115,12 @@ func populatePlan(ctx context.Context, plan *deployplan.Plan, changes []*tfjson.
 		}
 
 		if existing, ok := plan.Plan[key]; ok {
-			existing.Action = deployplan.GetHigherAction(existing.Action, actionType)
+			// For secret ACLs, mixed create+delete means the permissions are being updated, not deleted.
+			if group == "secret_acls" && isCreateDeleteMix(existing.Action, actionType) {
+				existing.Action = deployplan.Update
+			} else {
+				existing.Action = deployplan.GetHigherAction(existing.Action, actionType)
+			}
 		} else {
 			plan.Plan[key] = &deployplan.PlanEntry{Action: actionType}
 		}
 
@@ -101,6 +101,29 @@ func TestPopulatePlanSecretAcl(t *testing.T) {
 	}, plan.Plan)
 }
 
+func TestPopulatePlanSecretAclMixedCreateDelete(t *testing.T) {
+	ctx := t.Context()
+	changes := []*tfjson.ResourceChange{
+		{
+			Type:   "databricks_secret_acl",
+			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionDelete}},
+			Name:   "secret_acl_my_scope_0",
+		},
+		{
+			Type:   "databricks_secret_acl",
+			Change: &tfjson.Change{Actions: tfjson.Actions{tfjson.ActionCreate}},
+			Name:   "secret_acl_my_scope_1",
+		},
+	}
+
+	plan := deployplan.NewPlanTerraform()
+	populatePlan(ctx, plan, changes)
+
+	assert.Equal(t, map[string]*deployplan.PlanEntry{
+		"resources.secret_scopes.my_scope.permissions": {Action: deployplan.Update},
+	}, plan.Plan)
+}
+
 func TestConvertSecretAclNameToScopeKey(t *testing.T) {
 	assert.Equal(t, "resources.secret_scopes.my_scope.permissions", convertSecretAclNameToScopeKey("secret_acl_my_scope_0"))
 	assert.Equal(t, "resources.secret_scopes.my_scope.permissions", convertSecretAclNameToScopeKey("secret_acl_my_scope_1"))