The least exciting page here. And the one that decides everything.
Nobody has ever been promoted for designing a permission model. And yet every data platform that fails fails here: two definitions of revenue, a table nobody owns, a dashboard built on an extract of an extract, an agent that answered a question it should never have been able to ask. Unity Catalog puts tables, files, models, dashboards, agents and the servers they call into one hierarchy with one privilege model, one lineage graph and one set of shared definitions.
It is included in the Premium and Enterprise tiers — no separate licence, you pay only for the compute and storage you use — and it is switched on automatically in new workspaces. So the decision was made for you. What is left is the design.
- main4 schemas
- sales18 objects
- order_linecertified
- customerpii tagged
- contractsvolume · 4,112 files
- financerestricted
- demand_forecastmodel · v7
- pricing_agentagent · governed
Everything lives in three levels.
Catalogue, then schema, then the object. That is the whole hierarchy, and it is worth internalising because every grant, every policy and every lineage edge is expressed against it.
An account-level registry of your catalogues, schemas, tables and permissions. One per account and region. The old Hive metastore still exists for estates not yet on Unity Catalog; new work should not go there.
The top level, and the unit of isolation. Catalogues can be shared across workspaces in the same account and region, which is how you give three teams their own workspace without three copies of the data.
Inside a catalogue, holding tables, views, volumes, functions and models. Most arguments about data architecture are really arguments about where the schema boundaries go, so draw them around ownership rather than around technology.
A table is structured data, Delta by default. A view is a saved query, read-only. A volume is governed storage for everything that is not tabular — PDFs, images, audio — which is how documents reach the AI functions under the same permissions as the tables.
Functions are reusable logic, and a function registered here can be published as a tool an agent may call. Models live in the registry inside Unity Catalog, inheriting its access control and lineage rather than sitting in a separate system with separate rules.
An agent is registered as a model, and the tools it uses are governed as MCP services, functions or connections. This is the part that is genuinely new, and the part most governance programmes have not caught up with.
Before you change a column, see who breaks.
Lineage here is automatic and column-level: not “this table feeds that one” but “this column feeds that calculation in that dashboard that the board reads on Mondays”. It covers AI assets as well as data, which is how an audit of an agent’s answer becomes possible at all.
Databricks positions lineage for impact analysis, troubleshooting, governance and AI audits. The one that earns its keep daily is the first: the question “if I change this, what breaks?” used to be answered by asking around and hoping. Now it is a screen.
Rules that still hold for next month's tables.
A permission model written object by object is obsolete the day someone creates a table. The shift worth making is from naming objects to describing them: write the rule against tags and attributes, let classification apply the tags, and the rule covers what does not exist yet.
So instead of “grant select on these forty tables to this group”, the rule is “columns tagged pii are masked for everyone outside Finance” — and the table created next Tuesday is covered because its email column gets classified and tagged on arrival.
- Grants on catalogues, schemas and objects, inherited downward.
- Row filters, so a regional manager’s query returns their region.
- Column masks, so a support agent sees the last four digits and no more.
- Policies written against attributes and tags rather than object names.
- Automated classification, so the tags arrive without a human cataloguing columns.
- Audit logging of what was read, by whom, and through which path.
What it governs, and what it cannot
Lakehouse Federation and foreign tables bring systems you have not moved — Snowflake, Redshift, BigQuery, SQL Server, Postgres, Glue, Hive Metastore — under this discovery and these controls when they are queried through Databricks.
What that does not do is make Databricks the enforcement point inside those systems. Someone connecting directly to that Postgres instance is governed by Postgres. Federation governs a path, not a database, and a governance programme that misses this distinction is telling itself a story.
Monitoring that surfaces where people look
Anomaly detection and freshness tracking, with trust signals shown where users and agents actually work rather than in a report only the data team opens.
One governance dashboard
Governance, cost and AI usage in one view, flagging gaps, risky access changes and policy drift — which is the difference between governance as a state and governance as an annual exercise.
Why three teams bring three revenue numbers.
Here is the thing almost nobody says out loud: in most of these arguments, everybody is right. Two correct calculations of two different definitions. Finance excludes intercompany; Sales does not. One counts on invoice date, the other on delivery. Neither is wrong and neither is reconcilable, because the rule lives in a dashboard rather than in the data.
Twelve versions of margin
- Each report author encodes the rule in their own query.
- A rule change means finding and editing twelve places, and missing two.
- A natural-language question gets whichever version the model inferred.
- An agent computes a thirteenth.
- Every meeting starts with a reconciliation instead of a decision.
One version, used by everything
- Metric views hold the measure, its dimensions and its rule once.
- A change is made in one place and every consumer follows.
- BI tools, Genie answers and agents all compute the same figure.
- Lineage shows exactly which definition produced a number.
- The argument moves from “whose number” to “what to do”.
If you take one thing from this section
Agree ten metric definitions before you build a single dashboard. Get the people who argue about them into one room, write the rules down, put them in the catalogue, and name an owner for each. It takes about two weeks and it is the highest-return fortnight in a data programme — because it is the only part that cannot be retrofitted without redoing everything built on top of it.
We run that fortnight as a fixed-scope piece of work, with the definitions as the deliverable. Ask us about it.
Governing AI is governing what it can reach.
