Prevent Access to AI Functions Execution

Raman_Unifeye
Honored Contributor III

As a workspace Admin, I want to prevent unexpected API costs from unrestricted usage of AI Functions (AI_QUERY() etc.), how can we control that only a particular group-users can execute AI Functions ?

I understand the function execution cost can be viewed from https://docs.databricks.com/aws/en/large-language-models/ai-functions#-view-costs-for-ai-function-wo... but perhaps it will be too late 😉

Best Practice and guidelines pls.


RG #Driving Business Outcomes with Data Intelligence

iyashk-DB
Databricks Employee
Databricks Employee

Hi @Raman_Unifeye ,
For PT (Provisioned Throughput) endpoints, on the UI, you will have an option to edit "Permissions" and set a specific User/Group that can query them. You will have to assign that group "Can Query" permission. By Default all Admins will have access to this.

Screenshot 2025-11-24 at 11.28.41 PM.png

 Thanks,
Yashwanth

Raman_Unifeye
Honored Contributor III

@iyashk-DB - can you pls elaborate on it. I am looking to turn it off for all of Databricks AI Functions usage - https://docs.databricks.com/aws/en/large-language-models/ai-functions#-task-specific-ai-functions


RG #Driving Business Outcomes with Data Intelligence

iyashk-DB
Databricks Employee
Databricks Employee

@Raman_Unifeye , you will be disabling access to the endpionts that will be used inside the ai_query() function. It is not something like disabling the function, but managing the endpoint's access to the Users/groups who can and cannot query them.

Raman_Unifeye
Honored Contributor III

ok, so it has to be done at individual end-point and function level 😒


RG #Driving Business Outcomes with Data Intelligence

Nothing at the function level, but yes this has to be done to each endpoint