What you will be able to do
- Explain why certification tags alone do not limit what an agent can retrieve
- Design catalog, schema and index grants that give an agent's principal only authoritative assets
- Tell apart privileges that expose data from privileges that only expose metadata or management rights
1.Certification ranks assets; privileges decide access
Unity Catalog lets you mark assets with system.certification_status = certified or deprecated. That mark is a trust signal. It shows up next to the asset and affects how the asset ranks in search. Databricks says it helps Genie One by prioritizing the assets your organization vouches for. Nothing in that description says it blocks a read. A deprecated table is still a readable table. What actually limits an agent is the Unity Catalog permissions model, which denies by default: users start with no access to data in a metastore, and every action needs an explicit grant.
This three-part rule is what you design around. The agent can retrieve from a table only if its principal holds USE CATALOG on the catalog, USE SCHEMA on the schema and SELECT on the table, all three together. If any one is missing, the table is outside the agent's retrieval space, no matter what it is called or how it is tagged.
Checkpoint 1 of 5· Check yourself
You tag a derived summary table as deprecated, but the agent's principal already holds USE CATALOG, USE SCHEMA and SELECT for it. What happens when the agent tries to read the table?
Certification is a trust signal. Access follows explicit privileges, and this principal already holds the grants a read needs.
“A user or group must be explicitly granted a privilege to perform an action.”Source: docs.databricks.com
2.Drawing the boundary around authoritative assets
Catalogs and schemas are containers, and grants on containers are inherited. A privilege granted on a container applies to all its current child objects and to all future ones. That is convenient, and it is also the main risk for an agent. Suppose you grant SELECT on a schema that holds authoritative tables, and later someone writes a derived table into that schema. The agent can read the new table immediately, without anyone granting it anything. The design response is to keep authoritative assets in their own catalog or schema, where derived assets cannot be created, and to grant the agent's principal privileges only there.
Be especially careful with the workspace catalog. In workspaces enabled for Unity Catalog automatically, all workspace users get USE CATALOG on it. They also get USE SCHEMA, CREATE TABLE, CREATE VOLUME and other create privileges on its default schema. That makes it a natural place for scratch and derived tables to pile up, so it is a poor boundary for authoritative content. Usage privileges also protect the boundary after deployment. Only catalog and schema owners, or users with MANAGE, can grant USE CATALOG and USE SCHEMA. So a table owner cannot quietly widen the agent's reach.
| Operation | Required privileges |
|---|---|
| Read data from a table or view | USE CATALOG on catalog, USE SCHEMA on schema, SELECT on table or view |
| Read files from a volume | USE CATALOG on catalog, USE SCHEMA on schema, READ VOLUME on volume |
| Execute a function | USE CATALOG on catalog, USE SCHEMA on schema, EXECUTE on function |
AI Search indexes (formerly Databricks Vector Search) follow the same model. The index is its own Unity Catalog securable. For a Databricks app's service principal, the docs require USE CATALOG on the parent catalog, USE SCHEMA on the parent schema, and SELECT on the index. Our sources show this requirement for apps, but the principle carries over: grant SELECT only on indexes built from authoritative tables, and the agent cannot reach a vector index built from a derived copy.
Checkpoint 2 of 5· Check yourself
You grant an agent's principal SELECT on the schema finance.curated. Next month an analyst creates a derived table in finance.curated. What can the agent do?
Privilege inheritance covers current and future children of a container. That is why derived assets must not be created inside the schema the agent can read.
“that privilege automatically applies to all current and future child objects”Source: docs.databricks.com
Checkpoint 3 of 5· Exam question
An AI Search deployment for a RAG agent must apply user-department-level security so that Finance users cannot retrieve HR documents, but Databricks AI Search does not support native row- or column-level permissions on its indexes. Which design correctly enforces this constraint before deployment?
Correct answer: A — Add a department metadata column to the source Delta table and apply it as a filter in the AI Search query API for every retrieval call
- A. Correct. Since AI Search lacks native row/column-level security, the documented application-level pattern is to tag rows with a security metadata column and enforce it via the query-time filter API on every call.
