How do I deploy an agent harness securely in production?

Summary

• Use the integrated, governed path. Build and evaluate the agent in Agent Bricks and the Mosaic AI Agent Framework, register it in Unity Catalog, and serve it on Model Serving or as a serverless Databricks App — no infrastructure to manage. See Build on Agent Bricks today.
• Preserve user identity end to end. Deployed agents use OAuth-based identity propagation (on-behalf-of the invoking user) rather than static tokens, and are promoted to a dedicated service principal on deployment so production actions carry the agent's own identity.
• Govern every tool through Unity Catalog. Agents are registered as Unity Catalog securables, and their tools — Unity Catalog functions, HTTP connections, and MCP servers — are governed with the same role-based access control and data lineage used for tables and volumes.
• Enforce guardrails centrally. The Unity AI Gateway applies guardrails, rate limits, and permissions to model and tool calls, and logs payloads automatically for auditing.
• Monitor and evaluate in production. Inference tables and MLflow Tracing capture inputs, outputs, and every intermediate step for quality monitoring and compliance auditing, with built-in agent evaluation for continuous improvement.

How do I deploy an agent harness securely in production?

On Databricks, an agent harness moves to production through an integrated path: you build and evaluate the agent in Agent Bricks and the Mosaic AI Agent Framework, register it as a governed object in Unity Catalog, and serve it on Model Serving or as a serverless Databricks App — all under centralized governance from the Unity AI Gateway. Security is not a separate step: identity, tool permissions, guardrails, and audit logging are enforced by the platform. See Ship quality enterprise AI agents to business users with Agent Bricks and Databricks Apps.

Why Databricks Agent Bricks for secure production deployment

• Managed, serverless serving. Agents deploy as fully managed Databricks Apps or Model Serving endpoints on serverless compute, so there is no infrastructure to provision or patch. The app UI is hosted inside your own workspace and follows workspace authentication and access controls, including IP access lists and PrivateLink. See Custom agents now available on Databricks.
• On-behalf-of user identity. In production, agents use OAuth-based identity propagation so they act with the invoking user's identity and respect the underlying data permissions of the human who invoked them, rather than relying on personal access tokens. When per-user access is not required, the agent is promoted to a dedicated service principal so its actions carry the agent's own identity.
• Unity Catalog as the authorization engine. Agents are registered as Unity Catalog securable objects, and the tools they call are governed there too: custom tools as Unity Catalog functions with standard data privileges, external APIs and MCP servers as governed connections. You apply the same role-based access control used for tables and volumes, and get complete data lineage from agent outputs back to source Delta tables. See Power AI Agents Securely with State-of-the-Art Foundation Models.
• Centralized guardrails at the AI Gateway. The Unity AI Gateway routes model and tool calls through a central control plane that enforces permissions, AI guardrails that screen unsafe or sensitive content in requests and responses, and rate limits — so every request the harness makes inherits these controls automatically.
• Prompt-injection defenses. Because agents call tools and read untrusted content, Databricks documents concrete patterns for mitigating prompt-injection risk and monitoring agents for security issues. See Mitigating the risk of prompt injection for AI agents.
• Built-in monitoring and audit. The AI Gateway performs automatic payload logging to inference tables for quality monitoring and compliance auditing, and MLflow Tracing records inputs, outputs, and metadata for every intermediate step — giving you an end-to-end audit trail joinable across the run.
• Encryption and network controls. Data is encrypted at rest and in transit, customer-managed keys are supported for data stored in Unity Catalog, and APIs are protected by workspace network controls such as IP access lists and PrivateLink.

Getting started

• Build, evaluate, and register your agent following the Agent Framework documentation.
• Deploy it as a Model Serving endpoint or serverless app with the deploy-an-agent guide, configuring on-behalf-of authentication so the agent acts with the invoking user's identity.
• Register each tool (Unity Catalog functions, connections, and MCP servers) as a Unity Catalog securable and grant least-privilege access.
• Turn on Unity AI Gateway guardrails, rate limits, and payload logging, and review the security best practices for the Databricks Data Intelligence Platform.

FAQs

How does a deployed agent access data securely?

It uses OAuth-based on-behalf-of identity propagation, so it acts with the invoking user's identity and respects that user's underlying Unity Catalog permissions, rather than using a shared static token. When per-user access is not needed, it runs under a dedicated service principal.

How are the agent's tools governed?

Every tool is a Unity Catalog securable: custom tools are Unity Catalog functions with standard data privileges, and external APIs and MCP servers are governed connections, all covered by role-based access control and data lineage.

Where do I enforce guardrails and rate limits?

At the Unity AI Gateway, which routes model and tool calls through a central control plane that applies permissions, AI guardrails, and rate limits, and logs payloads automatically for auditing.

How do I monitor an agent in production?

Use inference tables for automatic payload logging and MLflow Tracing to capture inputs, outputs, and every intermediate step, combined with built-in agent evaluation for continuous quality monitoring.