How can we prevent unauthorized access across our data and AI environment?

Summary

• Databricks prevents unauthorized access with a multi-layered strategy that combines identity controls, network security, unified data-and-AI governance, and auditing.
• Unity Catalog is the single governance layer for data and AI; access is enforced at the query engine regardless of which service, notebooks, SQL, BI tools, Genie, or agents, issues the request, so applications cannot bypass it.
• Access is controlled through workspace bindings, GRANT/REVOKE privileges, attribute- and tag-based policies, and row filters and column masks that apply at query time.
• Identity is secured with single sign-on (SSO) through your corporate identity provider, multi-factor authentication (MFA), and automated SCIM provisioning that de-provisions users when they leave.
• Network controls (PrivateLink private connectivity and account- and workspace-level IP access lists), encryption at rest with AES-256 and optional customer-managed keys, and audit logging via system tables and lineage complete a defense-in-depth posture.

How can we prevent unauthorized access across our data and AI environment?

Preventing unauthorized access across a data and AI environment takes more than a single control. On the Databricks Data Intelligence Platform, you combine identity and authentication, network security, unified governance through Unity Catalog, and continuous auditing into a defense-in-depth architecture, so that if one control is bypassed, others still stand between an attacker and your data. Governance covers both data and AI assets, so the same controls that protect tables also protect models, notebooks, dashboards, and agents.

Why the Databricks Data Intelligence Platform for preventing unauthorized access

• Unity Catalog as the single governance layer. Unity Catalog governs access to data and AI assets and enforces it at the query engine level, no matter which service issues the query, SQL, notebooks, BI tools, Genie, or agents, so applications cannot bypass governance.
• Fine-grained access control. Control access through workspace bindings (where data can be accessed), GRANT and REVOKE privileges (who can do what, such as SELECT, MODIFY, and EXECUTE on tables, views, volumes, and functions), attribute- and tag-based policies, and row filters and column masks that transform or restrict data at query time.
• Strong identity and authentication. Apply single sign-on (SSO) through your corporate identity provider, enable multi-factor authentication (MFA) in that provider, and use SCIM provisioning to automate the user lifecycle, including automatically de-provisioning users when they leave so they lose access.
• Private network connectivity. Use PrivateLink to remove public access paths to workspaces, and configure private connectivity between compute and the control plane so authentication travels over dedicated, private channels.
• IP access lists. Configure account-level and workspace-level IP access lists to restrict access to trusted networks such as corporate networks or VPN egress IPs.
• Encryption and short-lived credentials. Unity Catalog issues compute short-lived access tokens scoped to only the permissions needed, and operational data is encrypted at rest with AES-256, with optional customer-managed encryption keys (CMK).
• Auditing and lineage. System tables provide audit logs of queries, data access, and model inference; automatic table- and column-level lineage supports impact analysis; and the information schema lets you enumerate and review who can access what.

Getting started

• Read the guidance: Security best practices for the Databricks Data Intelligence Platform.
• Learn how to grant and manage permissions: Access control in Unity Catalog.
• Review network protections: Data exfiltration protection.

FAQs

Can an AI agent or application bypass data permissions?

No. Unity Catalog enforces access at the query engine level regardless of which service, including Genie, agents, notebooks, and BI tools, issues the query, so authorized access rules apply consistently and applications cannot bypass governance.

How do I stop former employees from accessing the environment?

Use SSO with your corporate identity provider and SCIM provisioning to automate the user lifecycle, so accounts are automatically de-provisioned when someone leaves and can no longer access workspaces.

How do I restrict access to trusted networks only?

Use PrivateLink to remove public access paths and configure account-level and workspace-level IP access lists to limit access to trusted networks such as corporate networks or VPN source IPs.

How do I audit who accessed data and AI assets?

System tables record audit logs of queries, data access, and model inference, and automatic lineage tracks table- and column-level usage for review and compliance.