Databricks published a production pattern for Genie Agents that routes all governance enforcement through Unity Catalog instead of the model layer. The pattern directly rejects what Databricks calls a "dangerous bet": relying on prompt engineering and LLM instructions to restrict what an agent returns.
The core principle is credential passthrough. Genie Agents run as the end user's identity, not a service account with broad permissions. Every query executes under that user's existing object privileges, ABAC policies, row filters, and column masks. The agent cannot return rows the user cannot see—no prompt engineering required.
Identity synchronization uses Automatic Identity Management (AIM), which syncs users, groups, and service principals from Microsoft Entra ID or Okta. Just-in-time provisioning means a first-time user arrives with their IdP group memberships already attached. When an employee moves between org units, the IdP update propagates and their next Genie query reflects new access scope. Deactivating them in the IdP revokes all Genie access immediately.
Structured grounding covers the full Unity Catalog asset roster: Managed Tables, External Tables, Foreign Tables, Views, Metric Views, Materialized Views, and Streaming Tables. Metric Views encode business metrics—revenue formulas, KPI calculations—once in YAML so every consumer, human or agent, computes them identically. Foreign Tables extend the pattern to federated systems without copying data. Four layered controls enforce access: Object Privileges control SELECT on resources; ABAC policies match which rules apply to which user attributes; Row Filters restrict returned rows at query time; Column Masks redact values at the data layer.
| Control Layer | What It Enforces | Where It Acts |
|---|---|---|
| Object Privileges | SELECT (and other DML) access on specific Unity Catalog resources | Resource level |
| ABAC Policies | Which access rules apply, matched against user attributes | Policy evaluation |
| Row Filters | Restricts which rows are returned to the requesting user | Query execution time |
| Column Masks | Redacts or transforms column values for the requesting user | Data layer / output |
Unstructured data flows through Unity Catalog Volumes, allowing a single agent to answer across structured tables and document collections—PDFs, logs, unstructured files—without a separate RAG pipeline outside the governance boundary. Volume access controls mirror table query controls.
Most enterprise agent implementations grant the agent a service principal with wide permissions and filter outputs via system prompt. This makes the LLM the security perimeter. Databricks is blunt: telling an auditor that restricted data is protected by system prompt is not a defensible control. Models can be manipulated. Prompt injection is real.
| Dimension | Traditional (Service Principal + Prompt) | Unity Catalog Credential Passthrough |
|---|---|---|
| Agent identity | Broad-permission service principal | End user's own identity |
| Security perimeter | LLM / system prompt | Data layer (Unity Catalog) |
| Access enforcement | Prompt engineering & output filtering | Object privileges, ABAC, row filters, column masks |
| Prompt injection risk | High — model is the control | Mitigated — data layer ignores prompt manipulation |
| Auditability | Hard to defend to auditors | Governed by existing enterprise data controls |
| Threat model | LLM manipulation breaks the perimeter | Perimeter survives model compromise |
The constraint is that this pattern requires Unity Catalog governance to be well-configured already. AIM and ABAC only enforce what identity and policy definitions exist. Architects shipping agents into Databricks environments with inconsistent object privileges or stale groups surface those gaps immediately. The agent faithfully enforces whatever access policies exist—correct or not. This pattern is not a governance shortcut; it is a governance multiplier.
Treat the security perimeter question as a first-class design decision, not a patch. If your agent's answer to "what can this user see?" lives in a system prompt, your threat model is wrong.