How can I require approval before an AI agent takes sensitive actions?

Summary

• On Databricks you gate high-risk agent actions with service policies enforced by the Unity Gateway: a policy evaluates each interaction and returns ALLOW, DENY, or ASK.
• The ASK decision holds the interaction for human approval before it proceeds, enabling human-in-the-loop workflows — for example, an administrator can approve a destructive MCP tool call before it runs.
• Policies evaluate at two points: ON CALL (before the service is invoked, against the request) and ON RESULT (after the service responds), so a sensitive call is checked before it reaches any external system.
• Approval sits on a least-privilege foundation: Unity Catalog governs every model, MCP server, function, and connection as a securable, and on-behalf-of-user authentication keeps the agent inside the calling user's permissions.
• Built-in guardrails (block_unsafe_content, block_jailbreak, block_hallucination, detect_sensitive_data) and custom SQL/CEL/LLM-as-a-judge policies fail closed, and every decision is logged for audit. Service policies are in Beta.

How can I require approval before an AI agent takes sensitive actions?

You can require human approval for sensitive or high-risk agent actions on Databricks using service policies enforced by the Unity Gateway. A service policy evaluates each agent-to-model or agent-to-tool interaction at runtime and returns one of three decisions: ALLOW (the interaction proceeds), DENY (the policy blocks it), or ASK (the policy holds the interaction for human approval before it proceeds). The ASK decision is what enables human-in-the-loop workflows for sensitive operations — for example, an administrator can approve a destructive MCP tool call before it runs. This works together with Unity Catalog permissions and on-behalf-of-user authentication, so approval sits on top of a least-privilege foundation. See Governing AI agents at scale with Unity Catalog.

Why Databricks Unity Gateway gates sensitive agent actions

• Human approval with the ASK decision. A service policy can hold a specific interaction for human approval before it proceeds, so a sensitive operation — such as a destructive MCP tool call — pauses until an authorized reviewer approves it. See Service policy decisions and enforcement.
• Runtime enforcement at two points. Policies evaluate ON CALL (before Databricks invokes the service, against the request) and ON RESULT (after the service responds, against the response), so a call is inspected before it ever reaches an external system.
• Permissions come first. Unity Catalog governs every model, MCP server, function, and connection as a securable object with the same privileges and ABAC policies you use for tables. A caller must hold EXECUTE on the target service, so an agent can only reach what it is explicitly granted.
• On-behalf-of-user authentication. With OBO, the calling user's identity flows end to end and the agent acts with that user's permissions, including row filters and column masks, so the agent operates inside the same boundary as the user it serves.
• Built-in and custom guardrails. Attach built-in guardrails such as system.ai.block_unsafe_content, system.ai.block_jailbreak, system.ai.block_hallucination, and system.ai.detect_sensitive_data, or author custom policies in SQL, CEL, or with an LLM-as-a-judge to encode your own rules.
• Fail-closed by design. If a policy cannot be evaluated, the interaction is denied rather than allowed, so uncertainty never results in an ungoverned action.
• Complete audit trail. Every request, response, and decision is logged to Unity Catalog system tables, so you can prove what an agent did and which actions were approved.

Service policies are in Beta and require enabling the preview in the account console.

Getting started

• Read How AI governance works on Databricks for the asset, traffic, and behavior governance model.
• See Service policy decisions and enforcement to configure ALLOW, DENY, and ASK outcomes.
• Read What's new with Unity Gateway: service policies, guardrails, observability, and cost controls.

FAQs

How do I make an agent pause for approval before a risky action?

Attach a service policy that returns the ASK decision for that action. The Unity Gateway holds the interaction until an authorized reviewer approves it, then lets it proceed.

Can an agent bypass an approval policy?

No. Service policies are enforced by the gateway at runtime before the call reaches the target service, and they fail closed — if a policy cannot be evaluated, the interaction is denied.

What happens after an action is approved or denied?

The decision, request, and response are logged to Unity Catalog system tables, giving you an audit trail of every sensitive action and who approved it.