Most access requests still go through a person hand-writing Terraform off a Slack message and hoping the scope matches what was actually asked for.

I spent the weekend building a pipeline that closes that gap. A Databricks Unity Catalog access request goes from an ADO ticket to an applied grant, with an actual LLM agent doing the validation in between, and a human still required to review and merge every single change before anything touches Databricks.

How it works: someone submits a request through a form, that opens an ADO ticket. A webhook wakes up an Azure AI Foundry agent, it checks the request against live Unity Catalog and decides if it holds up. If it does, it opens a GitHub PR with its reasoning written into the description. Someone reviews it and merges. CI applies the grant, ticket closes itself out.

The design choice I'm most confident about: the agent has exactly 3 tools, and none of them can touch production. It can read the ticket, check Unity Catalog, and open a PR. That's it. It proposes, a human merges. No credential anywhere in the system lets it apply anything on its own.

What I like most about the result: every grant now traces back to a ticket, a PR with the agent's actual reasoning attached, and a person who approved it. That audit trail didn't exist before.

All built on a small personal Azure setup, not an enterprise budget. Functions, AI Foundry, Terraform CI/CD.

Repo's here if anyone wants to look at the code: https://github.com/vijayakunuri1/unity-catalog-governance-agent

If you're doing access governance today: is a narrow-tool agent with a hard human gate something you'd actually trust in your pipeline, or does "agentic" only make sense once it can act without you?