Skip to main content
Last updated on

Govern models and MCPs with GRANT policies

Use ABAC GRANT policies to govern access to models, model services, model provider services, and MCP services in the system.ai schema. Instead of maintaining a direct grant on every object, create one policy for each supported securable type and match assets by their governed tags.

The examples use Databricks-provided MCP Services in system.ai, such as system.ai.github. The same tag and GRANT policy steps apply to an MCP Service you register in another schema. Replace system.ai with that schema and review its existing grants before changing them.

By the end of this tutorial, you can:

  • Dynamically grant access to models, model services, model provider services, and MCP services using governed tags.
  • Remove access to a selected model family while keeping other tagged models and model services available, along with approved model provider services and MCP services.

The walkthrough uses the ai.model_family system tag that Databricks applies to models and model services in system.ai. For model provider services and MCP services, it uses a user-defined governed tag, access_status = approved.

important

GRANT policies do not support Unity Catalog functions. Removing the default EXECUTE privilege from system.ai also removes access to AI Functions. This tutorial shows how to grant access to required functions with direct grants.

Requirements​

The policies in this tutorial apply to the account users group, which contains every account user and service principal.

You must have:

Step 1: Create GRANT policies​

Choose a model family to exclude​

Models and model services in system.ai have system tags such as ai.model_family and ai.model_creator that are applied automatically. You can reference these tags directly in a policy without creating or assigning them yourself.

To create policy conditions based on additional tags, you can create and assign your own governed tags and reference those tags in GRANT policies.

In Catalog Explorer, inspect the models and model services you want to govern and choose an ai.model_family value to exclude. In the following policies, replace <excluded-model-family> with that value.

GRANT policies grant access only when an asset matches the policy's tag-based condition. In the following policies, a model or model service matches only when it has an ai.model_family tag whose value is not <excluded-model-family>.

Create a governed tag for services​

To govern access to model provider services and MCP services, create and assign a governed tag that identifies the services that account users can access. This tutorial uses access_status = approved as an example.

  1. Create a governed tag named access_status with the allowed value approved. See Manage governed tags.
  2. Apply access_status = approved to each model provider service and MCP service that account users can use. For example, tag system.ai.github if account users should be able to invoke it. In Catalog Explorer, open the service and add the governed tag under Tags on its Overview page. You can also use the Unity Catalog entity tag assignments API. See Add and update tags.

Create policies for models and services​

A GRANT policy targets one securable type. Create separate policies for models and model services, using the same condition.

SQL
CREATE POLICY grant_allowed_models
ON SCHEMA system.ai
COMMENT 'Grant EXECUTE on models outside the excluded family'
TO `account users`
GRANT EXECUTE FOR MODELS
WHEN has_tag('ai.model_family')
  AND NOT has_tag_value('ai.model_family', '<excluded-model-family>');
SQL
CREATE POLICY grant_allowed_model_services
ON SCHEMA system.ai
COMMENT 'Grant EXECUTE on model services outside the excluded family'
TO `account users`
GRANT EXECUTE FOR MODEL SERVICES
WHEN has_tag('ai.model_family')
  AND NOT has_tag_value('ai.model_family', '<excluded-model-family>');

The policies automatically grant EXECUTE privileges on new models and model services when they have an ai.model_family tag that does not match the excluded value. Users do not receive EXECUTE privileges on assets without that tag through these policies.

note

The preceding policies automatically grant EXECUTE to models and model services whose ai.model_family value matches the condition. If you prefer to explicitly control which models and model services account users can access, use your own governed tag instead. For example, apply access_status = approved to each approved model or model service, then use has_tag_value('access_status', 'approved') as the policy condition.

For model provider services and MCP services, the policies below grant EXECUTE when an administrator applies access_status = approved.

SQL
CREATE POLICY grant_allowed_model_provider_services
ON SCHEMA system.ai
COMMENT 'Grant EXECUTE on approved model provider services'
TO `account users`
GRANT EXECUTE FOR MODEL PROVIDER SERVICES
WHEN has_tag_value('access_status', 'approved');
SQL
CREATE POLICY grant_allowed_mcp_services
ON SCHEMA system.ai
COMMENT 'Grant EXECUTE on approved MCP services'
TO `account users`
GRANT EXECUTE FOR MCP SERVICES
WHEN has_tag_value('access_status', 'approved');

To create these policies in Catalog Explorer, open the system.ai schema, select Policies > New policy, and choose Grant access. Create one policy for each securable type. For the MCP policy, select MCP service, grant EXECUTE to All account users, and set a custom condition of has_tag_value('access_status', 'approved'). See Create a GRANT policy for the full UI steps.

Step 2: Grant access to AI Functions​

To grant access to an AI Function in system.ai, grant EXECUTE directly on the function. For example, the following statement grants access to the built-in python_exec function:

SQL
GRANT EXECUTE ON FUNCTION system.ai.python_exec TO `account users`;

Repeat this direct grant for each AI Function that users need to access. See AI Functions Unity Catalog permissions.

Step 3: Remove the default schema grant​

After you create the GRANT policies, remove the default schema-level EXECUTE grant.

Review direct EXECUTE grants on MCP services and their parent schema before relying on the tag condition to restrict access. A direct or inherited grant can still allow access to an untagged service. See How GRANT policies interact with direct grants.

Before you revoke EXECUTE, ensure that account users can still use the catalog and schema:

SQL
GRANT USE CATALOG ON CATALOG system TO `account users`;
GRANT USE SCHEMA ON SCHEMA system.ai TO `account users`;

Revoke the default grant:

SQL
REVOKE EXECUTE ON SCHEMA system.ai FROM `account users`;
warning

This change affects every account user and every executable asset in system.ai, including models, model services, model provider services, MCP services, and AI Functions.

Step 4: Verify access​

Confirm that the policies are attached to system.ai:

SQL
SHOW EFFECTIVE POLICIES ON SCHEMA system.ai;

Test as an account user who has no other EXECUTE grants to confirm the following:

  • User has EXECUTE privileges on a model or model service with a non-excluded ai.model_family value.
  • Users do not have EXECUTE privileges on a model or model service with the excluded value.
  • Users do not have EXECUTE privileges on an asset without the ai.model_family tag.
  • Users have EXECUTE privileges on a model provider service or MCP service tagged access_status = approved.
  • Users do not have EXECUTE privileges on an untagged model provider service or MCP service through these policies.
  • Users have EXECUTE privileges on an AI Function only if you granted them directly.

For the MCP check, connect an MCP client as that account user and invoke a tool on a tagged service, such as system.ai.github. Then try an untagged MCP service in system.ai and confirm that the user cannot invoke it. The coding-agent GitHub tutorial shows how to connect a client to system.ai.github.

To exclude a different model family, use CREATE OR REPLACE POLICY to update <excluded-model-family> in the WHEN conditions of both grant_allowed_models and grant_allowed_model_services. The updated policies grant EXECUTE only to models and model services whose ai.model_family value differs from the excluded value.

For model provider services and MCP services, apply or remove access_status = approved to change which services receive EXECUTE.

Additional resources​

On this page