How do I govern agents?

Summary

• Govern agents like any other asset. On Databricks you register agents, models, tools, and MCP servers as Unity Catalog securable objects and control them with the same privileges and attribute-based access control (ABAC) you use for tables.
• Control the traffic centrally. The Unity Gateway routes every model call, tool invocation, and agent interaction through one control plane with rate limits, budgets, and usage tracking.
• Enforce identity end to end. On-behalf-of (OBO) token passing means an agent acts with the requesting user's exact permissions, so it can never reach data the user cannot.
• Set guardrails and audit everything. Service policies allow, deny, or require approval on requests and responses, and every interaction is traced and logged for lineage and audit.
• Monitor behavior. MLflow tracing and evaluation plus Lakewatch turn agent logs into observability and security investigation.

How do I govern agents?

Governing agents means controlling what they can access, what they can do, how much they can spend, and keeping a complete record of every action — while they run, not just when they are built. Databricks treats this as an extension of data governance: the same platform that governs your tables governs your AI agents. In practice that comes down to four pillars — govern the assets, control the traffic, set guardrails, and observe and audit — built on Unity Catalog and the Unity Gateway. See Governing AI agents at scale with Unity Catalog.

How Databricks helps you govern AI agents

• Govern agents as securable assets. Register agents, models, Unity Catalog functions (used as tools), and Model Context Protocol (MCP) servers as Unity Catalog securable objects, governed with the same privileges you use for tables and volumes. See How AI governance works on Databricks.
• Attribute-based access control (ABAC). Write one tag-based rule — for example, grant access to all models tagged lifecycle = production — and any new asset matching those attributes is automatically governed on creation, using the same ABAC framework across data and AI.
• Route all AI traffic through one control plane. The Unity Gateway routes every model and MCP request through a central point and enforces rate limits, budgets, and usage tracking. See The AI Gateway: a governance layer for agentic AI.
• Propagate identity with on-behalf-of authorization. OBO token passing lets an agent act with the requesting user's exact permissions, so every request is authenticated and authorized against Unity Catalog before it reaches any system.
• Set guardrails with service policies. Service policies allow, deny, or require approval on individual requests and responses based on context, supporting uses like PII detection and prompt-injection mitigation.
• Connect to external tools securely. Register and govern MCP servers — Databricks-managed and custom — with tool filtering, so agents reach only approved tools. See How to connect agents to external MCPs securely.
• Trace, log, and audit every action. Every model call, tool invocation, and agent interaction is traced and captured with lineage and audit logs, stored as governed Delta tables you can query.
• Monitor behavior and investigate. MLflow adds GenAI tracing and an evaluation harness with LLM judges, and Lakewatch analyzes gateway traces to detect suspicious activity and investigate policy violations.

Getting started

1. Set up AI governance by registering your models, functions, and MCP servers as Unity Catalog securables — see How AI governance works on Databricks.
2. Route model and agent traffic through the Unity Gateway and define ABAC policies, rate limits, and budgets.
3. Add service-policy guardrails and enable tracing so every interaction is logged for lineage and audit.
4. Review What's new for the Unity Gateway for the latest capabilities.

FAQs

What does it mean to govern an agent?

It means controlling which models and tools an agent can call, what data it can access, how much it can spend, and recording every action — enforced while the agent runs. On Databricks this uses Unity Catalog and the Unity Gateway.

How does Databricks stop an agent from accessing data it shouldn't?

Agents inherit Unity Catalog permissions through on-behalf-of authorization, so they act with the requesting user's exact grants. If an agent requests data it wasn't granted, Unity Catalog denies the read and records the denial in the audit log.

Can I see what my agents are doing?

Yes. Every model call, tool invocation, and agent interaction is traced and stored as governed Delta tables, and MLflow evaluation plus Lakewatch turn those traces into monitoring and security investigation.