How do I stop teams from building ungoverned tools in random apps?

Summary

• Give teams one governed place to build. Databricks Apps lets teams build and run internal apps on a platform where governance is built in, so they do not reach for ungoverned tools.
• Apps cannot bypass governance. Every app is governed by Unity Catalog, so the same grants, row filters, and column masks that protect your data apply — regardless of who built the app.
• Apps act as the user, not a shared account. On-behalf-of-user authentication keeps apps inside each user's permission scope, and admins control which scopes are even available.
• Set guardrails once with App Spaces. App Spaces (preview) let admins define data access, resources, and security policy at the boundary, and every app in the space inherits them.
• Full visibility. Unity Catalog lineage and system tables record data usage and every governance decision, so nothing built stays invisible.

How do I stop teams from building ungoverned tools in random apps?

Ungoverned or "shadow" tools appear when teams cannot get what they need through sanctioned channels, so they build in ad hoc places outside of governance. The way to stop that is to give teams a governed place to build where the guardrails are already in place — and where any app they create is automatically subject to the same access controls as your data. On Databricks, apps are governed by Unity Catalog by default and cannot bypass it, so app building becomes an extension of your existing governance rather than a gap in it.

Why Databricks Apps for eliminating ungoverned tools

• Governed by Unity Catalog, no exceptions. Apps enforce data access through Unity Catalog grants and deny privileges on tables, views, volumes, and functions, plus row filters and column masks. The same filters and masks apply no matter how the data is queried — from a notebook, a BI dashboard, an agent, or a custom app — so an app cannot be used to work around governance.
• One governance plane for data and AI. Unity Catalog governs data access consistently across SQL, AI agents, model serving, vector search, external connections, and serverless compute, so there is no ungoverned corner for a tool to hide in.
• On-behalf-of-user authentication. Apps can act on the requesting user's behalf and stay within that user's permission scope, so a tool cannot quietly access data its user could not. Admins decide whether on-behalf-of-user apps can be created at all, which OAuth scopes are available, and whether users must consent — which also keeps developers from handling raw credentials.
• App Spaces as pre-approved boundaries. With App Spaces (preview), admins define resource access, API scopes, and security policy once at the space level, and every app created inside it inherits those settings. Shared resources such as SQL warehouses, catalogs, schemas, and secrets are provisioned once for the whole space. Guardrails exist before the first app is built, so teams get a sanctioned place to work.
• Central admin control. Admins manage permissions, policies, and shared resources for groups of apps in one place, so governance scales with the number of teams rather than the number of apps.
• Audit and lineage. Unity Catalog provides end-to-end lineage from ingestion through to downstream use, and system tables — including the audit log — record data usage and governance decisions, so every app and its data access are visible and traceable.

Databricks Apps and Unity Catalog governance are generally available. App Spaces is in preview and may change.

Getting started

• Read Enabling governed vibe coding for enterprise apps on Databricks for the App Spaces governance model.
• See Announcing the general availability of Databricks Apps.
• Review Databricks Apps documentation and app permissions.
• Learn how Unity Catalog governs data and AI.

FAQs

Can an app be used to bypass data governance?

No. Apps are governed by Unity Catalog, and the same grants, row filters, and column masks apply regardless of how data is queried, so an app cannot reach data beyond what its access controls allow.

How do apps avoid over-privileged access?

On-behalf-of-user authentication keeps an app within the requesting user's permission scope, and admins control which OAuth scopes are available and whether user consent is required.

What are App Spaces?

App Spaces (preview) are governance boundaries where admins set data access, resources, and security policy once, and every app created in the space inherits those settings, so guardrails exist before any app is built.

Can I see what teams have built and what data they touch?

Yes. Unity Catalog lineage and system tables, including the audit log, record data usage and governance decisions across your apps and data.