How to safely execute agent-generated code in production

Summary

• Require human approval before agents execute code using tool confirmation: choose per-execution approval, session-level approval, or always-allow policies based on risk and use case.
• Sandbox agent actions with Unity Catalog functions, row-level security, and attribute-based access control to limit scope and prevent unintended operations on production data.
• Deploy agents on Databricks Apps with built-in governance, versioned tools and models, and managed serverless compute that integrates with CI/CD.
• Monitor all agent activity through MLflow traces, AI guardrails, centralized logging, and inference tables to detect anomalies and ensure compliance.
• Use best practices including model version pinning, latency optimization, and careful design of agent tools and guardrails to maintain reliability and security.

How to safely execute agent-generated code in production

Executing agent-generated code safely in production requires multiple layers: human oversight through approval mechanisms, sandbox constraints through access control, governance infrastructure, continuous monitoring, and deployment architecture designed for safety. Databricks provides these layers integrated on a single platform so agents operate with full visibility, compliance, and ability to roll back or restrict actions.

Why safety matters for agent-generated code

Agent-generated code can modify data, trigger workflows, or query sensitive information. Unlike human-written code, which is reviewed before deployment, agent code is dynamic and model-dependent. LLM behaviors change when providers update models, so today's safe agent might behave differently tomorrow. Production deployments require human oversight, sandboxing, and monitoring to detect and prevent unintended operations.

How Databricks approaches safe agent execution

Require approval before execution. Use tool confirmation to require human approval before agents execute code. You can configure approval at three levels:

Approval Level	When to use	Behavior
Per execution	High-risk operations, sensitive data	Approve each action individually
Session-level	Development or low-risk operations	Approve once per thread, resets on "+"
Always allow	Fully tested, low-risk agents	Approved until settings change

Sandbox with Unity Catalog. Limit what agents can access and modify. Use Unity Catalog functions, row-level security, and attribute-based access control to create sandboxes:

• Grant agents only the catalogs, schemas, and tables they need
• Apply row filters so agents only access rows they should modify
• Use column masks to hide sensitive values even if agents query the table
• Register agent tools in Unity Catalog for governance and versioning

Deploy on Databricks Apps. Deploy agents as Databricks Apps on serverless compute, which provides built-in security and governance:

• All tools, datasets, and models are registered and versioned
• Compute is managed and isolated from production infrastructure
• Access to agents is controlled through Databricks account permissions
• Deployments integrate with CI/CD pipelines for continuous testing and rollback

Monitor and observe all activity. Use MLflow traces and AI guardrails to monitor agent behavior:

• MLflow traces capture every LLM call, tool invocation, and agent decision
• AI guardrails detect anomalies and malicious prompts in real time
• Inference tables centrally log all agent inputs and outputs for audit trails
• Custom scorers and AI judges evaluate agent responses against expectations

Use model version pinning. LLM behavior can shift when providers release new models. Pin your agent to a specific model version and test regularly:

# Pin to a specific model version
agent = Agent(
  model="claude-3-5-sonnet-20241022",  # Fixed version, not latest
  # ... other config
)

Test your agent regularly to catch behavioral changes early.
Design tools carefully. Agent tools should be specific and constrained:

• Avoid tools that accept arbitrary code or SQL queries
• Use enums and strict inputs to limit what agents can do
• Add validation and error handling to prevent unintended side effects
• Document expected behavior so monitoring can detect deviations

Use cases

Data exploration and reporting. Deploy agents that query specific dashboards or tables to answer questions. Sandbox access to non-sensitive tables, approve modifications to reports, monitor for unusual queries.
Workflow automation. Use agents to automate repetitive tasks like data quality checks or data classification. Require approval for high-impact operations, sandbox to the target tables, and log all actions.
Customer support assistants. Deploy agents that help customers with common questions. Limit tool access to customer-specific data, monitor for off-topic or malicious prompts, and escalate to humans for complex issues.
Internal analytics assistants. Build agents that help teams analyze data. Use session-level approval for exploration, require per-execution approval for modifications, and audit all access.

FAQs

What is the difference between per-execution and session-level approval?

Per-execution approval requires you to approve each action the agent takes, so you maintain tight control but incur overhead. Session-level approval requires one approval at the start of a conversation thread, then subsequent actions are approved automatically until you press "+" to start a new thread. Use per-execution for high-risk operations and session-level for exploration and low-risk tasks.

Can agents modify production tables?

Only if you grant them permission and configure approval settings. Use Unity Catalog to grant agents access only to tables they should modify, and require approval before executing write operations. For read-only agents, grant only SELECT permissions.

How do I know if an agent is behaving unexpectedly?

Monitor MLflow traces and AI guardrails. Traces show every decision the agent makes; guardrails detect anomalies like prompt injection or unexpected behavior patterns. Set up alerts for unusual activity and escalate to humans if needed.

What happens if an agent makes a mistake?

If an agent modifies data incorrectly, you can roll back using Delta Lake's time-travel feature to restore the table to a prior state. This is why keeping audit logs and versioning agent tools in Unity Catalog is critical for recovery.

How do I deploy an agent to production?

Deploy agents as Databricks Apps, which handles authentication, compute, and governance. Databricks Apps integrate with CI/CD so you can test agents before promotion to production, monitor them after deployment, and roll back quickly if needed.