Slide decks covering identity, federation, authorization, orchestration, Unity Catalog governance, agent cost governance, AI governance patterns and well-architected deployments on Databricks.
Your organization needs an AI platform where business users ask questions in plain English and get governed answers from live data. Where knowledge workers search across documents and institutional memory using natural language. Where multiple AI agents collaborate (one retrieves data, another reasons over it, a third takes action), all coordinated by a supervisor. And where a tool layer connects these agents to your data, APIs, and business logic.
Internal teams will use it daily. But the harder ask is already on the table: partners, customers, and regulated subsidiaries need the same capabilities, through their own portals, authenticated by their own identity providers, without ever getting accounts on your platform.
Same data. Same AI capabilities. Same governance guarantees. Two completely different identity worlds.
On Databricks, this means Genie Agents for natural language analytics, Vector Search for knowledge retrieval, Agent Bricks for multi-agent orchestration, MCP servers for tool governance, UC HTTP Connections for governed external service access, Unity Catalog for data access control, and AI Gateway for model traffic management. The decks below show you how to govern all of it.
The single control plane for AI traffic: routing, rate limits, guardrails, spend caps, and MCP Services.
U2M, OBO, and M2M token paths, and how Unity Catalog acts as the single authorization boundary regardless of path.
How authorization differs across Genie Agents, UC Functions, Vector Search, MCP Services, Tables, and Lakebase.
Agent Bricks orchestration, the three MCP types, service policies for tool-calling agents, and the 2026 build direction: Genie Agents, custom agents on Databricks Apps, and the Supervisor API deprecation.
Propagating a real end-user identity from an external app and IdP through to Unity Catalog enforcement.
One SP per service, purpose-scoped groups, client-credentials flow, and RLS behavior under M2M.
Governed access to external services through Unity Catalog connections, without static secrets.
Model routing, per-agent rate limits, hard spend caps, guardrails, approval gates, and sandbox isolation, plus which coding-agent runtime to pick: Omnigent or ug.
Embedding a dashboard in an app whose identity provider differs from the Databricks account's, without a second login.
Bringing per-user identity into Genie Agents from Microsoft Teams and Copilot Studio, and the publish-mode setting that can quietly override it.
Which identity each AI service honors, the three proxy types, confused-deputy prevention, and the chain of custody from human to tool to SQL. Companion to the Service Identity and Audit doc.
The IdP-agnostic identity chain end to end: what is in the token at each stage, the enforcement points, a failure decision tree, and how IdP config maps to Databricks config. Companion to the Production Federation Guide.
Route Claude Code, Codex, and other coding agents through Unity Gateway for identity, governed MCP tools and Skills, usage visibility, and cost control. Companion to the ug quickstart.