Genie for business users: asking questions of data without losing access control

In most Vietnamese banks, a branch director who wants to know how the overdue retail portfolio moved this month still sends the question to an analyst at head office and waits, often for several days. Genie, the natural-language interface in Databricks, shortens that wait: the director types the question, Genie writes the SQL, runs it and returns a table, a chart and a short summary.

The objection from risk and compliance teams is predictable. If a chat box can write any query, what stops a branch director from seeing another branch’s customers, or a relationship manager from seeing national ID numbers? The answer lies in how Genie runs queries, and it is worth understanding before anyone builds one.

A note on names: Databricks now calls the configured question-and-answer environment a Genie Agent. It was previously called a Genie space, and many older articles still use that name.

Whose permissions apply

A Genie Agent uses two separate credentials for every question.

Compute comes from the author. When an analyst sets up the agent, the SQL warehouse credentials of that analyst are embedded in it, so business users do not need their own permission on the warehouse.

Data access comes from the person asking. Unity Catalog evaluates every generated query as the end user’s own identity, not the author’s. Users see the data they are authorised to read and nothing more, each query is attributed to them in query history and on the agent’s monitoring page, and a question about data they cannot access returns an empty response. Generated queries are always read-only.

In practice, this means a Genie Agent does not create a new access path. A user needs SELECT on every table or view the agent uses, plus at least CAN VIEW or CAN RUN on the agent itself. Sharing the agent with a group does not give that group access to data it did not already have.

Row filters and column masks do the real work

Table-level permissions answer “can this person read this table”. In a bank, the harder question is “which rows and which columns”. Unity Catalog handles this with row filters and column masks: SQL functions attached to a table and evaluated at query time. Genie’s documentation is explicit that these are enforced per user automatically, however the agent is shared.

Two examples for a retail lending table. A row filter limits branch staff to their own branch, using a mapping table so the policy is maintained as data rather than code:

CREATE FUNCTION gov.policies.branch_filter(p_branch STRING)
RETURN is_account_group_member('head_office_all_branches')
    OR EXISTS (SELECT 1 FROM gov.policies.branch_access a
               WHERE a.branch_code = p_branch
                 AND is_account_group_member(a.group_name));

ALTER TABLE retail.lending.loans
  SET ROW FILTER gov.policies.branch_filter ON (branch_code);

A column mask shows national ID numbers in full to the KYC team and hides all but the last four digits from everyone else:

CREATE FUNCTION gov.policies.mask_id(id_number STRING)
RETURN CASE WHEN is_account_group_member('compliance_kyc') THEN id_number
            ELSE concat('********', right(id_number, 4)) END;

ALTER TABLE retail.customer.customers
  ALTER COLUMN id_number SET MASK gov.policies.mask_id;

In our deployments we add three working rules: check group membership rather than individual users, keep complex mappings in lookup tables, and limit analysts to SELECT while service principals hold the right to modify production tables. For many tables across catalogs, attribute-based policies (ABAC) apply the same filters and masks through governed tags and are now the recommended approach.

One detail makes this more than a recommendation. To help Genie match the words in a question to actual values, the agent collects representative column values using the author’s permissions, and those values become shared context for everyone using the agent. Tables with a row filter are excluded from this entirely, and masked columns are excluded too. Restrictions written into the agent’s instructions (“do not show other branches”) are not access controls at all. If something must stay hidden, it belongs in a row filter or a column mask on the underlying table. Note that filters and masks cannot be applied to views, so they go on the base tables.

Building a Genie Agent

Databricks’ guidance is to think of Genie as a new analyst joining the team: it needs clear context, and it works best on a narrow subject.

One audience, one subject. An agent for branch performance, another for deposit and liquidity. Databricks recommends five tables or fewer; the hard limit is 50 tables, views or metric views per agent.
Data registered in Unity Catalog, on a pro or serverless SQL warehouse. Serverless is the recommended option.
Descriptions in Unity Catalog. