Databricks grounds Genie Agents in secure enterprise data

Databricks has updated its Genie Agents to analyze both structured data and unstructured files simultaneously while maintaining strict enterprise governance. Instead of relying on fragile prompt engineering to restrict what an AI model can see, the system routes all queries through Databricks Unity Catalog. This setup ensures that Genie Agents run directly under the end user's identity, making it impossible for the AI to retrieve or display information the user is not authorized to access.

For structured data, Genie Agents can query various assets, including managed, external, and foreign tables, as well as metric views and materialized views. To handle unstructured documents, practitioners can store files in Unity Catalog Volumes. The system supports a wide range of formats, including PDFs, Microsoft Office documents like DOCX and PPTX, plain text, Markdown, and images such as PNG and TIFF. Because permissions are applied at the volume level, users must have read access to an entire volume to use an agent connected to it.

Security is maintained through several Unity Catalog features, including Automatic Identity Management, which syncs user groups from Okta and Microsoft Entra ID. Access is further controlled using attribute-based access control, object privileges, row filters, and column masks. For example, if an organization has regional restrictions, a manager querying a sales table will only receive rows corresponding to their specific region, with sensitive columns like email addresses automatically masked.

This unified architecture simplifies the deployment of enterprise AI. Previously, developers had to build and maintain separate pipelines to bridge structured databases and unstructured document stores. By consolidating governance at the data layer, organizations can deploy a single Genie Agent that safely answers complex business questions using all available data sources, without the risk of data leaks or the need for complex, per-user prompt engineering.