security framework for AI

Summary

• A security framework for AI maps the components of an AI system to the risks at each component and the controls that reduce them. Databricks publishes the Databricks AI Security Framework (DASF), which is platform-agnostic.
• DASF 2.0 identified 62 technical security risks mapped to 64 recommended controls across 12 AI system components. DASF v3.0 (March 2026) adds agentic AI as a 13th component, bringing the framework to 97 risks and 73 controls.
• On Databricks, Unity Catalog governs data and AI assets with privileges, attribute-based access control, lineage, and audit logging. Unity Gateway governs the runtime interactions between models, agents, MCP servers, and tools.
• Unity Gateway service policies, which add content guardrails and can pause an MCP request for user approval, are in Beta.

security framework for AI

A security framework for AI answers three questions: what are the parts of an AI system, what can go wrong at each part, and which controls reduce each risk. Databricks answers with the Databricks AI Security Framework (DASF), a platform-agnostic compendium of risks and controls, and with Unity Catalog and Unity Gateway capabilities that implement many of them.

What is the Databricks AI Security Framework?

DASF 2.0, announced on February 12, 2025, enumerates 12 canonical AI system components, their risks, and actionable controls. It identifies 62 technical security risks and maps them to 64 recommended controls. It also maps to frameworks including MITRE ATLAS, OWASP, NIST, ISO 42001, and the EU AI Act.
DASF v3.0, announced on March 20, 2026, covers agentic AI as its 13th system component. It adds 35 technical security risks and 6 mitigation controls, bringing the full framework to 97 risks and 73 controls. The new component covers the agent core, MCP servers (the tool interface), and MCP clients (the connection layer). Databricks highlights least privilege for tools, human-in-the-loop oversight, sandboxing and isolation, guardrails, and observability.

Which capabilities should a platform provide?

Capability	What Databricks documents
Access control for data and AI assets	Unity Catalog privileges, attribute-based access control (ABAC) with row filter and column mask policies, and workspace bindings
Sensitive data discovery	Data Classification uses an agent to automatically classify and tag tables, and ABAC can build controls on the results
Lineage	Lineage down to column level, plus model services and external model providers governed through Unity Gateway
Runtime control of AI services	Unity Gateway access control, rate limits, traffic routing, monitoring, and service policies (Beta)
Audit	The system.access.audit system table (Public Preview) and Unity Gateway inference tables
Secrets	Secret scopes stored in an encrypted database managed by Databricks, with secret values redacted when displayed
Network isolation	Customer-managed VPC, front-end and back-end Private Link, IP access lists, and serverless egress control
Encryption	Customer-managed keys for managed services and workspace storage, and optional encryption of traffic between worker nodes
Compliance	The compliance security profile, required for data regulated under standards such as HIPAA and PCI-DSS

How does Databricks approach security for AI?

The AI governance guide calls Unity Gateway the control plane for AI and outlines four steps: govern access to AI assets in Unity Catalog, route and control AI traffic with Unity Gateway, apply service policies to requests and responses, and monitor usage and cost.
Unity Catalog governs the assets. It is the unified governance layer for data and AI. It enforces access control when you query a table or call a model, tracks lineage, and logs activity for auditing. AI assets are securable objects, so you grant and revoke access with the same privileges you use for tables and volumes. ABAC uses governed tags to enforce row filter and column mask policies on tables, materialized views, and streaming tables.
Unity Gateway governs runtime interactions. It extends governance beyond your data and AI assets to the runtime interactions between models, agents, MCP servers, and tools. Rate limits cover model services (requests and tokens per minute) and MCP services (requests per minute), and a service that exceeds a limit returns HTTP 429. Service policies return ALLOW or DENY, and on MCP services also ASK, which pauses a request for user approval before the tool runs. Policy evaluation fails closed, so an error results in DENY, and service policies do not replace Unity Catalog grants. An account admin enables the Beta capabilities from the Previews page.
Platform security sits underneath. The security docs cover authentication and access control, networking, data security and encryption, secret management, and compliance. The Databricks Trust Center covers Databricks' own certifications and attestations.

FAQs

How do I limit what data an agent can reach?

Grant the agent's identity only the Unity Catalog privileges it needs. For agents on Model Serving, automatic authentication passthrough runs the agent with the permissions of the user who deployed it. On-behalf-of-user authentication (Public Preview) runs it with the permissions of the end user making the request.

Can I trace which AI services depend on which data?

Unity Catalog records lineage for queries, including column-level detail. It also captures lineage for the model services and external model providers you govern through Unity Gateway.

Is traffic between cluster worker nodes encrypted by default?

No. The docs say that by default, data exchanged between worker nodes in a cluster is not encrypted. You can enable it with an init script, which requires the Enterprise plan, and the compliance security profile enforces instance types for inter-node encryption.

When do I need the compliance security profile?

Enabling it is required if you use Databricks to process data regulated under standards such as HIPAA, PCI-DSS, HITRUST, FedRAMP Moderate, or FedRAMP High. The docs list the full set of supported standards.

How do I restrict outbound access from serverless compute?

Serverless egress control manages outbound network connections from serverless compute and requires the Enterprise tier. Full access allows unrestricted outbound access. Restricted access limits connections to Unity Catalog external locations and explicitly defined destinations.