Databricks Summit 2026 shows agentic AI needs governance

At a glance

What this is: Databricks Data + AI Summit 2026 is positioning production-scale agentic AI around open sharing, federated governance, and transactional support for agents.

Why it matters: For IAM and security teams, the key issue is that AI infrastructure now needs identity, access, and governance controls that keep pace with autonomous workloads and cross-platform data use.

By the numbers:

• The event features more than 800 sessions across four days, underscoring the scale of production AI discussion.
• Databricks presented more than 65 partner awards before the sessions began, reflecting a broad ecosystem focus around production AI.

👉 Read Trust3's analysis of Databricks Summit 2026 and production AI governance

Context

Enterprise AI infrastructure is moving beyond experimentation, but governance is not keeping pace with the rate at which data, models, and agents are being connected across clouds and teams. In practice, the hardest problems are now identity and access related: what an AI agent can reach, how that access is governed, and whether runtime actions stay inside policy boundaries.

This Summit framing matters because the article is not really about a conference programme, it is about the control plane for production AI. Where organisations are already using agents or planning to operationalise them, the question shifts from whether the technology works to whether the surrounding governance model can see, limit, and audit what those systems do.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do data governance gaps become identity risk for AI programmes?

A: Because AI systems inherit trust from the identities that access and route data into them. If human users, service accounts, or agents can reach data without clear lifecycle controls, the AI layer inherits that exposure. The result is not just poor data hygiene, but a governance failure that affects decision quality and accountability.

Q: What breaks when AI asset sharing does not include provenance controls?

A: Recipients may trust an AI model, skill, or file without knowing who produced it, what it contains, or which permissions were attached to it. That turns portability into exposure. Provenance controls are the difference between controlled distribution and uncontrolled reuse across cloud and partner environments.

Q: How do security teams decide whether an AI agent needs PAM-style controls?

A: Use PAM-style controls when the agent can reach sensitive systems, modify data, trigger administrative actions, or inherit privileges that exceed its task scope. The deciding factor is not whether the system is called an AI agent, but whether its actions can change operational state in ways that need tighter approval and session control.

Technical breakdown

OpenSharing and secure cross-organisational AI asset exchange

OpenSharing extends the idea of data sharing from tables and files to AI assets such as models, agent skills, and unstructured content. The technical shift is important because sharing becomes protocol-based instead of integration-specific, which reduces the need for bespoke connectors. The governance challenge is that asset portability also broadens the identity surface: access rights, trust boundaries, and recipient validation now apply to AI artefacts as much as to data sets. If the receiving environment cannot verify who or what is allowed to consume the asset, portability becomes a control problem rather than an efficiency gain.

Practical implication: treat AI asset sharing as an access-control and provenance problem, not just a data exchange pattern.

Federated Catalog governance across AWS Glue and Snowflake

Federated cataloging allows external catalogs to remain in place while Unity Catalog applies policy, lineage, and auditing across them. That is a useful pattern for hybrid and multi-cloud environments because it avoids data duplication while maintaining a central governance layer. For security teams, the architectural question is whether policy enforcement remains consistent when the governed object is external. If identity, entitlements, and audit logs are fragmented across systems, the federation layer can only partially close the gap. Centralized visibility matters most when data is queried by both humans and agentic systems.

Practical implication: validate that entitlement mapping and audit coverage remain intact when governance extends to external catalogs.

Lakebase and the transactional layer for agentic workloads

Lakebase is aimed at the operational side of agentic AI, where systems must write state, update records, and trigger actions at low latency. That is a different workload profile from analytical lakehouse querying, and it introduces new governance needs around write authority, rollback, and concurrency. Agents that can modify records behave more like privileged actors than passive consumers, which means their access must be scoped, monitored, and revocable. The technical issue is not only performance. It is whether the database layer can safely support autonomous action without creating persistent, over-broad privilege.

Practical implication: model agent write access as privileged operational access and apply tighter policy than for read-only analytics.

NHI Mgmt Group analysis

Open standards for AI assets are becoming an identity governance issue. OpenSharing matters because it turns models, agent skills, and unstructured AI artefacts into portable objects that move across organisations and clouds. That improves interoperability, but it also expands the trust boundary that IAM and PAM teams must govern. The practical conclusion is that AI asset portability now needs provenance, entitlement checks, and recipient validation as first-class controls.

Federated governance exposes the limits of fragmented identity models. When external catalogs remain in place but policy is enforced centrally, the real test is whether identity, lineage, and audit evidence stay coherent across systems. This is especially relevant for NHI and agentic AI programmes because automated systems often inherit access paths that were never designed for autonomous use. Practitioners should treat federation as a governance integration challenge, not a simple visibility feature.

