Does Databricks have an AI security product?

Summary

• Databricks covers AI security with several products and a framework, not one product named "AI security": Unity Gateway governs AI traffic at runtime, Unity Catalog governs access to data and AI assets, Lakewatch is an agentic SIEM, and the Databricks AI Security Framework (DASF) is guidance.
• Unity Gateway is generally available. It routes model and MCP requests, enforces rate limits and cost controls, and records usage. Its service policies, which implement guardrails for sensitive data, prompt injection, and unsafe content, are in Beta.
• Databricks describes analyzing Unity Gateway traces in Lakewatch to detect suspicious activity and investigate policy violations. Lakewatch was announced in Private Preview on March 24, 2026.
• DASF is a framework and whitepaper that maps AI risks to controls. It is not a product you deploy.

Does Databricks have an AI security product?

Yes, in pieces. Databricks does not sell a single product named "AI security". It covers AI security with Unity Gateway for runtime governance and guardrails, Unity Catalog for access control, and Lakewatch for security operations, and it publishes DASF to help teams choose controls.

Offering	What it is	Role in AI security
Unity Gateway	The control plane for AI	Routes model and MCP requests, enforces rate limits and cost controls, applies service policies, and records usage
Unity Catalog	Governance for data and AI assets	Manages models, MCP servers, functions, and connections as securable objects
Lakewatch	An agentic SIEM built on the security lakehouse	Security analytics and investigation, including analysis of Unity Gateway traces
DASF	A whitepaper and framework from the Databricks Security team	Identifies AI risks and the controls that mitigate them

What does Unity Gateway do for AI security?

The Databricks docs put it this way: "On Databricks, Unity Gateway is the control plane for AI. It routes every model and MCP request, enforces rate limits and cost controls, applies service policies to implement guardrails, and records usage across any model provider and any coding agent."
The docs split AI governance into three dimensions:

• Asset governance: Unity Catalog manages models, MCP servers, functions, and connections as securable objects.
• Traffic governance: Unity Gateway routes requests centrally and enforces rate limits, budgets, and usage tracking.
• Behavior governance: Service policies allow or deny requests based on their content.

External coding agents are governed by routing them through a Databricks model service, so developers use Databricks credentials instead of provider API keys on their machines. For MCP, you choose which tools a service exposes, and a custom policy can deny a specific tool for a specific agent. Usage tables record who called what and when, and inference tables hold full request and response payloads.

Which guardrails are built in?

Service policies are a type of attribute-based access control (ABAC) policy scoped to AI services. They are in Beta, and account admins control access from the account console Previews page. Databricks provides four built-in policies:

Policy	What it does
system.ai.block_unsafe_content	Denies interactions that contain unsafe or harmful content
system.ai.block_jailbreak	Denies requests that attempt to circumvent model safety instructions
system.ai.block_hallucination	Denies responses that contain hallucinated content
system.ai.detect_sensitive_data	Detects structured sensitive data and either blocks the interaction or redacts the matched values

A policy returns ALLOW or DENY, and for MCP services only it can return ASK, which pauses the request for user approval. Policies attach to MCP services, model services, and model provider services. Agent services are not supported.

What does Lakewatch add?

Lakewatch is "Databricks' agentic SIEM built on the security lakehouse." The product page describes normalizing log formats into a unified OCSF schema, managing detections as code with automated testing and deployment, asking natural-language threat-hunting questions with Genie, and governing all Lakewatch data with Unity Catalog.
For AI security, the Data + AI Summit 2026 governance post says to "analyze Unity Gateway traces in Lakewatch to detect suspicious activity, investigate policy violations, and accelerate AI security investigations." Databricks announced Lakewatch in Private Preview on March 24, 2026. The product page does not name a later stage, so confirm current availability with your Databricks account team.

What is the Databricks AI Security Framework?

DASF comes from the Databricks Security team and is published as a whitepaper in the Security and Trust Center. It is not a product. DASF v3.0, announced on March 20, 2026, added agentic AI as the 13th system component, addressing the unique risks of agent memory, planning, and tool use.

Are guardrails enough on their own?

No. Databricks' March 2026 prompt-injection guidance says its controls are not bulletproof on their own and recommends stacking them, including Unity Catalog access controls, serverless egress controls, inference tables, and system tables. It also cites Meta's "Agents Rule of Two": an agent should be permitted only two of these three: access to sensitive systems or private data, exposure to untrustworthy inputs, and the ability to change state or communicate externally.

FAQs

Is Unity Gateway generally available?

Yes. The August 4, 2026 release notes say so. Service policies, including the built-in guardrails above, are in Beta.

Is Lakewatch generally available?

Databricks announced Lakewatch in Private Preview on March 24, 2026, and the current product page does not state a later stage. Ask your Databricks account team for its current availability.

Does Unity Gateway govern coding agents?

Yes, when you route them through a Databricks model service. You grant EXECUTE to control who can use it, set rate limits per minute, and set budgets with alert thresholds.

Is DASF a product I can deploy?

No. DASF is a framework and whitepaper that helps teams identify AI risks and select controls. The enforcement happens in products such as Unity Catalog and Unity Gateway.