ABAC for AI agents

Summary

• ABAC (attribute-based access control) extends data governance policies to AI agents in real time through Unity Catalog, using governed tags to dynamically control access to data and model invocations.
• Agents inherit the permission context of the user who invokes them, so row filters, column masks, and privilege denials apply at SQL query execution regardless of which AI service issues the query.
• Four policy types (row filters, column masks, GRANT, and DENY) enforce governance consistently across new assets the moment they're tagged, without per-object configuration.
• Databricks ABAC for AI reached general availability in April 2026, with GRANT policies for model invocations in Beta as of June 2026, enabling organizations to scale AI governance to unlimited agents and users.

ABAC for AI agents

ABAC (attribute-based access control) makes it possible to govern AI agents using the same data policies you define for humans without creating permission silos. Agents acting on behalf of a user automatically inherit that user's row filters, column masks, and privilege denials at the SQL engine level. This prevents agents from becoming over-permissioned points of compromise while still giving them the exact level of access the user would have.

What is ABAC?

Attribute-based access control attaches fine-grained policies to data and models using governed tags. Instead of granting permissions on individual objects, you define rules that apply automatically to anything matching those tags. When you tag a table data_classification: sensitive, a column-mask policy on that tag applies to every column in the table instantly, without manual configuration. New tables inherit the same governance the moment you tag them.

Key capabilities to evaluate

Capability	Why it matters
Row filtering	Agents see only rows matching the user's attributes (e.g., only their region's data). Prevents over-exposure of sensitive subsets.
Column masking	Sensitive columns are obscured unless the user belongs to an approved group. Applies automatically at query time.
Dynamic privilege grants	GRANT policies can automatically authorize agents to invoke specific models or tools based on user attributes, without hard-coded role assignments.
Explicit denials	DENY policies (Beta) block certain operations: an agent can't invoke a tool, or a model can't access a table, regardless of other grants.
Enforcement at the SQL layer	Policies fire at the database engine, not in the application. No agent can bypass governance through a different query path or API.

How Databricks approaches ABAC for AI agents

Databricks implements ABAC through Unity Catalog, which extends governance from data into AI. When an agent operates on behalf of a user using on-behalf-of (OBO) authentication, the user's identity flows end-to-end. Unity Catalog evaluates each agent query against the user's row filters and column masks, applying them before results return.
The four policy types are:

1. Row filter policies: Restrict which rows the agent can retrieve from a table.
2. Column mask policies: Control how column values are presented (redacting, hashing, or replacing sensitive data).
3. GRANT policies: Automatically authorize agents to invoke models or execute tools when they meet tag-based criteria.
4. DENY policies (Beta): Explicitly prevent access, taking precedence over grants.

Policies attach at the catalog, schema, or table level and evaluate automatically whenever an agent queries a tagged object. This means new assets are covered immediately upon tagging. You don't need to reconfigure permissions for each new table or model. It's the same approach that governs humans; agents inherit it by proxy of the user context they run under.
You can read more about implementing ABAC in the Databricks documentation and explore governance patterns for AI in the reference architecture.

Use cases

Financial services: A financial analyst's agent can access transaction data only for its assigned portfolio. A compliance agent can't see customer PII even though it queries the payments table. Column masks automatically redact account numbers in any query.
Healthcare: An agent assisting a clinician sees only patients in that clinician's practice. Masked columns prevent the agent from retrieving raw medical record numbers or billing codes, even if the table contains them.
SaaS platforms: Multi-tenant SaaS providers use ABAC to isolate customer data per tenant automatically. A customer-support agent can only see conversations and usage data for its assigned customers, enforced at the SQL layer.

FAQs

How do agents inherit user permissions?

Agents must authenticate with on-behalf-of (OBO) credentials that carry the invoking user's identity. Unity Catalog checks that identity against all ABAC policies at query time. The agent's own permissions don't matter. Only the user's permissions control access. If the user is denied access to a column, the agent can't retrieve it either.

Can an agent invoke a restricted model?

Yes, if a GRANT policy on that model's tag evaluates to true for the user's attributes. For example, a GRANT policy might allow role: data_scientist to invoke a foundation model while blocking other users. DENY policies (Beta) work the opposite way: they block invocation regardless of other grants.

What happens if a new table is added without tags?

Until you tag the table, no ABAC policies apply to it. It falls back to standard Unity Catalog permissions. Once you apply a tag that matches an active policy, the policy takes effect immediately for all queries.

Does ABAC slow down agent queries?

No. Policies are evaluated at the SQL engine level during query execution, as part of the normal authorization flow. The overhead is equivalent to standard role-based access control.

Is ABAC available for all agent types?

Yes. Row filters, column masks, and DENY policies are GA as of April 2026. GRANT policies for models are in Beta as of June 2026 and work with both customer-registered MLflow models and Databricks foundation models. All policy types apply uniformly to Genie agents, Agent Bricks, custom MCP clients, and notebooks.