What does "Agent-Ready Data Governance" actually mean in production?

[Bitrip007]

Databricks introduced several governance capabilities for the agentic era, including Unity Catalog Business Semantics, AI Gateway, and agent-ready governance.

My question is:

In a large enterprise with 20+ business domains, how are you governing:

• Agent permissions
• Tool permissions
• Vector Search access
• Business glossary
• MCP tools
• Prompt governance
• Cross-domain reasoning

Would love to hear how people are implementing this in production.

[iyashk-DB]

"Agent-ready data governance" is mostly marketing language for applying existing Unity Catalog primitives to AI workloads. The actual production mechanics are less novel than the branding suggests. Here's how each of your items maps to what's really available:

Agent permissions and tool permissions. Agents deployed as model serving endpoints run under a service principal. You scope that service principal's UC privileges exactly like you would a Spark job: GRANT EXECUTE ON FUNCTION for UC functions used as tools, SELECT on tables the agent needs, and endpoint-level ACLs for the serving endpoint itself. For MCP tools, they can be registered as Unity Catalog securables and governed with the same grant/revoke model. One service principal per agent (or per agent group) makes this manageable across 20+ domains.

Vector Search access. UC governs the index at the schema level, CREATE TABLE privilege is required to create one, and endpoint-level ACLs control who can query it. The big limitation to know upfront: row/column-level security is NOT supported on Vector Search today. If you need data isolation within an index (e.g., one index serving multiple domains with different access rights), you have to implement filtering at the application layer using the filter API rather than relying on the platform to enforce it.

Prompt governance. This is handled through AI Gateway guardrails. You attach service policies to a model service or MCP service endpoint. Policies run on both input and output, and you can layer built-in ones (PII detection, jailbreak detection, unsafe content) with custom ones backed by a UC function. For cross-domain deployments, you configure different policies per endpoint rather than one global policy.

Business glossary. Unity Catalog's Business Semantics (formerly "AI-ready metadata") lets you attach natural-language descriptions, synonyms, and semantic labels to tables and columns. This is what feeds Genie and helps agents understand what data means without you hardcoding it in every prompt. Governance here is just standard UC metadata management.

MCP tools. Registered through AI Gateway as UC securables. You control which identities can invoke which MCP server, apply service policies per server, and track usage through system tables. The pattern teams are using in production is to register one MCP server per domain and grant access to agents in that domain's service principal group.

Cross-domain reasoning. This is the least mature piece and the most architecture-dependent. The platform doesn't have a native concept of "cross-domain agent federation." What you actually build is either a supervisor/orchestrator agent that routes to domain-specific agents, or a single agent with tools spanning multiple domains where access is controlled at the tool/function level. The governance in that case is: does the agent's service principal have privileges on all the UC objects across the domains it needs to touch? That's a grant management question, not a new feature.

In practice, teams handling 20+ domains are leaning heavily on groups and group-based grants rather than per-agent grants, and using separate catalogs or schemas per domain so you can apply coarse-grained catalog/schema-level grants without managing hundreds of object-level permissions.

[empire_labs]

Great thread and iyashk-DB's breakdown is solid on the mechanics. 
One thing worth adding from running this in production at enterprise scale, the piece most teams miss (myself included, first time round) is the evidence layer, 
agent-ready governance isn't just configuring grants and policies, it's being able to prove they held at any point in time.

Three practical additions:
1. Build your agent activity query set early.
The system tables are your raw material for audit: system.access.audit (service_name aibiGenie, aibiMCP, 
aiAgentFramework), system.access.assistant_events, system.access.column_lineage. 
Standardize the queries you run monthly before an auditor asks — you don't want to be reverse-engineering 
event schemas under deadline. Start here:
https://docs.databricks.com/aws/en/admin/system-tables/
https://docs.databricks.com/aws/en/admin/system-tables/audit-logs

2. Map agent governance to controls, not features.
For SOC 2 / ISO 27001, auditors don't care about "AI Gateway guardrails" as a noun,
they care about the control: who can invoke what, with what data, and evidence that it was enforced. 
Keep a mapping doc: agent/tool/vector-index → service principal → UC grants → guardrail policy → system-table evidence query. 
Review it on the same cadence as your other access reviews. 
The AI governance guide is a good frame for this:
https://docs.databricks.com/aws/en/ai-gateway/ai-governance

3. Watch for drift between policy and reality.
The risk isn't the initial grant model, it's the accumulation of exceptions (temporary grants, new MCP servers, 
new tools registered). A monthly diff of "what's registered as a securable vs. what's actually being invoked" catches exceptions before 
they become audit findings. For MCP specifically:
https://docs.databricks.com/aws/en/ai-gateway/govern-mcp-service

The 20-domain question really is a grants-management + evidence-management problem, not a platform feature problem, which is good news: the fundamentals (groups, catalogs per domain, service principals per agent) scale cleanly and the system-table audit trail gives you the proof layer on top.

[kartikchoudhary]

One thing I’d be interested in hearing from teams running this across multiple business domains is how they handle business ownership and consistency of definitions. Technical access controls can restrict what an agent can see or invoke, but how are organizations ensuring that the agent interprets metrics and business terms consistently across domains?

Especially when the same metric can have different definitions across finance, sales, or operations, is the business glossary becoming part of the governance process rather than just metadata?