TL;DR: Enterprise context, policy guardrails, lineage, and runtime trust signals can follow data and agents into production as Collibra and Databricks expanded bi-directional governance across Unity Catalog, Genie, and Agent Bricks, according to Collibra. That matters because agentic AI fails quickly when metadata, access boundaries, and accountability are fragmented across platforms.
At a glance
What this is: This is a partnership expansion that pushes governance, lineage, policy, and runtime trust signals into Databricks agentic AI workflows.
Why it matters: It matters because IAM, IGA, and NHI teams need governance to travel with AI agents at the point of action, not sit in a separate catalogue.
Context
Agentic AI governance only works when the system that decides, the data it touches, and the controls that constrain it stay aligned. In practice, that means business definitions, access boundaries, lineage, and usage signals have to be available inside the runtime where agents actually act.
This article is about extending that governance model into Databricks so enterprise context can move with data into Unity Catalog, Genie, and Agent Bricks. The identity question is no longer just who can access the platform, but what an agent is authorised to do with governed context once it is there.
Key questions
Q: How should security teams secure AI agents and integrations in Databricks environments?
A: Security teams should treat AI agents and integrations as active access paths, not passive connections. The priority is to inventory every user, agent, and third-party link, enforce least privilege on workspace and data access, and continuously monitor behaviour for risky data flows or compromised accounts. Strong programmes combine posture hardening, identity threat detection, and continuous compliance across the full SaaS and data stack.
Q: Why do autonomous agents create more risk when metadata and lineage are fragmented?
A: Because the agent can still act on authorised access while making decisions from stale or incomplete business context. Fragmented metadata breaks the connection between what the data is, who owns it, and how it may be used, which turns valid access into unsafe action.
Q: What are the signs that agentic AI is drifting away from the rules it was designed to follow?
A: The clearest signs are stale outputs, inconsistent decisions, and behavior that no longer matches the workflow the agent was built to execute. The article also points to hidden risk when agents quietly substitute scraped information for verified data. Monitoring should check whether the agent actually followed the intended steps, not just whether it produced an answer.
Q: How do data governance controls differ from agent authorisation controls?
A: Data governance defines meaning, ownership, quality, and policy context for the data estate, while agent authorisation governs what an AI system may do with that context at runtime. In agentic environments, both must work together or the agent can remain technically authorised but operationally unsafe.
How it works in practice
Bi-directional governance between Collibra and Databricks
The integration described here is bi-directional: governed metadata, semantic definitions, and policy context move from Collibra into Databricks, while lineage and observability signals move back into Collibra. That matters because agentic AI does not operate safely on static catalog entries alone. It needs an execution-time view of sensitivity, ownership, and approved meaning, while governance teams need feedback from runtime behaviour to validate whether policy is actually holding. In identity terms, this is a control loop across authorisation, consumption, and evidence rather than a one-way sync of metadata.
Practical implication: Treat metadata synchronisation as a governance control loop, not a catalog integration.
How Unity Catalog, Genie, and Agent Bricks change trust boundaries
Unity Catalog provides the technical anchor, but Genie and Agent Bricks extend the trust problem into natural-language analytics and autonomous execution. Once agents can query governed definitions, check quality scores, and validate access boundaries in-line, the control point shifts from platform perimeter to policy enforcement at consumption time. This reduces ambiguity, but it also makes governance dependent on the freshness and completeness of the contextual layer. If business definitions or lineage are stale, the agent may still act within policy syntax while violating business intent.
Practical implication: Validate that the contextual layer is current before allowing agents to act on it.
Runtime trust signals for agent behaviour
The article also describes operational trust signals from Agent Bricks, including pass rates, assessment status, token-consumption trends, and unmonitored agents. Those signals are not just telemetry; they are evidence that an AI agent is staying within its intended behaviour envelope. For governance teams, that means trust has to be measured continuously, not inferred from approval at deployment time. The important technical shift is from provisioning-time confidence to runtime evidence, especially when agent decisions can cascade into reports, workflows, or transactions.
Practical implication: Use runtime trust signals to detect drift before autonomous actions compound.
NHI Mgmt Group analysis
Agentic AI governance fails when business context and runtime execution are separated. Collibra and Databricks are responding to a control problem that spans data governance and identity governance at once: agents need certified meaning at the moment of action, not after the fact. When the context layer is disconnected from the execution layer, policy becomes descriptive instead of enforceable. Practitioners should treat governed context as part of the control surface, not just reference data.
