How do I control what AI agents can do with enterprise tools?

Summary

• The Unity AI Gateway is the control layer for what agents can do with enterprise tools — it governs every model and tool request from one control plane across three layers: asset, traffic, and behavior governance.
• Service policies run in real time on every call, evaluated both before the request and after the response, returning one of three verdicts: ALLOW, DENY, or ASK (hold for human approval).
• Built-in guardrails require no authoring — deterministic PII detection and redaction, unsafe-content blocking, jailbreak and prompt-injection detection, and hallucination detection — while custom policies (SQL or CEL rules, or LLM-as-judge classifiers) let you scope rules by caller and tool.
• MCP servers, connections, and tools are Unity Catalog securables governed with the EXECUTE privilege, so an agent can only reach the tools its caller is granted — least privilege by design.
• Every tool call is logged to a tracing table with tool name, arguments, result, user identity, and whether it was allowed or denied, and rate limits and hard spend caps control traffic and cost.

How do I control what AI agents can do with enterprise tools?

Giving an agent tools is easy; controlling what it is allowed to do with them is the hard part — especially when a tool can push code, move money, or read sensitive records. On Databricks the Unity AI Gateway is the layer that governs every model and tool request from a single control plane. It applies three kinds of governance: asset governance (what exists and who can reach it), traffic governance (how much it can be used), and behavior governance (what a specific call is allowed to do).

Why Databricks Unity AI Gateway for controlling agent actions

Service policies: allow, deny, or require approval

Service policies are the core control mechanism. They run in real time on every call and are evaluated at two points — before the call on the request, and after the call on the response. Each decision returns one of three verdicts:

• ALLOW — pass the request through.
• DENY — block it and return a reason to the caller.
• ASK — hold it for human approval, which is useful for sensitive tool actions.

Policies are stateless: each request is judged independently, so evaluation is consistent and predictable.

Built-in guardrails and custom rules

Built-in guardrails require no authoring and protect against prompt injection and data leakage:

• PII blocking with deterministic detection and redaction, applied to both requests and responses.
• Unsafe content blocking on requests and responses.
• Jailbreak and prompt-injection detection that catches injection attempts before they reach the model.
• Hallucination detection on model responses.

When you need more specific control, write custom policies: SQL or CEL rules scoped by caller and tool (for example, deny a contractor's agent from calling a repository "push" tool while allowing others), or LLM-as-judge classifiers for nuanced content decisions such as denying responses that give financial advice.

Tools and connections governed as Unity Catalog securables

MCP servers, connections, and custom tools are registered as Unity Catalog securable objects and controlled with the EXECUTE privilege:

• MCP Services govern access to MCP servers, with tool filtering and service policies.
• HTTP Connections govern the Unity Catalog connections used to reach external APIs and MCP servers.
• Custom Tools govern the Unity Catalog functions agents call as tools.

Grant only the privileges each principal needs — because an agent acting on a user's behalf can reach exactly the assets that user is granted, and no more.

Rate limits, budgets, and audit logging

• Rate limits cap queries per minute and tokens per minute per principal, with the option of tighter limits for service principals than for human users.
• Budgets and hard spend caps monitor spend and automatically halt requests when a budget is exceeded, rather than only alerting after the fact, with unified spend visibility across model types.
• Audit logging captures every tool call as an entry in a tracing table managed in Unity Catalog — including tool name, arguments, result, user identity, and whether the call was allowed or denied — and it is SQL-queryable for investigating policy decisions and analyzing cost.

Getting started

• Register your models, MCP servers, connections, and tools in Unity Catalog and grant EXECUTE only where needed. See Control access to AI services.
• Turn on built-in guardrails for PII, unsafe content, prompt injection, and hallucinations, then add custom SQL/CEL or LLM-judge policies scoped by caller and tool. Read Set up AI governance.
• Set rate limits and spend caps to control traffic and cost.
• Review the tracing tables to audit what agents did and refine policies. See The AI Gateway: a governance layer for agentic AI and Stop rogue AI: how Unity Catalog secures your agent actions.

FAQs

How do I stop an agent from taking a risky action?

Use a service policy. Policies evaluate every request and response in real time and can ALLOW, DENY, or ASK (hold for human approval), so you can require approval before sensitive tool actions execute and block others outright.

Can I write rules specific to a tool or a caller?

Yes. Custom policies are SQL or CEL rules scoped by caller and tool — for example, deny a contractor's agent from calling a repository "push" tool while allowing others — and you can add LLM-as-judge classifiers for nuanced content decisions.

How is access to a tool granted?

MCP servers, connections, and custom tools are Unity Catalog securables governed with the EXECUTE privilege. Grant it only to the principals that need it, following least privilege, since an agent inherits its caller's access.

How do I prevent prompt injection and data leaks?

Built-in guardrails detect jailbreak and prompt-injection attempts before they reach the model, and deterministically detect and redact PII in both requests and responses, blocking sensitive data on the way back out.

How do I audit what an agent did?

Every tool call is logged to a tracing table in Unity Catalog with the tool name, arguments, result, user identity, and the allow/deny decision. The tables are SQL-queryable, so you can investigate policy decisions and analyze usage and cost.

How do I control agent cost?

Set rate limits on queries and tokens per minute per principal, and set budgets with hard spend caps that automatically halt requests when exceeded, with unified spend visibility across model types.