How are AI agents, models, and data sources authenticated and authorized?

Summary

• On Databricks, AI agents, models, tools, and data sources are governed by the same model as your data: Unity Catalog manages models, functions, MCP servers, and connections as securable objects with the same permissions and attribute-based policies applied to tables and volumes.
• Agents authenticate using one of several patterns: an automatically provisioned, least-privilege service principal; on-behalf-of-user (OBO) authentication, where the agent runs as the calling user; or an explicit service principal via OAuth.
• Authorization is enforced consistently: an agent acting on a user's behalf inherits that user's exact permission boundary, and Unity Catalog row filters and column masks apply whether data is accessed by a person or an agent.
• The Unity AI Gateway routes every model and MCP request and enforces rate limits, budgets, usage tracking, and service policies before requests reach external systems.
• Access for external tools uses managed OAuth and Unity Catalog connections, so agents reach systems without exposing raw secrets.

How are AI agents, models, and data sources authenticated and authorized?

Databricks extends the same governance model it uses for data to every AI asset. Authentication establishes who or what is making a request — a user, an agent's service principal, or a user's identity passed through an agent — and authorization is enforced by Unity Catalog, which governs models, functions, MCP servers, and connections as securable objects. On top of that, the Unity AI Gateway controls the traffic itself. The result is that an agent operates inside the same permission boundary as the user it serves.

How authentication and authorization work on the Databricks Platform

• Multiple authentication patterns for agents. Agents can authenticate with an automatically provisioned, least-privilege service principal (for workloads with no per-user access needs), with on-behalf-of-user (OBO) authentication (the agent runs as the calling user), or with an explicit service principal using OAuth for external resources. These patterns can be combined within a single agent.
• On-behalf-of-user identity. With OBO, the human's identity flows from the request through to every downstream data and tool call. In multi-agent systems, that identity propagates to sub-agents, so access checks always see the actual user.
• Unity Catalog as the enforcement engine. Unity Catalog governs models, functions, MCP servers, and connections with the same privileges and attribute-based access control (ABAC) used for tables and volumes. Grant and revoke access with standard SQL privileges.
• The same boundary for people and agents. If a user cannot access a table, a masked column, or a governed view, an agent acting on that user's behalf receives the same boundary. Row filters and column masks apply uniformly whether data is queried through the UI, a SQL tool, or a governed assistant. Each tool still needs its own Unity Catalog grants — permissions do not cascade automatically.
• Traffic governance with Unity AI Gateway. The Unity AI Gateway routes every model and MCP request and enforces rate limits, budgets, usage tracking, and service policies (guardrails) that can allow, deny, or require approval based on the caller's identity and content — before requests reach external systems.
• Secure access to external tools. Databricks provides managed OAuth for external MCP servers and governs them through Unity Catalog connections, so agents reach external systems without exposing raw credentials. MCP on Databricks always enforces Unity Catalog permissions and supports OAuth and personal access token authentication.
• Identity delegated to your provider. Authentication is delegated to your enterprise identity provider, and Databricks trusts that identity for downstream authorization decisions.

Getting started

• Read how AI governance works on Databricks to see how Unity Catalog and the Unity AI Gateway fit together.
• Register models, tools, and connections as Unity Catalog securables and grant access with SQL privileges and ABAC policies.
• Use the Unity AI Gateway to control access to AI services and set rate limits, budgets, and service policies.
• For external tools, connect agents to MCP servers securely with managed OAuth.

FAQs

How does an AI agent authenticate on Databricks?

An agent can use an automatically provisioned least-privilege service principal, on-behalf-of-user authentication (running as the calling user), or an explicit service principal via OAuth — and these can be mixed within one agent.

Can an agent access data the acting user cannot?

No. With on-behalf-of-user authentication, an agent inherits the calling user's exact permission boundary; Unity Catalog row filters and column masks apply the same way they do for that user.

How are models and external tools governed?

Unity Catalog governs models, functions, MCP servers, and connections as securable objects, and the Unity AI Gateway enforces rate limits, budgets, and service policies on every model and MCP request.