| → / Space | Next slide |
| ← | Previous slide |
| Home | First slide |
| End | Last slide |
| Swipe | Touch navigation |
One governance model for business users and AI agents alike, whether access originates internally or through a partner or customer's own identity provider.
The entry point. The domain decks that follow go deep on each governance area referenced here.
Business users and AI agents both need governed access to the same data, internally and through external partner/customer identity providers, without a separate trust model per surface.
One trust boundary, three token paths, seven enforcement layers, and a resource lens for what's being accessed.
Consistent governance regardless of surface, a single control plane for audit and compliance, and faster delivery of new AI surfaces.
A map to the 11 topic decks (02 through 12) that cover implementation detail for each domain.
Ask plain-English questions, build dashboards, and work through Genie Agents, copilots, and agents. Each expects to see only the data their own permissions allow.
Orchestrate tools and call data on a user's behalf. Partners and customers need the same capabilities, reached through their own portals and their own identity providers.
Databricks enforces authorization in exactly one place: Unity Catalog. Authentication can originate from the workspace identity provider for internal users, or from an external IdP via token federation for partners and customers. Every path converges on UC before any data or tool is touched.
Same governance, regardless of which door the identity walked in. Data, tools, and agents all check the same UC privileges.
U2M, OBO, and M2M are token acquisition paths, not separate authentication systems. What changes is whose identity Unity Catalog sees.
| Path | Who authenticates | Identity in UC |
|---|---|---|
| U2M | The human, directly | The human |
| OBO | The human, via an app that forwards the token | The human |
| M2M | The application itself (service principal) | The service principal |
| Layer | Governs |
|---|---|
| 1 · Identity | Agent service principal, user OBO, token federation |
| 2 · Permission | UC privileges on tables, functions, and services (MCP, model) |
| 3 · Data | Row filters, column masks, ABAC, BROWSE privilege |
| 4 · Execution | Model Serving, Apps, serverless sandboxing |
| 5 · Service Policy | ABAC governance: who calls what tools, on which data (guardrails built-in, enforced ON CALL/ON RESULT, fail-closed) |
| 6 · Content | AI Gateway guardrails: hallucination detection, safety, PII handling |
| 7 · Audit | system.access.audit, MLflow traces, inference tables |
MCP Services and model services are UC securables with governed tags, role-based access, and service policies. PostgreSQL (Lakebase) uses native PG authorization (roles, GRANT, RLS) — the exception to the UC model.
The same rules apply whether the surface is Genie Agents, Teams, a custom app, or a partner portal. No per-integration reinterpretation of who can see what.
One control plane to prove compliance against: system.access.audit and MLflow traces cover every surface, not a bespoke log per integration.
New AI surfaces plug into the same identity and authorization model instead of re-solving it, so teams ship faster without reopening the trust question.
| Deck | Covers |
|---|---|
| Unity AI Gatewayunity-ai-gateway.html | Routing, rate limits, guardrails, spend caps, MCP Services |
| Identity & Auth Foundationsidentity-auth-foundations.html | U2M/OBO/M2M in depth, one authentication layer |
| Authorization by Resource Typeauthorization-by-resource.html | The full resource-authorization matrix |
| Orchestration & Tool Governanceorchestration-tool-governance.html | Agent Bricks, MCP, service policies |
| Cross-IdP Federationcross-idp-federation.html | Token exchange across identity providers |
| SP & M2M Identitysp-m2m-identity.html | Governance for service principals and machine identities |
| UC Connectionsuc-connections.html | Unity Catalog HTTP Connections to external services |
| UC Governanceuc-governance.html | Row filters, column masks, ABAC |
| Agent Cost Governanceagent-cost-governance.html | Cost control for agentic workloads |
| AI/BI Dashboard Embeddingaibi-dashboard-embedding.html | Embedding dashboards for foreign identity providers |
| Teams/Copilot Studio → Genie Agents OBOteams-copilot-genie-obo.html | Per-user identity from Teams and Copilot Studio |