How should we govern data and context for AI agents?

Summary

• Treat governing AI agents as a data-governance problem: keep governance in the catalog layer so it scales with the agent, rather than bolting controls onto each model.
• With Unity Catalog, data, models, agents, tools, and MCP servers are all governed objects under one permission, lineage, and audit model.
• Agents run with on-behalf-of identity, so row filters and column masks enforce the calling user's permissions at the query engine level — if a user cannot see data, neither can the agent acting for them.
• Define business context once as governed assets (for example, metric views and semantic definitions) and reuse it across dashboards, Genie, and agents so answers stay consistent.
• Ground retrieval in governed data: vector search indexes inherit row-level security from their source tables, and every agent interaction is captured in lineage and audit logs.

How should we govern data and context for AI agents?

The most durable way to govern AI agents is to treat it as a data-governance problem rather than a separate AI system. When governance lives in the catalog layer that already controls your data, it scales with the agent and applies automatically to whatever the agent reads, retrieves, or calls. On Databricks, Unity Catalog governs data and AI assets together, agents run with the identity of the user they act for, and business context is defined once and reused — so agents work from trusted, consistent information. See governing AI agents at scale with Unity Catalog.

How to govern data and context for AI agents on Databricks

• Govern data and agents in one model. Unity Catalog treats data, models, agents, tools, and MCP (Model Context Protocol) servers as first-class governed objects, secured with familiar privileges — for example, SELECT on tables and views, EXECUTE on functions, and use permission on connections — and tracked with shared lineage and audit. See AI governance on Databricks.
• Ground agents in governed lakehouse data. Point agents at governed structured data (tables, views, metric views) and unstructured files in Unity Catalog volumes, so a single agent can answer across data types without leaving the governance boundary. See how to ground Genie agents in structured data and documents without losing governance.
• Enforce the user's permissions with on-behalf-of identity. When an agent acts on behalf of a user, its access evaluates against that user's identity: row filters and column masks fire at the query engine level no matter which service — Genie, Agent Bricks, a custom agent, a notebook, or a BI tool — issues the query. If a user cannot access a table or a masked column, the agent acting for them gets the same boundary.
• Curate business context once, reuse it everywhere. Define business semantics as governed assets — metric views and semantic definitions — and reuse them consistently across AI/BI dashboards, Genie, and agents. This gives agents accurate, shared definitions and avoids semantic drift between tools.
• Keep retrieval inside the governance boundary. Vector search indexes inherit row-level security from their source tables, so retrieval-augmented agents use the same grant model as the underlying data and stay grounded in quality-controlled information.
• Trace and audit every interaction. Every agent read, retrieval, and tool call is recorded, so you can reconstruct the path from source data to an answer; when an agent requests something it has not been granted, Unity Catalog denies the read and the audit log records the identity, the object, the time, and the deny decision.

Getting started

• Read governing AI agents at scale with Unity Catalog for the core patterns.
• Learn how AI governance works on Databricks and set privileges for data, models, tools, and MCP servers.
• Adopt an organization-wide data and AI governance strategy so agents inherit the same controls as your data.
• See how Agent Bricks provides a governed enterprise agent platform for building and running agents on business data.

FAQs

What is the best way to govern data for AI agents?

Govern it in the catalog layer. With Unity Catalog, data, models, agents, tools, and MCP servers are governed objects under one permission, lineage, and audit model, so controls scale with the agent rather than being reapplied to each model.

How do I stop an agent from seeing data a user shouldn't?

Run the agent with on-behalf-of identity. Row filters and column masks enforce the calling user's permissions at the query engine level, so if a user cannot access a table or column, the agent acting for them cannot either.

What does "context" mean for AI agents, and how is it governed?

Context is the business meaning and data an agent uses — metric views, semantic definitions, documents, and retrieval sources. Define these once as governed assets in Unity Catalog and reuse them across dashboards, Genie, and agents for consistent, accurate answers.

Does retrieval-augmented generation stay governed?

Yes. Vector search indexes inherit row-level security from their source tables, so retrieval uses the same access controls as the underlying data, and every interaction is captured in lineage and audit logs.