An agent is not dangerous because it is clever. It is dangerous because it holds a credential. Unity Gateway applies the catalogue’s privileges at runtime to models, agents, tools and MCP servers — the same grants you use for tables and volumes, extended to the things that call them.
| Control | What it does | The problem it prevents |
|---|---|---|
| Access | Unity Catalog privileges over foundation models served natively, external providers connected with your own key, registered models, MCP servers, functions used as tools, and HTTP connections. Permissions can be set per group and per model. | A team quietly standing up its own provider account outside every control you have. |
| Rate limits | Consumption limits on model and MCP services, to manage both capacity and cost. | One retry loop in one notebook spending a month of budget overnight. |
| Budgets | Monitoring with per-user thresholds and hard caps, so spend has a ceiling rather than a report. | Discovering the number at the end of the month. |
| Guardrails | Service policies over request and response content, which can account for the caller’s identity. Built-in, custom and external policies are supported, including enforcing a third-party guardrail vendor’s decisions. | An agent repeating something back to a customer that should never have left the building. |
| Routing | Traffic splitting across model destinations, failover for availability, and Smart Routing that picks a model and harness per coding task to control spend. | A model choice baked into application code, which is the wrong place for a decision that changes quarterly. |
| Audit | Usage tracking in system tables — requests, tokens, latency — cost attributed to services, models, principals and tags, and request and response logging to Delta tables. | Being unable to answer, six months later, why the agent said that. |
One naming note, because it will confuse you otherwise: Databricks’ own pages use both Unity Gateway and AI Gateway, sometimes on the same page, and the relationship between the two names is not stated clearly anywhere. Treat them as the same control point until Databricks settles the naming. See Agent Bricks for what sits on top of it.
What governance makes possible.
Everything else on this platform assumes this layer has been designed rather than defaulted.
Genie
The place business users live: governed dashboards, natural-language questions answered from curated data, and the shared metric definitions that keep the answers consistent.
Read it →Artificial intelligenceAgent Bricks
A runtime for agents that survive a crash, memory and sessions, tools and MCP servers, search over your documents, traced runs and evaluation by judges and by your experts.
Read it →Sharing and collaborationOpenSharing
An open protocol for handing live tables, models and files to another company on another platform, with clean rooms for the work neither side may see, and a marketplace.
Read it →Where this leads next.
© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice
What people ask about governance.
Is Unity Catalog an extra licence?
No. Databricks includes it in the Premium and Enterprise tiers, and you pay only for the compute and storage you use. It is also switched on automatically in new workspaces, so for anything built from today it is not a decision — it is the default.
The work is not buying it. The work is designing the catalogue, schema and permission model it holds, which is the part that decides whether anyone trusts the platform in a year's time.
What does it govern besides tables?
Tables, views, volumes of files, functions, machine-learning models, dashboards, AI agents and MCP servers all sit in the same hierarchy with the same privilege model. That matters more than it sounds: an agent is only as safe as the permissions on the things it can reach, and governing the data in one system and the agents in another is how an agent ends up answering a question it should not have been able to ask.
Unity Gateway is the part that applies this at runtime to models, agents, tools and MCP servers, with guardrails, rate limits, budgets and usage tracking.
How fine-grained can access control get?
Beyond grants on a table there are row filters, column masks, and policies written against attributes and tags rather than object names — so a rule like "nobody outside Finance sees columns tagged pii" holds for tables created next month. Automated classification can apply the tags in the first place.
Lineage is column-level and automatic, which is what makes the rest usable: before you change a table you can see every dashboard, model and agent downstream of it.
Can we govern data that is not in Databricks?
Partly, and it is worth being precise about the limit. Lakehouse Federation lets you query MySQL, PostgreSQL, Redshift, Snowflake, Azure SQL, Synapse, BigQuery and others in place, with Unity Catalog's row, column and attribute controls applied to the query. Foreign tables bring catalogues such as Glue, Hive Metastore and Snowflake Horizon under the same discovery and permissions.
What that does not do is make Databricks the enforcement point inside those systems. Someone connecting directly to that Postgres instance is still governed by Postgres.
What are business semantics, and why would we bother?
They are shared definitions — what "active customer" means, how net revenue is calculated — held once in the catalogue instead of once per dashboard. Every BI tool, every Genie answer and every agent then computes the metric the same way.
It is unglamorous and it is the single highest-return thing on this page. Most of the arguments about whose number is right are not data problems; they are two correct calculations of two different definitions.
Two weeks on ten definitions.
We will get the people who disagree about your numbers into a room, write down what each metric actually means, put the definitions in the catalogue with an owner against each, and leave you with a permission model designed around ownership rather than around whoever asked first.
- Ten metrics, defined once and agreed
- Catalogue and schema boundaries drawn around ownership
- Tag-based policies instead of object lists
- Lineage you can answer impact questions from
- AI access governed before the first agent
Databricks, Lakehouse, Lakeflow, Lakebase, Unity Catalog, Genie, Agent Bricks, OpenSharing, Delta Sharing and Lakewatch are trademarks of Databricks, Inc. Apache, Apache Spark, Apache Iceberg and Spark are trademarks of the Apache Software Foundation. Delta Lake and MLflow are projects of the Linux Foundation. SAP, SAP Business Data Cloud and SAP Datasphere are trademarks of SAP SE. PostgreSQL is a trademark of the PostgreSQL Community Association. All other names belong to their owners. Mawkish Technologies is not affiliated with, endorsed by or a reseller for Databricks, Inc. Everything described here is taken from material Databricks publishes; product names, availability and prices change, so check the current documentation before you commit to anything. Screens shown are our own illustrations with sample data, not screenshots.
Our Linleigh Loop is the name we give to how we handle Databricks Unity Catalog: one accountable partner, from the first meeting to long after go-live.