Databricks databricks-ai-functions — agentic threat model

Not certain from the listing — the specific foundation models invoked by the generated SQL (via ai_query) are managed externally or via Databricks Model Serving, making them susceptible to prompt injection or model misalignment if untrusted inputs are passed to the SQL functions.

The agent directly interacts with Databricks warehouse data by generating SQL queries. Threats include data exfiltration, unauthorized table access, and data corruption if the generated SQL contains logical flaws or is manipulated via injection.

As an 'Agent Skill' that encodes function signatures and usage patterns, framework vulnerabilities could lead to the generation of insecure or malicious SQL pipelines, effectively misusing the database as an execution tool.

Not certain from the listing — the execution environment is the user's Databricks workspace and SQL warehouses. Security relies heavily on workspace isolation, secure cluster policies, and network firewalls to prevent lateral movement.

Not certain from the listing — monitoring and observability depend on Databricks' native system tables, query history, and Unity Catalog lineage rather than any built-in agent-specific guardrails or logging mechanisms.

Access control and governance are managed by Databricks Unity Catalog. The generated SQL runs under the executing user's identity, requiring strict row- and column-level security policies to prevent privilege escalation.

Not certain from the listing — there is no indication of multi-agent orchestration or ecosystem-level interactions beyond standard integration into Databricks data pipelines.