---
title: "Stop rogue AI: How Unity Catalog secures your agent actions"
description: "Agentic AI systems connected to external tools can take destructive production actions while operating within delegated authority, yet without restrictions on tool selection or records of their calls. Unity Catalog now governs MCP tools with fine-grained access control, service policies, and payload logging, while Unity AI Gateway enforces decisions in real time. Policies are SQL functions receiving actor and context information; they can allow, deny, or require user consent, inspect arguments and caller properties, and block calls before execution. Every tool call is recorded in a Unity Catalog-managed Delta table with the tool name, arguments, result, user identity, and allow-or-deny status, making the activity queryable with SQL. The service policies and payload logging are available as a Gated Beta, with early access offered through Databricks account teams."
---

# Stop rogue AI: How Unity Catalog secures your agent actions

[Databricks](https://yomu.fyi/company/databricks) · Ahmed Bilal · May 19, 2026

**Type:** Problem & solution

## Summary

Agentic AI systems connected to external tools can take destructive production actions while operating within delegated authority, yet without restrictions on tool selection or records of their calls. Unity Catalog now governs MCP tools with fine-grained access control, service policies, and payload logging, while Unity AI Gateway enforces decisions in real time. Policies are SQL functions receiving actor and context information; they can allow, deny, or require user consent, inspect arguments and caller properties, and block calls before execution. Every tool call is recorded in a Unity Catalog-managed Delta table with the tool name, arguments, result, user identity, and allow-or-deny status, making the activity queryable with SQL. The service policies and payload logging are available as a Gated Beta, with early access offered through Databricks account teams.

## Context

Agents connected to MCP servers may have access to every exposed tool once authorized, including destructive operations, with no way to restrict actions by tool, caller, or circumstances. Tool calls also do not appear in model or application logs, leaving no record for investigation after an unexpected action.

## Approach / What changed

Register MCP servers in Unity Catalog, define SQL service policies that evaluate actor and context details, and attach those policies to MCP services in Unity AI Gateway. The gateway evaluates each call in real time, allowing, denying, or requiring consent, while automatically recording tool-call payloads and outcomes in a Unity Catalog-managed Delta table.

## Takeaways

- Service policies can block specific MCP tools, such as file deletion, or restrict actions like pull-request merges to approved engineers.
- Policies can inspect tool arguments, caller properties, and other context properties, and may allow, deny, or require user consent for each call.
- Payload logging records tool name, arguments, result, user identity, and allow-or-deny status in a queryable Delta table.

**Tags:** [MCP](https://yomu.fyi/topic/mcp), [Security](https://yomu.fyi/topic/security), [Unity AI Gateway](https://yomu.fyi/topic/unity-ai-gateway), [Unity Catalog](https://yomu.fyi/topic/unity-catalog)

- Source: [Databricks](https://www.databricks.com/blog/stop-rogue-ai-how-unity-catalog-secures-your-agent-actions)
- Source URL: https://www.databricks.com/blog/stop-rogue-ai-how-unity-catalog-secures-your-agent-actions
- Ingested by Yomu: 2026-08-31T03:34:07.938Z

[Read original post](https://www.databricks.com/blog/stop-rogue-ai-how-unity-catalog-secures-your-agent-actions)