- B. Incorrect. Unity Catalog ACLs on the index govern who can manage or query the index object as a whole; they do not filter individual rows by a department value.
- C. Incorrect. Random selection provides no reliable access boundary and could just as easily return the wrong department's data.
- D. Incorrect. Embeddings capture semantic similarity, not access policy; they cannot reliably or deterministically exclude a department's records.
- E. Incorrect. Broad CAN MANAGE grants increase exposure rather than restrict it, and endpoint-level permissions do not implement row-level filtering.
3.Privileges that look like access but are not
Some privileges reveal assets without exposing their data. Databricks recommends granting BROWSE on catalogs to all account users to support discovery. BROWSE lets a principal see that an object exists, along with its name, description and tags, and request access. It does not grant access to the underlying data. MANAGE is about administration, not reading data: it covers managing privileges, transferring ownership and dropping objects. Even a principal with MANAGE still needs the usage privileges to SELECT.
Checkpoint 4 of 5· Match them up
Match each privilege to what it gives an agent's principal
Tap a term, then the definition that fits it.
Only SELECT, together with USE CATALOG and USE SCHEMA, puts table data in the agent's retrieval space. BROWSE exposes metadata, and MANAGE grants administrative control.
“BROWSE allows users to discover objects and view their metadata without granting access to the underlying data.”Source: docs.databricks.com
Sources3
4.Tag-driven policies and the pre-deployment audit
Explicit grants work well when authoritative assets live in a few dedicated schemas. When the boundary has to follow a classification instead, attribute-based access control (ABAC) is an option. ABAC policies use governed tags as attributes and attach at the metastore (Beta), catalog, schema or table level. One policy can then enforce the same rule across a whole catalog or schema. ABAC supports row filters, column masks, GRANT policies for dynamic privilege grants, and DENY policies (Beta). Read the DENY scope carefully: it denies MANAGE ACCESS CONTROL, not data reads. Our sources also do not say whether system.certification_status can be used as an ABAC attribute, so do not assume a certification tag can drive a policy.
Not as described. The documentation says DENY policies deny the MANAGE ACCESS CONTROL privilege. That is about who can manage access, not about reading data. To keep derived tables out of reach, do not grant the agent's principal usage and SELECT privileges on the containers that hold them.
Last, audit before you ship. Search certificationStatus:deprecated and confirm that nothing it returns sits inside a catalog or schema where the agent has usage privileges. Then query INFORMATION_SCHEMA.TABLE_TAGS in the agent's catalog to confirm that the tables it can reach carry the certified status you expect.
Checkpoint 5 of 5· Exam question
A team is building a Delta Sync Index in AI Search to serve as the retrieval source for a production agent. The pipeline currently syncs from a raw ingestion Delta table that has not yet passed data-quality checks and still contains unresolved duplicate records. To constrain the agent's retrieval space to authoritative data before deployment, what should the index sync from instead?
Correct answer: A — The curated, quality-checked Delta table that represents the authoritative version of the data
- A. Correct. Pointing the Delta Sync Index at the curated, quality-checked table ensures the retrieval space reflects the authoritative data rather than unresolved, duplicate-laden raw records.
- B. Incorrect. Syncing more frequently only refreshes stale, unvalidated data faster; it does not address the underlying data-quality and duplication problem.
- C. Incorrect. Unioning raw and curated data reintroduces the unresolved duplicates and quality issues into the retrieval space rather than excluding them.
- D. Incorrect. The reranker orders retrieved results by relevance; it is not a data-quality or governance control and cannot remove duplicate or unvalidated records from the index.
- E. Incorrect. An older snapshot of the same unvalidated raw table still contains the underlying quality problems and is not an authoritative source.
Sources5
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.Tagging derived tables as deprecated stops the agent from retrieving them.Why is that wrong?
Certification is a trust signal used for prioritization and display. What an agent can read is decided by explicit Unity Catalog privileges.
