Databricks AI Security Leap

Databricks is rolling out a new security layer for its AI agents designed to tackle a fundamental flaw in current authorization models. Traditional systems verify who can access what, but not why. This oversight allows malicious instructions, hidden within data an AI agent processes, to trick it into performing unauthorized actions, as detailed in their blog post.

The new system, part of Omnigent, introduces intent-based authorization. It mandates that every action an AI agent takes must align with a clearly declared purpose for that specific session.

The Vulnerability: Identity vs. Intent

AI agents often handle vast amounts of diverse data, including documents, emails, and user-submitted text. Prompt injection attacks exploit the agent's inability to distinguish between data to process and instructions to follow.

When an attacker embeds instructions within this data, the agent might execute them if its identity-based permissions allow it. This is particularly dangerous when an agent has broad capabilities, like reading and granting access to data, but is only intended for a specific task, such as data quality checks.

Without intent-based authorization, an agent tasked with checking data quality could be manipulated via a hidden instruction to grant external auditors access to sensitive tables, even though such an action is outside the scope of a quality check.

Omnigent's Intent-Based Defense

Intent-based authorization binds the AI agent's session to a declared purpose. Every subsequent action is then evaluated against this declared intent.

Actions are categorized as 'Permitted' (within the declared purpose), 'Consent-required' (sensitive but potentially within scope, requiring human approval), or 'Denied' (outside the declared purpose).

This ensures that even if an agent's identity allows it to perform an action, it will be blocked if that action does not serve the session's declared intent.

Human Approval and Tamper-Proof Intent

The declared intent is drafted by the AI agent from a plain-language description but requires explicit human approval before activation. Crucially, the agent cannot alter or expand its own intent at runtime, preventing prompt injection from hijacking the security policy itself.

Omnigent's design includes safeguards: agents lack the tools to remove or edit policies, and new policies require human review, preventing the agent from silently weakening its own guardrails.

This layered approach, combining intent-based authorization with other contextual policies like session-risk scoring, creates a robust defense mechanism within a single policy engine.