How to ground Genie Agents in both structured data and documents without losing governance
Databricks integrates Genie Agents with Unity Catalog to unify structured and unstructured data analysis while enforcing existing governance policies without additional setup.
Databricks has extended its Genie Agents to operate across both structured data sources—such as Managed Tables, External Tables, and Metric Views—and unstructured files in Unity Catalog Volumes. This allows a single agent to analyze diverse data types while inheriting governance controls from the existing catalog layer. The approach eliminates the need for separate systems to bridge structured and unstructured data, simplifying architecture and reducing integration time from weeks to days.
Governance for Genie Agents is enforced through Unity Catalog’s existing mechanisms, including Automatic Identity Management (AIM), Object Privileges, Attribute-Based Access Control (ABAC), Row Filters, and Column Masks. These controls ensure agents operate under the end user’s identity and permissions, preventing unauthorized data exposure. The governance framework relies on precise identity synchronization and continuous enforcement, shifting security responsibility from the model layer to the data layer.
The governance foundation begins with Automatic Identity Management, which syncs user identities, group memberships, and service principals from Microsoft Entra ID and Okta into Databricks without requiring SCIM applications. This ensures identities remain current, enabling immediate access adjustments when roles change or employees leave. For example, an employee transferring from APAC to AMER automatically gains access to regional data aligned with their new role, while departing employees lose all access instantly.
For structured data, Genie Agents can query any Unity Catalog asset, including Delta tables, Metric Views, and federated foreign tables. Governance is applied through row filters, column masks, and ABAC policies, which can be defined once and applied universally using governed tags. This approach reduces configuration overhead, as new tables inherit protections automatically. For instance, a regional manager’s queries are filtered to show only their region’s orders, with sensitive columns like customer emails masked, ensuring compliance with existing access policies.