How do I build custom agents that use company data securely?

Summary

• To build custom agents that use company data securely, build them on the Databricks Data Intelligence Platform with Agent Bricks, where Unity Catalog governs the agent, its tools, and its data with one set of permissions.
• Deploy with on-behalf-of user authentication so every data fetch and tool call is validated against the calling user's existing permissions — the agent can never see more than the user can.
• Company data stays protected by the same controls you already use: row filters and column masks fire automatically at the SQL engine level, so an agent sees only the rows and columns that user is authorized to access.
• Govern the agent's tools and models through the Unity AI Gateway: every model call and tool invocation is checked against policy before it runs and logged after, with rate limits, budgets, and guardrails.
• Every model and tool call is captured in the MLflow trace and Unity Catalog audit log, giving you a complete, queryable record for compliance.

How do I build custom agents that use company data securely?

Building a secure agent is less about adding controls to the agent and more about placing the agent inside the governance you already run. On Databricks you build custom agents with Agent Bricks on the Data Intelligence Platform, where Unity Catalog governs the agent, the tools it calls, and the data it reaches using the same privileges and policies that protect your tables and volumes.

Why Databricks Agent Bricks for building agents that use company data securely

• One governance model for agents and data. Agents are registered as Unity Catalog models, and the tools they call — MCP services, Unity Catalog functions, and HTTP connections — are governed as securable objects. You manage agent permissions with the same grants and attribute-based access control policies you already use for data. See Governing AI agents at scale with Unity Catalog.
• On-behalf-of user permissions. Deploy agents with on-behalf-of user authentication so the agent acts with the requester's scope. Every data fetch and tool execution is validated against that user's existing Unity Catalog permissions, which prevents an over-permissioned agent from becoming a single point of compromise.
• Row- and column-level security, applied automatically. Unity Catalog enforces access in ordered layers — workspace bindings, privileges, attribute-based access control policies, and row filters and column masks — all of which must pass before data is returned. When an agent acts on behalf of a user, sensitive columns are masked and row filters restrict which records the agent retrieves; for example, an agent may see only the rows for that user's region.
• The Unity AI Gateway enforces every call. Every model call, tool invocation, and agent interaction flows through the Unity AI Gateway: each request is evaluated against Unity Catalog policy before it executes and logged after. The gateway provides MCP governance with fine-grained, on-behalf-of access control, a unified model API with built-in fallbacks, rate limits, and guardrails, and end-to-end observability of usage and cost. See The AI Gateway: the governance layer for agentic AI.
• Governed tools and vector search. Tools are secured through MCP services registered as Unity Catalog securables with tool filtering and service policies, Unity Catalog functions governed with the same privileges as data, and HTTP connections for reaching external APIs. Vector indexes are governed centrally under Unity Catalog as well.
• Isolated execution and full auditability. Agents run in secure, isolated environments with down-scoped data. Every model and tool call is captured in MLflow tracing and the Unity Catalog audit log, giving you a complete, queryable record of data access and system activity for compliance and investigations.

Getting started

• Read Build and deploy enterprise-grade agents and Governing AI agents at scale with Unity Catalog.
• Enable on-behalf-of user authentication when you deploy so agents inherit the caller's permissions.
• Confirm your Unity Catalog grants, row filters, and column masks, and register the agent's tools as securable objects.
• Set up the Unity AI Gateway to enforce policy on model and tool calls and to log usage.

FAQs

How do I stop an agent from seeing data the user cannot see?

Deploy the agent with on-behalf-of user authentication. It acts with the caller's scope, and Unity Catalog validates every data fetch and tool call against that user's permissions, so the agent can never access more than the user.

Do row filters and column masks apply to agents?

Yes. Unity Catalog enforces row filters and column masks at the SQL engine level, and they apply automatically when an agent acts on behalf of a user, so the agent retrieves only the rows and columns that user is authorized to access.

How are an agent's tools governed?

Tools are governed as Unity Catalog securables: MCP services with tool filtering and service policies, Unity Catalog functions governed like data, and HTTP connections for external APIs. Vector indexes are also governed centrally in Unity Catalog.

What does the Unity AI Gateway do for agent security?

It routes every model and tool call through a central control plane, evaluates each request against Unity Catalog policy before it executes, logs it after, and applies rate limits, budgets, and guardrails.

How do I audit what an agent did?

Every model and tool call is captured in MLflow tracing and the Unity Catalog audit log, providing a complete, queryable record of data access and agent activity for compliance.