Covered in Certification ranks assets; privileges decide access
2.A schema-level SELECT grant covers only the tables that exist when you grant it.Why is that wrong?
Container grants are inherited by future child objects too, so derived tables created later in that schema become readable.
3.Granting BROWSE on a catalog lets an agent retrieve the data in it.Why is that wrong?
BROWSE exposes names, descriptions and tags only. It does not give access to the underlying data.
Covered in Privileges that look like access but are not
4.An ABAC DENY policy can block an agent from reading specific tables.Why is that wrong?
As documented, DENY policies (Beta) deny the MANAGE ACCESS CONTROL privilege, not data access.
Practise it for real
Mark an authoritative table and a derived table in a sandbox catalog, then confirm the status before you scope an agent's grants.
1.Run SET TAG ON TABLE with
system.certification_status=certifiedon the table your agent should rely on.Why: This records the asset as authoritative, so search and Genie One can prioritize it.
You should see: If you lack ASSIGN on the governed tag, the command fails. Otherwise the table shows a check mark in the workspace.
2.Run the same command with
deprecatedon a derived summary table.Why: This flags the derived asset so consumers avoid it in new workflows.
You should see: The table shows a restricted icon.
3.In workspace search, run type:table certificationStatus:certified and then certificationStatus:deprecated.
Why: This checks the inventory you will use to draw the grant boundary.
You should see: Each table appears under its status. Updates can take a few minutes to show up in search results.
4.Query INFORMATION_SCHEMA.TABLE_TAGS in the catalog you plan to grant the agent.
Why: This audits tags with a query, so you can compare them against the containers the agent's principal will have USE CATALOG and USE SCHEMA on.
You should see: Rows for the system.certification_status tag on each tagged table you have privileges to see.
Stuck? Get a nudge
If a deprecated table shows up in a schema you plan to grant, move or exclude it before you grant anything. The tag alone will not keep the agent out.
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.
“Initially, users have no access to data in a metastore.”
↩︎ Certification ranks assets; privileges decide access“All workspace users receive the USE CATALOG privilege on the workspace catalog.”
↩︎ Drawing the boundary around authoritative assets - 2.
“These signals appear next to the asset in the workspace and influence how it surfaces in search”
↩︎ Certification ranks assets; privileges decide access - 3.https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control/permissions-conceptsOfficial docs
“this prevents table owners from granting access outside approved boundaries”
↩︎ Drawing the boundary around authoritative assets“BROWSE is granted at the catalog level and applies to all objects within that catalog.”
↩︎ Privileges that look like access but are not“A user or group must be explicitly granted a privilege to perform an action.”
↩︎ Exam trap 1“that privilege automatically applies to all current and future child objects”
↩︎ Exam trap 2“BROWSE allows users to discover objects and view their metadata without granting access to the underlying data.”
↩︎ Exam trap 3“Having only the SELECT privilege on a table is not sufficient to read it if you lack USE CATALOG or USE SCHEMA”
↩︎ Prediction“A user or group must be explicitly granted a privilege to perform an action.”
↩︎ Checkpoint“that privilege automatically applies to all current and future child objects”
↩︎ Checkpoint“BROWSE allows users to discover objects and view their metadata without granting access to the underlying data.”
↩︎ Checkpoint - 4.
“the USE SCHEMA privilege on the parent schema, and the SELECT privilege on the index”
↩︎ Drawing the boundary around authoritative assets“Databricks AI Search was formerly known as Databricks Vector Search.”
↩︎ Drawing the boundary around authoritative assets - 5.
“These attributes, represented through governed tags, are used in policy conditions to identify which data a policy should protect.”
↩︎ Tag-driven policies and the pre-deployment audit“a single policy can enforce consistent access rules across an entire metastore, catalog, or schema.”
↩︎ Tag-driven policies and the pre-deployment audit“How to create and manage DENY policies (Beta), which deny the MANAGE ACCESS CONTROL privilege on supported securable types.”
↩︎ Exam trap 4