Agentic workloads create a new class of operational privilege. Once AI systems can write state and trigger actions, they begin to resemble privileged service identities rather than passive analytics consumers. That shifts the control discussion from data access alone to scoped execution, revocation, and runtime monitoring. The named concept here is agentic write privilege: when autonomous systems can modify operational records, the governance model must be closer to PAM than traditional BI access control. Practitioners should classify these permissions as high-risk and short-lived.

The governance gap is now between infrastructure readiness and behavioural control. The article is right to emphasise that production AI needs more than performant storage or cross-cloud sharing. What is missing in many programmes is a control layer that can see which agents exist, what they can access, and how their decisions are constrained at runtime. The implication for identity leaders is clear: production AI adoption should trigger an entitlement review, not just an architecture review.

Linux Foundation stewardship signals a standards race, not a vendor feature race. OpenSharing being hosted as a top-level project suggests the market is moving toward shared protocols for AI assets rather than closed integration stacks. For practitioners, that raises the bar for governance because standards adoption will not eliminate the need for policy, it will increase the number of places policy must be enforced. Teams should prepare for a more interoperable but more complex AI control environment.

What this signals

Agentic AI is now a permissions problem as much as a model problem. The practical shift for security teams is that AI adoption cannot be measured only by model performance or platform scale. The control question is whether identities, entitlements, and runtime actions are bounded tightly enough to prevent autonomous systems from accumulating invisible privilege.

AI asset interoperability will accelerate governance sprawl unless teams standardise policy at the identity layer. As sharing protocols, federated catalogs, and write-capable databases converge, the programme risk moves toward inconsistent policy enforcement across systems. Teams should expect more pressure to prove who can do what, where, and under which delegated authority.

70% of organisations grant AI systems more access than they would give a human employee performing the exact same job. That gap suggests most programmes still treat AI access as an extension of application access, when it increasingly behaves like a separate privileged identity class. The near-term priority is to align access scope with task scope before scale multiplies the blast radius.

For practitioners

• Define AI asset trust boundaries Classify models, agent skills, and unstructured AI artefacts as governed assets with explicit owner, consumer, and approval metadata before enabling cross-organisational sharing.
• Map external catalog entitlements end to end Verify that identity mappings, access checks, and audit trails remain consistent when data is queried through federated catalogs such as AWS Glue and Snowflake.
• Treat agent write permissions as privileged access Scope agentic systems to the narrowest possible operational records, require approval for write-capable workflows, and review revocation paths before production rollout.
• Add runtime monitoring for autonomous actions Track which agents are active, what data they access, and which actions they execute so policy drift is visible before it becomes operational risk.
• Reassess third-party AI consumption controls Require provenance checks and access policy for externally sourced AI models or skills, especially where multiple clouds or partners are involved.

Key takeaways

• Production AI is shifting the security question from deployment speed to governed access.
• Interoperable sharing and federated catalogs improve scale, but they also widen the identity surface that teams must control.
• Once AI systems can write state or trigger actions, they should be governed as privileged identities with strict scope and revocation.

Key terms

• Agentic Write Privilege: The ability of an AI system to modify records, trigger workflows, or change operational state. This is higher risk than read-only access because the system can create direct business impact, so it should be treated like privileged access with tight scope, monitoring, and revocation.
• Federated Catalog Governance: A control model in which metadata, policy, lineage, and auditing are enforced across catalogs that remain in separate systems. It reduces data movement, but it only works when identity mapping and entitlement enforcement stay consistent across every participating platform.
• AI Asset Provenance: Evidence that shows where an AI model, skill, or related artefact came from, who produced it, and what permissions or constraints were attached to it. Provenance helps teams decide whether an asset can be trusted, shared, or executed in a governed environment.
• OpenSharing: An open protocol concept for sharing AI assets across organisations, platforms, and clouds without forcing a common vendor stack. Its value is interoperability, but the security burden shifts to policy, provenance, and access control at the receiving boundary.

What's in the full article

Trust3's full article covers the operational detail this post intentionally leaves for the source:

• The full Summit breakdown of OpenSharing, including how the protocol extends sharing to AI models, agent skills, and unstructured assets.
• The practical governance implications of catalog federation across AWS Glue and Snowflake, including how access and auditing are expected to work.
• The Lakebase details on transactional AI workloads, including throughput claims and why write-heavy agent applications change database governance.
• The source article's framing of production AI infrastructure, partner ecosystem context, and what Databricks expects practitioners to prioritise next.

👉 Trust3's full article covers OpenSharing, federated catalog governance, and Lakebase in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It is designed for practitioners who need to connect identity control to broader security programmes.