How do I manage permissions for custom AI agents?

Summary

• Unity Catalog is the single authorization engine. On Databricks, custom AI agents built with Agent Bricks and the Mosaic AI Agent Framework are governed as Unity Catalog securables, so the same grants, row filters, and column masks that protect your data also govern what an agent can do. See Four pillars of agent governance.
• Grant tools by privilege. Custom function tools are governed with GRANT EXECUTE, external API and MCP connections with GRANT USE CONNECTION, and managed MCP servers as registered securables that require EXECUTE plus USE CATALOG and USE SCHEMA on the parent catalog and schema.
• Permission the registered agent itself. A deployed agent is a Unity Catalog Agent Service with assignable privileges (EXECUTE, READ METADATA, MANAGE, ALL PRIVILEGES); in the UI you grant Can Query to call it and Can Manage to configure it and set permissions.
• On-behalf-of user authentication. With on-behalf-of token passing, an agent inherits the invoking user's permissions in real time — if a user cannot access a table, neither can the agent acting for them — and every action is logged against both the user and the agent identity.
• Runtime service policies and least privilege. Service policies evaluate each tool call before it runs and return allow, deny, or require consent; grant only the privileges each principal needs and scope external connections per agent.

How do I manage permissions for custom AI agents?

On Databricks, you manage permissions for custom AI agents through Unity Catalog, the single governance layer for Agent Bricks and the Mosaic AI Agent Framework. Everything an agent touches — the tools it calls, the external connections it uses, and the deployed agent itself — is a Unity Catalog securable, so you grant and revoke agent access with the same privilege model you already use for tables and functions. Governance works across three complementary layers: permissions control who can call what, service policies control whether a specific tool call should proceed at runtime, and guardrails control what content flows in and out. See Four pillars of agent governance.

Why Databricks Agent Bricks governs agent permissions

• Unity Catalog grants on agent tools. Custom function tools are governed with the same GRANT EXECUTE privilege you use for data functions. HTTP and external-API connections — including the connections agents use to reach external MCP servers — are governed with GRANT USE CONNECTION. Grant only the privileges each principal needs, because access to an AI asset determines what an agent acting on a user's behalf can reach. See Control access to AI services and create a custom tool.
• Managed MCP servers as securables. External and managed MCP (Model Context Protocol) servers are registered in Unity Catalog and governed like any other catalog object, with tool filtering and service policies. End users need EXECUTE on the registered MCP service, plus USE CATALOG and USE SCHEMA on its parent catalog and schema. See MCP services.
• Permissions on the registered agent. A deployed agent is registered and governed as a Unity Catalog Agent Service. Assignable privileges are EXECUTE, READ METADATA, MANAGE, and ALL PRIVILEGES, which you can grant, inspect, and revoke per principal. From the Agents page you can open Manage permissions and grant Can Query (call the agent endpoint in AI Playground and through the API) or Can Manage (configure the agent, improve quality, and set permissions). See Grant access to agent services and register and govern agents.
• On-behalf-of user authentication. Rather than running under a shared, over-privileged service account, an agent can pass the invoking user's identity so it accesses resources with that user's permissions in real time. If a user cannot access a table in Unity Catalog, neither can the agent acting on their behalf, and this extends to MCP servers so one user's agent only sees what that user is allowed to see. Every action is logged against both identities — the real user who triggered the request and the agent that acted for them. Admins can further restrict agents by scoping OAuth permissions per connection. See Unity AI Gateway for external MCP connectivity.
• Runtime service policies. Service policies are Unity Catalog functions attached to registered MCP services that evaluate each tool call before it runs. Based on the tool name, its arguments, or the caller's identity, a policy returns allow, deny, or require user consent; a deny blocks the call. Service policies are enabled through the Unity AI Gateway governance preview.
• Least privilege by default. The Unity Catalog governance model enforces permissions at the query engine, so the same grants, row filters, and column masks apply no matter which service issues the request — Genie, Agent Bricks, a custom MCP tool, a notebook, or a BI tool — and applications cannot bypass it. Grant only what each principal needs and scope external connections per agent. See Start building AI agents with tool calling.

Getting started

• Read Four pillars of agent governance to understand the permissions, service-policy, and guardrail layers.
• Register your agent tools as Unity Catalog securables and grant least-privilege access: GRANT EXECUTE on function tools and GRANT USE CONNECTION on external connections.
• Grant access to the deployed agent from agent services or the Manage permissions dialog on the Agents page.
• Configure AI governance in the Unity AI Gateway to enable on-behalf-of authentication and service policies.

FAQs

How do I grant access to a custom agent's tools?

Govern each tool as a Unity Catalog securable: use GRANT EXECUTE for custom function tools and GRANT USE CONNECTION for external API and MCP connections, granting only the privileges each principal needs.

How do I control who can call or manage a deployed agent?

A deployed agent is a Unity Catalog Agent Service with EXECUTE, READ METADATA, MANAGE, and ALL PRIVILEGES. In the UI, grant Can Query to let a principal call the agent and Can Manage to let them configure it and set permissions.

What is on-behalf-of authentication for agents?

The agent inherits the invoking user's Unity Catalog permissions in real time, so it can only access what that user can access, and every action is audited against both the user and the agent identity.

How do service policies control agent tool use?

Service policies are Unity Catalog functions attached to registered MCP services that evaluate each tool call before execution and return allow, deny, or require consent based on the tool, its arguments, or the caller.