# Databricks AI Security Leap
_Databricks' Omnigent introduces intent-based authorization to prevent AI agents from executing off-task actions, even when their identity permits them._
**Published:** 2026-07-23
**Source:** https://www.startuphub.ai/ai-news/technology/2026/databricks-ai-security-leap
---
Databricks is rolling out a new security layer for its AI agents designed to tackle a fundamental flaw in current authorization models. Traditional systems verify who can access what, but not why. This oversight allows malicious instructions, hidden within data an AI agent processes, to trick it into performing unauthorized actions, as detailed in their [blog post](https://www.databricks.com/blog/permission-isnt-purpose-intent-based-authorization-omnigent).

AI Agent VulnerabilityDriver

traditional systems verify who can access what, not why an action is takenFrom the article 9+ mentionsDatabricks is rolling out a new security layer for its AI agents designed to tackle a fundamental flaw in current authorization models.leads toPrompt Injection RiskDrivermalicious instructions hidden in data trick agents into unauthorized actionsFrom the article 2 mentionsPrompt injection attacks exploit the agent's inability to distinguish between data to process and instructions to follow.exploitsIdentity-Based FlawDriveragent executes off-task actions if identity permissions allow itFrom the article 2 mentionsWhen an attacker embeds instructions within this data, the agent might execute them if its identity-based permissions allow it.addressed byOmnigent Security LayerCoreFrom the articleDatabricks is rolling out a new security layer for its AI agents designed to tackle a fundamental flaw in current authorization models.usesIntent-Based AuthorizationCoreevery AI agent action must align with a clearly declared purposeFrom the article 5 mentionsThe new system, part of Omnigent, introduces intent-based authorization.enablesPrevent Off-Task ActionsEffectstops AI agents from executing actions not aligned with their session's purposeresults inEnhanced AI SecurityOutcometackles a fundamental flaw in current authorization models for AI agentsFrom the article 2 mentionsCrucially, the agent cannot alter or expand its own intent at runtime, preventing prompt injection from hijacking the security policy itself.
The new system, part of Omnigent, introduces intent-based authorization. It mandates that every action an AI agent takes must align with a clearly declared purpose for that specific session.

## The Vulnerability: Identity vs. Intent

AI agents often handle vast amounts of diverse data, including documents, emails, and user-submitted text. Prompt injection attacks exploit the agent's inability to distinguish between data to process and instructions to follow.

When an attacker embeds instructions within this data, the agent might execute them if its identity-based permissions allow it. This is particularly dangerous when an agent has broad capabilities, like reading and granting access to data, but is only intended for a specific task, such as data quality checks.

Without intent-based authorization, an agent tasked with checking data quality could be manipulated via a hidden instruction to grant external auditors access to sensitive tables, even though such an action is outside the scope of a quality check.

## Omnigent's Intent-Based Defense

Intent-based authorization binds the AI agent's session to a declared purpose. Every subsequent action is then evaluated against this declared intent.

Actions are categorized as 'Permitted' (within the declared purpose), 'Consent-required' (sensitive but potentially within scope, requiring human approval), or 'Denied' (outside the declared purpose).

This ensures that even if an agent's identity allows it to perform an action, it will be blocked if that action does not serve the session's declared intent.

## Human Approval and Tamper-Proof Intent

The declared intent is drafted by the AI agent from a plain-language description but requires explicit human approval before activation. Crucially, the agent cannot alter or expand its own intent at runtime, preventing prompt injection from hijacking the security policy itself.

Omnigent's design includes safeguards: agents lack the tools to remove or edit policies, and new policies require human review, preventing the agent from silently weakening its own guardrails.

This layered approach, combining intent-based authorization with other contextual policies like session-risk scoring, creates a robust defense mechanism within a single policy engine.
---
Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.