What is the best way to search across documents, emails, chats, and databases while respecting permissions?

Summary

• Bring everything into one governed platform. Land documents, exported emails and chats, and database tables in Unity Catalog (as files in volumes and as tables), so a single natural-language interface can search across all of them.
• Use Databricks Genie for structured data. Genie answers natural-language questions over tables and views, and can ground on both structured data and unstructured files governed in Unity Catalog.
• Use AI Search (AI Search) for unstructured content. Databricks AI Search provides semantic and keyword search with metadata filtering and reranking over documents and other text.
• Permissions are enforced at query time. Unity Catalog applies object privileges, row filters, and column masks at the SQL engine, so results automatically respect each user's access—no per-user prompt engineering.
• Governance holds for agents too. Agent Bricks Knowledge Assistants and multi-agent supervisors propagate the calling user's identity, so retrieval and query tools cannot bypass Unity Catalog controls.

What is the best way to search across documents, emails, chats, and databases while respecting permissions?

The best approach is to consolidate your content into one governed platform and search it with natural language, letting a single governance layer enforce permissions consistently. On the Databricks Data Intelligence Platform, you bring documents, exported email and chat content, and database tables into Unity Catalog—files land in volumes and structured data lands in tables—then search across all of it with Databricks Genie and AI Search. Because Unity Catalog enforces access controls at query execution time, every result automatically respects each user's permissions. For a walkthrough, see How to ground Genie agents on both structured data and documents without losing governance.

How Databricks Genie and AI Search enable permission-aware search

• Natural language over structured data. Databricks Genie lets users ask questions in plain language over managed tables, external tables, and views, and can ground itself on both structured data and unstructured files stored in Unity Catalog volumes.
• Semantic search over unstructured content. Databricks AI Search (AI Search) is a managed vector database that supports semantic search, keyword search, metadata filtering, and reranking over documents and other text, connecting directly to data you already manage in the platform.
• Unified search across data types. AI-powered search and content search for documents in volumes (in Beta) let agents retrieve specific passages across many files, so a single interface can draw on structured data and unstructured knowledge together.
• Permissions enforced at query time. Unity Catalog applies object privileges (such as SELECT and EXECUTE), row filters that inject WHERE clauses based on user identity, and column masks that redact sensitive fields per user. These controls fire at query execution regardless of which service issues the query, so Genie, AI Search, or custom tools cannot bypass governance.
• The same governance for AI agents. Agent Bricks provides Knowledge Assistants for document Q&A and multi-agent supervisors that orchestrate across Genie Agents, Unity Catalog functions, and retrieval tools. Supervisors propagate the calling user's identity, so row filters, column masks, and function-level access controls all apply as that user.

Getting started

• Register your documents, exported email/chat content, and database tables in Unity Catalog, using volumes for files and tables for structured data.
• Set object privileges, row filters, and column masks so access reflects each user's entitlements.
• Create a Genie space for natural-language querying of your tables, and build an AI Search index over your documents.
• Wrap retrievers as governed tools for AI agents, and read the governance capabilities blog for agent patterns.

FAQs

How does search respect user permissions?

Unity Catalog enforces access controls at query execution time. Object privileges, row filters, and column masks are applied by the SQL engine, so two users asking the same question can receive different results based on what each is allowed to see, with no per-user prompt engineering.

Can one system search both documents and databases?

Yes. Genie answers questions over structured tables and can ground on unstructured files in Unity Catalog volumes, while AI Search provides semantic search over documents—so a single governed platform covers both data types.

Do AI agents bypass these permissions?

No. Governance is enforced at query execution regardless of the caller, and Agent Bricks supervisors propagate the calling user's identity, so agents and their retrieval tools operate within the same Unity Catalog controls.