Most organisations running large data operations are doing something that does not scale: a person, or a small team, manually controls who can see what in each database table. When a new table gets created, someone has to remember to set the rules. When an employee changes roles, someone has to update the permissions. When a regulator asks for evidence of compliance, someone has to produce it.
This works at a certain size. It stops working when you have thousands of tables, multiple cloud environments, and AI tools that can read data faster than any human audit cycle.
Databricks has now moved three tools in its Unity Catalog product from testing into full production status. The first tool, called attribute-based access control, lets a governance team write a rule once and attach it to a category of data rather than a specific table. Any table that carries a certain label automatically gets the same protection, including future tables that do not exist yet when the rule is written. The second tool manages those labels themselves, making sure only authorised people can create or change them. The third uses AI to scan data and apply the labels automatically, so the process does not depend on someone noticing that a new column contains customer phone numbers.
The three work together in a chain: the AI finds the sensitive data, labels it, and the protection rule kicks in automatically. No human in the middle.
The timing is not accidental. AI agents inside enterprises are now operating at a scale that creates a genuinely new risk. Research published this year found that AI agents move roughly sixteen times more data through enterprise systems than human users do. Around 32 percent of organisations already consider unsupervised AI agent data access a critical threat. The old model of manually managing who sees what simply was not designed for systems that operate at machine speed, around the clock.
Regulatory pressure is moving in the same direction. GDPR fines in Europe have reached into the billions. The US Department of Justice introduced new rules in 2025 restricting cross-border transfers of sensitive American data. Singapore's financial regulator has explicitly named data governance as a foundational requirement for any AI deployment. The legal cost of getting this wrong is rising faster than most compliance teams can respond manually.
Databricks is not alone in this space. Snowflake has its own governance layer and is publicly positioning Databricks as lacking enterprise-grade security. Microsoft Purview governs data across the entire Microsoft environment and works alongside Unity Catalog for organisations running both. The competitive framing matters: Databricks is strongest when the data lives inside its own platform, and that is where these new tools operate. Organisations running data across multiple platforms will still need additional layers.
What Databricks has done that is genuinely notable is close the gap between data discovery and data protection inside a single platform, without requiring a handoff between teams or systems. That gap has historically been where compliance breaks down, not because anyone made a bad decision, but because the process had too many manual steps.
For any organisation where a compliance failure means a regulatory fine, a contract clause, or a headline, the direction of travel here is clear: automated governance that follows the data is no longer a nice feature. It is becoming a baseline expectation. The organisations that have not yet moved from manual, per-table security to something that scales automatically are accumulating a risk that is growing faster than their governance teams can address it.