Databricks Unity AI Gateway Explained: Multi-Model AI Governance, and Cost Control

Announced and significantly expanded at the Data + AI Summit in June 2026, the Databricks Unity AI Gateway is a centralized runtime governance layer designed to manage, secure, and control costs for enterprise AI agents. In its architectural form, it operates as an enterprise-wide platform and control point built directly as an extension of Unity Catalog.

Rather than being a standalone application, it takes the form of a unified registry, APIs, and real-time guardrails (such as SQL-based contextual policies and hard spend caps) that govern live interactions across any model, agent, or Model Context Protocol (MCP) service.

While unveiled in mid-2026 with many of its core features currently rolling out in Beta or Public Preview, its implementation is highly immediate-usage billing for related AI tools like Genie transitions to a pay-as-you-go model on July 6, 2026, requiring the Gateway’s budget controls to manage enterprise spend.

What Unity AI Gateway Is

Unity AI Gateway is Databricks’ centralized runtime governance layer for AI agents, built as an extension of Unity Catalog. Where traditional governance answers “who can access this asset,” the Gateway answers a different question: “what is an AI system permitted to do during a live interaction.”

It governs models, agents, Model Context Protocol (MCP) services, and enterprise tools in real time, rather than at the point of static access grants.

Two architectural pieces anchor this:

• Agent Registry — a single system of record in Unity Catalog for every agentic asset, whether built on Databricks or on a third-party platform, giving organizations one place to discover and audit agents.
• Agent Memory Service — built on Lakebase (serverless Postgres), it lets agents persist session history and context across interactions inside a governed environment.

The Gateway also extends Unity Catalog governance to models (Databricks-hosted and external providers including OpenAI, Anthropic, Gemini, Grok, and Kimi), managed MCP services (Google Drive, Jira, Confluence, Slack, GitHub, SharePoint, Outlook), and reusable “AI Skills” published across an organization.

You’re centralizing governance and context delivery, not eliminating complexity.

Vadym Mariiechko

Data Engineer, Addepto

Read More

Vadym’s full breakdown of what Databricks Data + AI Summit 2026 actually means for your team: Databricks Data + AI Summit 2026: What’s Actually Happening →

The Four Governance Problems It Solves

The report frames 2026 as the year of an “AI cost explosion,” comparable to the cloud cost explosion of 2015 and the data pipeline explosion of 2020.

Four distinct problems fall out of that framing:

The context bottleneck

Agents hallucinate or fail without a shared source of business meaning. The Gateway addresses this through integration with Genie Ontology and Unity Catalog Semantics, grounding agent reasoning in governed business context rather than raw, ungoverned data access.

Runaway AI costs

Fragmented usage across model providers creates unmanaged token spend and “shadow AI.” The Gateway responds with unified financial controls: real-time spend visibility and hard spend caps across every model provider, including bring-your-own-key external connections. Budgets can be set by user, team, tool, or use case.

Actionable risk

Security has historically been inconsistent across agents that can push code, write to CRMs, or touch PII. The Gateway enforces contextual guardrails – runtime inspection and blocking of unsafe content or unauthorized tool invocations – plus Attribute-Based Access Control (ABAC) policies that can require human-in-the-loop approval before a sensitive action executes (e.g., an agent allowed to query a database but denied from a git push without sign-off).

Blind spots in observability and incident response

Without unified tracing, security teams can’t reconstruct what an agent actually did. The Gateway captures end-to-end traces of model interactions, reasoning paths, and MCP tool activity into Unity Catalog-governed inference tables, queryable via Genie in natural language, and integrated with Lakewatch (Databricks’ agentic SIEM), enhanced following the acquisition of Panther, for root-cause analysis of policy violations.

Implementing Unity AI Gateway in a Regulated Enterprise: The Governance Framework

In a regulated enterprise, the blocker to deploying agentic AI usually isn’t technical – it’s that legal, security, finance, and compliance teams won’t sign off on it without a unified governance layer to sit in front of it. Unity AI Gateway is built to be that layer.

Structured as a framework, the implementation breaks into five parts:

1. Centralize governance for every AI asset in Unity Catalog

Internal models, external APIs (OpenAI, Anthropic), MCP services, and individual agent skills all get registered in Unity Catalog rather than left scattered as shadow AI, so AI assets inherit the same permissions and lineage tracking the organization already applies to its data.

