How does Unity Catalog govern models, tools, MCP servers, and agents?

Summary

• AI assets are securable objects. Unity Catalog governs registered models, tools (UC functions), MCP servers, and agents the same way it governs data, in the catalog → schema hierarchy, giving one place for discovery, lineage, and audit.
• Familiar permissions. Access uses standard privileges such as EXECUTE to use a model or tool, CREATE to register new assets or connections, and MANAGE to administer configuration and access.
• Tag-driven policies (ABAC). One rule can govern an entire class of assets by tag, for example every model tagged lifecycle = production, and new assets that match the tags are governed automatically.
• Runtime enforcement via Unity Gateway. Every model and tool request is routed through a central control plane that applies access control, rate limits, budgets, and, with service policies (Beta), allow/deny/approval rules and built-in guardrails.
• Unified lineage and audit. Model interactions and MCP tool activity are traced end to end, and system tables log every access for compliance.

How does Unity Catalog govern models, tools, MCP servers, and agents?

As organizations put AI into production, the models, tools, MCP servers, and agents they build need the same governance as their data. Unity Catalog extends its unified governance model to these AI assets, treating each as a securable object and enforcing access, lineage, and audit through a single layer that works together with the Unity Gateway at runtime.

Why Databricks Agent Bricks governs AI assets in Unity Catalog

• AI assets are securable objects. Unity Catalog registers models, MCP servers, tools (UC functions), and agents as governed objects in the familiar catalog → schema hierarchy, so a single governance layer provides consistent discovery, lineage, and audit across every asset type instead of fragmented, per-tool systems.
• Role-based permissions. Administrators grant access with the same privileges used for data: EXECUTE to use a model or tool, CREATE to register new assets or connect providers, and MANAGE to administer configuration, rate limits, and access.
• Attribute-based access control (ABAC). You can write one rule that covers an entire class of assets by governed tag, for example granting a group access to every model tagged lifecycle = production. New assets that match the tags are governed automatically on creation, using the same ABAC framework that powers row filters and column masks on tables.
• Runtime governance through Unity Gateway. The Unity Gateway routes every model and MCP service request from a central control plane and enforces governance in three dimensions: asset governance (privileges and policies on models, MCP servers, functions, and connections), traffic governance (rate limits, budgets, and usage tracking), and behavior governance through service policies (Beta) that allow, deny, or require approval for individual requests and responses. Built-in guardrails help protect against issues such as PII exposure, prompt injection, and unsafe content.
• Governed agent execution. When an agent calls a tool or model, Databricks authenticates the request, authorizes it against Unity Catalog, and routes it through the Unity Gateway before it reaches any external system. Agents are registered as Unity Catalog models, and the tools they call are governed as MCP services, UC functions, and connections; MCP services offer the richest controls, including tool filtering and service policies. See The AI Gateway: a governance layer for agentic AI.
• Unified lineage, observability, and audit. Unity Catalog tracks lineage across data and AI assets, including which models consume which data down to the column level. End-to-end tracing captures model interactions and MCP tool activity in one telemetry layer, and audit logging through system tables records every access for compliance.

Getting started

• Follow Set up AI governance to register models, MCP servers, functions, and connections as Unity Catalog objects and grant access.
• Tag your AI assets and apply ABAC policies so entire asset classes are governed by a single rule.
• Route requests through the Unity Gateway to enforce access, rate limits, budgets, and service policies at runtime.
• Review what's new in Unity Catalog for the latest AI governance capabilities.

FAQs

What AI assets can Unity Catalog govern?

Registered ML and foundation models, tools implemented as UC functions, MCP servers, connections to external providers, and agents, all as securable objects in the catalog → schema hierarchy.

What privileges control access to models and tools?

The same privilege model used for data: EXECUTE to use a model or tool, CREATE to register new assets or connections, and MANAGE to administer configuration and access. Tag-driven ABAC policies can govern whole classes of assets at once.

How are agents and tool calls governed at runtime?

When an agent calls a model or tool, the request is authenticated, authorized against Unity Catalog, and routed through the Unity Gateway, which applies rate limits, budgets, and service policies before the request reaches any external system.

Is AI activity audited?

Yes. Model interactions and MCP tool activity are traced end to end, and system tables log every access, supporting compliance and cost attribution across models, teams, and workflows.