How do I connect AI agents to multiple data sources securely?

Summary

• On Databricks, Unity Catalog is the single authorization engine for every data source an agent touches — so an agent can reach many governed sources under one consistent permission model.
• Connect structured data through Genie Agents, unstructured data through AI Search, and business logic through Unity Catalog functions — each exposed to the agent as a governed tool via managed MCP servers.
• Access is enforced at the SQL engine level, so the same GRANTs, row filters, and column masks apply no matter which service issues the query — an agent, Genie, a notebook, or a BI tool. Applications cannot bypass governance.
• On-behalf-of authentication flows the user's identity through every call: if the user cannot see a row, masked column, or governed view, neither can the agent. In multi-agent systems, a supervisor forwards the user's token to each sub-agent.
• The Unity AI Gateway is the enforcement layer — every model and tool request is authenticated, authorized against Unity Catalog, and logged from one control plane.

How do I connect AI agents to multiple data sources securely?

Agents rarely need just one source. A useful agent reads structured tables, retrieves from documents, and calls business logic — often in a single reasoning loop. The security challenge is doing that across many sources without granting the agent a broad, shared credential. On Databricks the answer is to make Unity Catalog the single authorization engine for every source, and to connect each source to the agent as a governed tool. Access rules are defined once and enforced everywhere.

Why Databricks for connecting agents to data securely

One authorization engine across every source

Unity Catalog enforcement fires at the SQL engine level, so it does not matter which service issues a query — Genie, an Agent Bricks agent, a custom tool, a notebook, or a BI tool. The same GRANT SELECT, row filters, and column masks apply, and applications cannot bypass Unity Catalog governance. Unity Catalog applies layered access control that must all pass: workspace bindings on catalogs, privileges (SELECT, MODIFY, EXECUTE), attribute-based access control policies on governed tags, and row/column filters. Row filters return fewer rows silently; column masks return NULL without errors.

A governed tool for each kind of data

• Structured data via Genie. A Genie Agent gives an agent natural-language access to curated tables, with Unity Catalog permissions enforced on every request. A Genie Agent is exposed to agents through a managed MCP server.
• Unstructured data via AI Search. AI Search indexes inherit row-level security from their source Delta table and use the same grant model as tables, and are available as a managed MCP server for semantic retrieval.
• Business logic via Unity Catalog functions. Functions run under the same privilege model and become deterministic, governed tools the agent can call.

Managed MCP servers that respect permissions automatically

Databricks provides managed MCP servers for Genie, AI Search, and Unity Catalog functions. They are managed for you with no upkeep and inherit Unity Catalog governance automatically, so connecting a new data source does not mean writing new authorization code.

On-behalf-of authentication end to end

Identity flows through the platform using OAuth 2.0 token exchange — the on-behalf-of pattern. A user querying a table, an agent calling a SQL tool, and a Genie Agent invoked as a tool all operate inside the same permission boundary. If the user cannot access the underlying data, a masked column, or a governed view, the agent receives exactly the same boundary. For multi-agent systems, the supervisor forwards the user's token to each sub-agent, so row filters, column masks, and function-level access controls all fire as the calling user — with no extra auth code. Agents never receive shared backend write credentials.

The Unity AI Gateway as the control plane

The Unity AI Gateway is the enforcement layer for every agent interaction. It routes every model-service and MCP-service request from one control plane and enforces asset governance (every model, MCP server, function, and connection is a Unity Catalog securable), traffic governance (rate limits, budgets, usage tracking), and behavior governance (policies that allow, deny, or require approval based on who is calling and what the request contains). Every call is authenticated, authorized against Unity Catalog, and logged before it reaches any system.

Getting started

• Register your sources in Unity Catalog and set grants, row filters, and column masks once. See Unity Catalog.
• Expose each source as a governed tool — a Genie Agent for structured data, a AI Search index for documents, and Unity Catalog functions for logic — through managed MCP servers.
• Connect the agent with on-behalf-of authentication so it inherits the user's permissions. Read Announcing managed MCP servers.
• Govern and monitor everything through the Unity AI Gateway. See How AI governance works on Databricks.

FAQs

How does an agent access many data sources under one permission model?

Unity Catalog is the single authorization engine. Each source is exposed as a governed tool, and enforcement happens at the SQL engine level, so the same grants, row filters, and column masks apply no matter which service or agent issues the query.

What happens if the user isn't allowed to see certain data?

With on-behalf-of authentication, the agent runs inside the user's permission boundary. If the user cannot access a row, a masked column, or a governed view, the agent receives the same restricted result — row filters silently return fewer rows and column masks return NULL.

How do I connect structured versus unstructured data?

Use a Genie Agent for natural-language access to structured tables and a AI Search index for unstructured documents. Both are available as managed MCP servers and both inherit Unity Catalog permissions.

How is security handled in multi-agent systems?

A supervisor agent forwards the user's OAuth token to each sub-agent, so every sub-agent enforces the calling user's permissions automatically, with no additional authentication code in the supervisor.

What role does the Unity AI Gateway play?

The Unity AI Gateway is the control plane that routes every model and tool request, authenticates it, authorizes it against Unity Catalog, applies rate limits and policies, and logs every invocation for monitoring and compliance.