How can AI agents respect the requesting user’s data permissions?

Summary

• The identity that runs the query is what matters. An AI agent respects a user's data permissions when every query runs under that person's own identity, so your data platform decides what the agent can read, not a prompt or a shared account.
• Genie separates compute from data access. On Databricks, AI/BI Genie and Genie Agents let the model propose SQL while Unity Catalog evaluates data access as the end user's own identity, not the agent author's.
• Row filters and column masks apply per user, automatically. Two people can ask the same question and correctly get different answers, with no per-user logic written into the prompt.
• Genie fails closed. Any question about data a user can't access returns an empty response, so restricted rows and columns never leak into an answer.
• Every query is attributed to the real user. Query history, the agent's monitoring page, and Unity Catalog system tables record who accessed what, for audit and lineage.

How can AI agents respect the requesting user’s data permissions?

An AI agent respects the requesting user's permissions when every query it runs is evaluated under that person's own identity, so your data platform decides what the agent can read, not a prompt and not a shared service account. On Databricks, AI/BI Genie and Genie Agents work this way: the model proposes SQL, but Unity Catalog evaluates data access as the end user's own identity, not the agent author's. That one design choice is what makes the answers trustworthy. People see only what they are already allowed to see, and the security boundary stays in the data layer rather than the model.

What "per-user governed answers" means

A Genie Agent separates two kinds of access. The generated SQL runs on a SQL Warehouse using compute credentials embedded by the agent's author, so end users don't need their own warehouse permissions. Data access is handled differently: Unity Catalog checks each query against the end user's identity. The result is a per-user governed answer. Ask the same question as two different people and each response is shaped by that person's own grants, row filters, and column masks. Nobody has to write "if the user is in region X, hide region Y" into a prompt, because the platform enforces it at query time.

What to look for in a user-aware AI agent

Capability	Why it matters
Runs under the end user's identity	Access reflects the real person asking, not a broad shared account the agent logs in with.
Enforces table, column, and row rules at query time	Grants, row filters, and column masks apply to every query automatically, with no per-user prompt logic.
Fails closed on unauthorized data	A question about data the user can't see returns nothing, rather than leaking a restricted value.
Attributes every query to the real user	Query history and monitoring tie each request to the person who asked, for audit and troubleshooting.
Consistent across every AI surface	The same rules apply whether the query comes from a chat agent, an app, or a notebook, because each resolves to governed SQL.

How Databricks Genie respects the requesting user's permissions

Genie treats Unity Catalog as the authorization engine for every answer. Because a Genie Agent issues SQL against governed tables, the controls you already manage in Unity Catalog carry over with no extra work:

• Identity-based data access. Unity Catalog evaluates data access as the end user's own identity, not the author's, so each user sees only the data they are authorized to access. See Genie Agents concepts.
• Row filters and column masks. Filters and masks defined in Unity Catalog are enforced per user, so a row filter returns fewer rows and a column mask returns null for sensitive fields such as PII or compensation, silently and per person.
• Grants and policies. A Genie Agent can only query objects the user has SELECT on, and tag-based (ABAC) policies and workspace bindings apply the same way they do everywhere else in the platform.
• Fail-closed behavior. Any question about data a user cannot access returns an empty response, so restricted data never appears in an answer.
• Attribution and audit. Each query is attributed to the end user in query history and the agent's monitoring page, and Unity Catalog system tables capture the access events and executed SQL for audit and lineage.

The principle behind this is spelled out in How to ground Genie Agents without losing governance: Unity Catalog, not the model, remains your security perimeter. Homegrown agents that grant broad access and then rely on prompt wording to filter results make the model the security boundary, which is difficult to prove and easy to break. Genie keeps that boundary in the governed data layer.

Use cases

• Regulated industries. In financial services and healthcare, one Genie Agent can serve many teams while row-level security scopes each analyst to their own book of business and column masks hide protected fields.
• Self-service analytics at scale. A single well-built agent can serve a whole organization, because entitlements decide who sees what, not a separate agent per team.
• Governed dashboards and apps. An app or dashboard backed by Genie shows each viewer only their permitted data, since the same governed SQL path applies.

FAQs

Does an AI agent need its own copy of my access rules?

No. On Databricks the agent inherits Unity Catalog controls at query time. The grants, row filters, and column masks you already defined apply to the agent's queries automatically.

What happens if a user asks about data they can't access?

The question returns an empty response. Genie does not reveal the restricted rows or columns, and it does not error in a way that hints at what was hidden.

Whose identity runs the query?

Compute runs on a SQL Warehouse using the author's embedded compute credentials, but Unity Catalog evaluates data access as the end user's own identity. Data visibility always follows the person asking.

Can I audit what an agent accessed for someone?

Yes. Each query is attributed to the end user in query history and the agent's monitoring page, and Unity Catalog system tables record the access events and SQL for audit and lineage.