Approval at build time is not enough for autonomous systems. The article’s emphasis on runtime trust signals is the right direction because autonomous behaviour can drift after deployment even when the original configuration was correct. That means governance assumptions based on static certification, periodic review, or catalogue completeness are too weak for agentic operations. The implication is that control evidence has to come from live behaviour, not only from declared permissions.
Context drift is the new identity risk surface for agents. A named concept emerges here: governed context drift. It describes the gap that appears when access is technically valid but the underlying definitions, lineage, or quality signals no longer match how the agent is making decisions. This is a governance problem, but it behaves like an identity problem because the agent acts on behalf of the organisation. Practitioners need to track drift as a first-class control failure.
AI oversight will increasingly sit inside the data platform, not beside it. The market signal here is that agent governance is being pulled into the same environment where data consumption happens. That will pressure IAM, IGA, and data governance teams to converge on shared evidence, shared policy vocabulary, and shared runtime signals. The organisations that keep these controls separate will find that neither platform governance nor identity governance can explain what an agent actually did.
From our research library:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
- Read next: Agentic AI Identity Guide
What this signals
Governed context now has to travel with execution. For IAM and IGA teams, the key programme shift is that authorisation decisions for agents cannot be separated from the definitions, lineage, and ownership data the agent relies on. If the context layer lags behind the runtime layer, policy may still exist but it no longer governs the action the agent takes.
Governance evidence must become continuous. Agentic systems create a new expectation that trust signals, not just access grants, should be monitored as operational controls. Collibra and Databricks are pointing toward a model where runtime visibility is part of the control plane, which means governance teams need to watch for drift, not just misconfiguration.
Governed context drift: When an agent acts on technically valid access but obsolete definitions or lineage, the failure is not permission alone, it is meaning becoming stale. That creates a governance gap that looks like access success while producing business-risky decisions.
For practitioners
- Map governed context to runtime decisions Identify where certified definitions, ownership, and quality signals need to be available at the exact point an AI agent consumes data or selects a tool.
- Tie agent approval to live evidence Require runtime trust signals such as pass rates, assessment status, and unmonitored-agent detection before allowing autonomous workflows to expand.
- Audit stale meaning in agent workflows Review where business definitions or lineage can drift away from current data usage, especially when natural-language interfaces are used for analytics and actions.
- Separate platform access from governance truth Do not assume that visibility into a platform equals governance control across the data estate; verify that ownership, classification, and policy context are synchronised.
Key takeaways
- Agentic AI governance breaks down quickly when business context, lineage, and policy controls are not available at the point of execution.
- The partnership extends oversight from catalogued data into production agent behaviour, where runtime signals reveal whether controls are actually holding.
- Practitioners should focus on synchronising context, monitoring agent drift, and treating runtime trust evidence as part of the identity control surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic systems here depend on privileged data and tool access governed at runtime. |
| Recommendation — Limit agent privileges to approved tasks and revoke any expansion that is not continuously justified. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agents and supporting identities should not accumulate broader access than the workflow requires. |
| Recommendation — Review and reduce agent access scopes to prevent unnecessary privilege growth. | ||
| NIST AI RMF | MANAGE — AI Risk Management and Governance | The article focuses on runtime oversight, traceability, and continuous trust management for AI systems. |
| Recommendation — Implement ongoing AI risk monitoring with evidence from production behaviour, not deployment approval alone. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about authorising AI access to data and actions inside a governed platform. |
| Recommendation — Continuously validate entitlements for AI agents and align them to approved business use cases. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Runtime misuse of credentials and tool access is the threat pattern most closely adjacent to the article’s controls. |
| Recommendation — Map agent misuse paths to credential access and lateral movement so detection covers tool-driven abuse. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Governed Context: The approved business meaning, labels, and boundaries that shape how an AI system interprets data before acting on it. When context is governed, the organisation is not only controlling access to information, but also controlling what the system can infer, combine, and operationalise from that information.
- Runtime Trust: Runtime trust is the idea that access should remain valid only while current context justifies it. Instead of trusting a setup decision indefinitely, teams continuously re-evaluate whether a workload or agent still deserves privilege. This approach is especially important for AI agents that can change behaviour mid-task.
- Context Drift: Context drift is the gap between what an identity was authorised to do at the start of a session and what it ends up doing after inputs, tools, or instructions change. In agentic systems, it is a core governance problem because behaviour can move outside the original approval boundary.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org