I am trying to restrict workspace users' access to Databricks Foundation Models using the guidance in the Foundation Model Unity Catalog Permissions documentation.

I have revoked EXECUTE permission for all users from the system.ai schema. However, workspace users can still successfully query foundation models via ai_query() using the databricks-* serving endpoint names:

-- This SUCCEEDS (should be blocked)
SELECT ai_query("databricks-claude-sonnet-4-5", "whats 1+1?") AS response

-- This FAILS with RESOURCE_DOES_NOT_EXIST
SELECT ai_query("system.ai.claude-sonnet-4-5", "whats 1+1?") AS response

The system.ai.* path returns a RESOURCE_DOES_NOT_EXIST error (which I assume is expected) after revoking EXECUTE. However, calling the same model via the databricks-* endpoint name bypasses the UC permission check entirely.

The documentation states: "Foundation model Unity Catalog permissions is generally available but requires enablement. Reach out to your Databricks account team to enable this feature."

What is the Foundation Model Unity Catalog Permissions feature called in Account Previews and how can it be enabled? So that the EXECUTE revoke on system.ai is enforced consistently across all access paths — including pay-per-token databricks-* endpoints called via ai_query().

Side question: does serverless compute bypass Unity Catalog permissions?