Guardrails on AI services are built with these Beta Unity Catalog policies, which inspect every request and response and then allow or deny it. Grants differ: they only control who may call the service.
Read more: Databricks docs
In the Ultra Transcenders books
Each book explains Service policy in context, with comparison tables and the common traps.
Terms in this definition
- Unity Catalog
Azure Databricks' governance solution covering both data and AI in one place, with centralised permissions, auditing, data discovery and lineage.
- Deny
An Azure Policy effect that stops any create or update request that would break the policy.
- CONTROL
Granting this on a securable gives all other permissions on it too, making it the most powerful SQL permission. At database scope that includes UNMASK and ALTER ANY MASK. Warehouse access through the Admin, Member or Contributor workspace roles carries it.
Related terms
- ASK
An outcome a service policy can return, alongside ALLOW and DENY, that holds a tool call until a person approves it. It applies only to MCP Services, at the input phase.
- CEL
When you attach a service policy, Databricks converts the SQL body of its function into this expression language, which is why only part of SQL is supported. Testing the function exercises the SQL on its own.
- COALESCE
A SQL function that picks out the first non-NULL argument. CEL validation rejects a STRING cast inside the call, so a service policy function hands it the VARIANT field and casts what comes back.
- Log mode
A service policy setting that runs the evaluation and notes what the verdict would have been, but blocks nothing. Databricks advises using it ahead of Enforce, and you still pay for the evaluations.
- ON RESULT
The service policy phase that checks a service's response once it has been returned.
ON CALLis the equivalent on the input side. - Sensitive Data Detection
A Beta service policy,
system.ai.detect_sensitive_data, that Databricks provides ready-made. It deterministically spots PII and similar content going in or coming out, then masks or stops it, and MCP services can additionally pause the call pending approval. - Service policy DENY
Blocks an interaction while still answering HTTP 200, so monitoring built on status codes never sees it. A
databricks_service_policyobject and the assistant turn both name the responsible policy, and no later ranks run. - Service policy evaluator
The model behind an LLM-as-a-judge service policy, which assesses the content. A default is already chosen, and every check is charged as a normal call.