What does least-privilege access mean for an AI agent?

Summary

• Least privilege for an AI agent means it gets only the minimum permissions needed for its task — and never more than the person it acts for is authorized to use.
• On-behalf-of-user authorization makes the agent inherit the invoking user's permissions rather than running with a broad, standing service identity, so if a user cannot see a table, the agent cannot either.
• Unity Catalog governs AI assets — models, functions used as tools, and MCP services — as securable objects with the same GRANT privileges used for tables and volumes, so administrators grant only what each principal needs.
• Fine-grained controls apply to agents and people alike: row filters, column masks, and attribute-based access control (ABAC) fire inside the engine, so no application can bypass them.
• The Unity AI Gateway enforces this at runtime, authenticating and authorizing every model and tool call against Unity Catalog policy before it executes, and logging it after.

What does least-privilege access mean for an AI agent?

Least-privilege access for an AI agent means granting the agent only the minimum permissions it needs to accomplish its task, so it cannot reach data or tools beyond what the invoking user is authorized to use. It is a security principle, not a model behavior: the limits are enforced at the data and governance layer, not by the language model or by prompt engineering. On Databricks, least privilege for agents is enforced through the same unified governance model that protects the rest of the platform, Unity Catalog.

Why Databricks enforces least privilege for AI agents

• On-behalf-of-user authorization. When an agent acts on a user's behalf, the underlying SDK uses the permissions of the end user interacting with the agent, not a broad service principal tied to the agent. Identity flows end to end from the user, through the agent, to the specific data accessed, and every action is logged against both the user and the agent. If a user cannot access a table, the agent cannot either. See Governing AI agents at scale with Unity Catalog.
• AI assets are governed like data. Unity Catalog manages models, the functions agents call as tools, and MCP services as securable objects, secured with the same privileges you use for tables and volumes. Administrators grant only the privileges each principal needs, because access to an AI asset determines what an agent acting on a user's behalf can reach. See Set up AI governance.
• Row and column security. Row filters restrict which rows a caller sees based on their attributes, and column masks hide sensitive fields such as PII unless the caller belongs to a permitted group. These row and column controls fire at the SQL engine level, so no application can bypass them, and the same policies that protect enterprise data govern AI interactions.
• Attribute-based access control (ABAC). With ABAC, administrators define tag-driven policies once and apply them across catalogs, schemas, and tables, so agents inherit the same attribute-based restrictions as human users without managing permissions object by object.
• Runtime enforcement through the Unity AI Gateway. Every model call and tool invocation is authenticated, authorized against Unity Catalog, and routed through the gateway before it reaches any external system, then logged. The gateway governs which models and tools can be accessed, applies rate limits and budgets, and can allow, deny, or require approval for specific requests. See How AI governance works on Databricks.

Getting started

• Register the models, tool functions, and MCP services your agents use as Unity Catalog securables and grant each principal only the privileges it needs.
• Build agents to run on behalf of the invoking user so they inherit that user's permissions.
• Apply row filters and column masks and ABAC policies to sensitive data so agents inherit them automatically.
• Route agent traffic through the Unity AI Gateway to authorize and log every model and tool call.

FAQs

What is least-privilege access for an AI agent?

It is granting an agent only the minimum permissions needed for its task, and never more than the user it acts for is authorized to use, enforced at the data and governance layer rather than by the model.

Can an AI agent see data the user is not allowed to see?

No. With on-behalf-of-user authorization, the agent inherits the invoking user's permissions, so if the user cannot access a table, the agent cannot either.

How are agent permissions enforced on Databricks?

Unity Catalog governs models, tool functions, and MCP services as securable objects, row and column controls fire in the engine, and the Unity AI Gateway authorizes and logs every model and tool call at runtime.