2. Enforce runtime contextual policies and guardrails

Access control alone isn’t enough in a regulated setting; the Gateway also needs to govern what a model or agent is allowed to do once it’s running. Contextual Service Policies (Beta) evaluate interactions in real time, built-in guardrails detect and block PII exposure, unsafe content, and prompt injections, while human-in-the-loop rules can require explicit sign-off before an agent takes a sensitive action, such as pushing code, editing a shared drive folder, or updating a CRM record.

3. Layer RBAC and ABAC for strict data isolation

Role-Based Access Control draws hard isolation boundaries for specific projects – clinical trials or country-specific regulated data are the clearest cases. Attribute-Based Access Control goes further, tying access rules to live user attributes synced from the enterprise identity provider (department, region, clearance level) and propagating those governed tags automatically through downstream data transformations.

4. Guarantee end-to-end auditing and observability

Every interaction – prompts, agent reasoning traces, model responses, tool calls, and policy decisions – lands in Unity Catalog-governed Inference Tables, producing an audit-ready record for compliance review. Streaming that same telemetry into Databricks Lakewatch (the agentic SIEM) gives security teams real-time alerts on PII leaks or policy violations and a basis for full incident investigation.

5. Integrate with the security stack already in place

None of this requires ripping out existing tooling. Identity providers – Okta, Ping Identity, Saviynt – let agents inherit exactly the access permissions of the human user they act on behalf of. Runtime security platforms, CrowdStrike, Zscaler, Palo Alto Networks (Prisma AIRS), get to inspect AI interactions and apply their own outcome-based controls on top of the Gateway’s.

Databricks Unity AI Gateway: Real-World Examples

Four organizations in regulated or compliance-sensitive sectors illustrate how this kind of governance plays out in practice.

Accolade (Healthcare)

Before Databricks, Accolade‘s member data was scattered across systems including AWS Redshift and Snowflake, a split that slowed care teams down and made it hard to categorize members accurately by health status and risk. Moving onto a Databricks lakehouse changed the operating model in two connected ways.

• First, Apache Spark handled continuous streaming ingestion so data no longer sat stale across silos.
• Second, Unity Catalog governed the result, structured and unstructured data, ML models, notebooks, dashboards, and files, all under one permission and lineage framework built to support HIPAA compliance.

On top of that governed base, Accolade’s team built a RAG assistant with Agent Bricks Custom Agents on DBRX, Databricks’ own open-source LLM, so internal staff could pull answers from PDFs, product protocols, and customer contracts instead of searching manually.

Once the model produced results, Databricks Model Serving deployed it as a REST API with version control and automatic scaling.

OMV (Energy)

OMV‘s sustainability team needed to process more than 100,000 pages of product certifications, research papers, and EU regulatory filings – a volume that had already defeated an earlier, less-governed attempt at generative AI.

The eventual build combined a multilingual embedding pipeline – BAAI’s BGE M3 model, chosen specifically to handle documents across EU languages – with a RAG chatbot built on Agent Bricks Custom Agents, routing queries to GPT-3.5 or GPT-4 depending on load, and refined over time through a human feedback loop against FAQ-style queries.

The governance detail that matters most for a regulated deployment sits underneath all of that: Unity Catalog controls exactly which users can reach which documents, so the chatbot only ever surfaces content a given user is cleared to see.

Santalucía Seguros (Insurance)

Santalucía, the Spanish insurer, in business for over a century, built a GenAI virtual assistant delivered inside Microsoft Teams so agents could get natural-language answers on products, coverage, and procedures around the clock, on any device.

The architecture runs as a Retrieval Augmented Generation pipeline deployed as an MLflow pyfunc model, on Santalucía’s Advanced Analytics Platform (Databricks plus Microsoft Azure).

Two operational governance details stand out: Databricks Model Serving centralizes the credentials, permissions, and token consumption for every third-party model the assistant calls, with credentials held in Azure Key Vault rather than in code; and no release reaches production untested.

Taken together, the throughline across all three sourced examples is the same one the Gateway’s framework formalizes: govern the catalog first (Unity Catalog access control scoped to what a user or role is cleared to see), then govern the interaction (evaluation gates, centralized credential management) – data governance and behavioral governance as two separate, necessary layers, not one blanket policy.