diff --git a/bundle/config/validate/folder_permissions.go b/bundle/config/validate/folder_permissions.go
index a376bd776c..56d36cfed3 100644
--- a/bundle/config/validate/folder_permissions.go
+++ b/bundle/config/validate/folder_permissions.go
@@ -4,10 +4,9 @@ import (
 	"context"
 	"fmt"
 	"path"
-	"strings"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/libraries"
+	"github.com/databricks/cli/bundle/paths"
 	"github.com/databricks/cli/bundle/permissions"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/apierr"
@@ -24,37 +23,12 @@ func (f *folderPermissions) Apply(ctx context.Context, b bundle.ReadOnlyBundle)
 		return nil
 	}
 
-	rootPath := b.Config().Workspace.RootPath
-	paths := []string{}
-	if !libraries.IsVolumesPath(rootPath) && !libraries.IsWorkspaceSharedPath(rootPath) {
-		paths = append(paths, rootPath)
-	}
-
-	if !strings.HasSuffix(rootPath, "/") {
-		rootPath += "/"
-	}
-
-	for _, p := range []string{
-		b.Config().Workspace.ArtifactPath,
-		b.Config().Workspace.FilePath,
-		b.Config().Workspace.StatePath,
-		b.Config().Workspace.ResourcePath,
-	} {
-		if libraries.IsWorkspaceSharedPath(p) || libraries.IsVolumesPath(p) {
-			continue
-		}
-
-		if strings.HasPrefix(p, rootPath) {
-			continue
-		}
-
-		paths = append(paths, p)
-	}
+	bundlePaths := paths.CollectUniquePaths(b.Config().Workspace)
 
 	var diags diag.Diagnostics
 	g, ctx := errgroup.WithContext(ctx)
-	results := make([]diag.Diagnostics, len(paths))
-	for i, p := range paths {
+	results := make([]diag.Diagnostics, len(bundlePaths))
+	for i, p := range bundlePaths {
 		g.Go(func() error {
 			results[i] = checkFolderPermission(ctx, b, p)
 			return nil
diff --git a/bundle/libraries/path.go b/bundle/libraries/path.go
index 3bad40face..418d9ca73c 100644
--- a/bundle/libraries/path.go
+++ b/bundle/libraries/path.go
@@ -38,6 +38,7 @@ func IsWorkspaceLibrary(library *compute.Library) bool {
 }
 
 // IsVolumesPath returns true if the specified path indicates that
+// it should be interpreted as a Databricks Volumes path.
 func IsVolumesPath(path string) bool {
 	return strings.HasPrefix(path, "/Volumes/")
 }
diff --git a/bundle/paths/paths.go b/bundle/paths/paths.go
new file mode 100644
index 0000000000..c092543e62
--- /dev/null
+++ b/bundle/paths/paths.go
@@ -0,0 +1,39 @@
+package paths
+
+import (
+	"strings"
+
+	"github.com/databricks/cli/bundle/config"
+	"github.com/databricks/cli/bundle/libraries"
+)
+
+func CollectUniquePaths(workspace config.Workspace) []string {
+	rootPath := workspace.RootPath
+	paths := []string{}
+	if !libraries.IsVolumesPath(rootPath) && !libraries.IsWorkspaceSharedPath(rootPath) {
+		paths = append(paths, rootPath)
+	}
+
+	if !strings.HasSuffix(rootPath, "/") {
+		rootPath += "/"
+	}
+
+	for _, p := range []string{
+		workspace.ArtifactPath,
+		workspace.FilePath,
+		workspace.StatePath,
+		workspace.ResourcePath,
+	} {
+		if libraries.IsWorkspaceSharedPath(p) || libraries.IsVolumesPath(p) {
+			continue
+		}
+
+		if strings.HasPrefix(p, rootPath) {
+			continue
+		}
+
+		paths = append(paths, p)
+	}
+
+	return paths
+}
diff --git a/bundle/permissions/workspace_root.go b/bundle/permissions/workspace_root.go
index bd8b0ca5a5..d52c658cd4 100644
--- a/bundle/permissions/workspace_root.go
+++ b/bundle/permissions/workspace_root.go
@@ -3,10 +3,9 @@ package permissions
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"github.com/databricks/cli/bundle"
-	"github.com/databricks/cli/bundle/libraries"
+	"github.com/databricks/cli/bundle/paths"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"golang.org/x/sync/errgroup"
@@ -55,38 +54,10 @@ func giveAccessForWorkspaceRoot(ctx context.Context, b *bundle.Bundle) error {
 	}
 
 	w := b.WorkspaceClient().Workspace
-	rootPath := b.Config.Workspace.RootPath
-	paths := []string{}
-	if !libraries.IsVolumesPath(rootPath) {
-		paths = append(paths, rootPath)
-	}
-
-	if !strings.HasSuffix(rootPath, "/") {
-		rootPath += "/"
-	}
-
-	if !strings.HasPrefix(b.Config.Workspace.ArtifactPath, rootPath) &&
-		!libraries.IsVolumesPath(b.Config.Workspace.ArtifactPath) {
-		paths = append(paths, b.Config.Workspace.ArtifactPath)
-	}
-
-	if !strings.HasPrefix(b.Config.Workspace.FilePath, rootPath) &&
-		!libraries.IsVolumesPath(b.Config.Workspace.FilePath) {
-		paths = append(paths, b.Config.Workspace.FilePath)
-	}
-
-	if !strings.HasPrefix(b.Config.Workspace.StatePath, rootPath) &&
-		!libraries.IsVolumesPath(b.Config.Workspace.StatePath) {
-		paths = append(paths, b.Config.Workspace.StatePath)
-	}
-
-	if !strings.HasPrefix(b.Config.Workspace.ResourcePath, rootPath) &&
-		!libraries.IsVolumesPath(b.Config.Workspace.ResourcePath) {
-		paths = append(paths, b.Config.Workspace.ResourcePath)
-	}
+	bundlePaths := paths.CollectUniquePaths(b.Config.Workspace)
 
 	g, ctx := errgroup.WithContext(ctx)
-	for _, p := range paths {
+	for _, p := range bundlePaths {
 		g.Go(func() error {
 			return setPermissions(ctx, w, p, permissions)
 		})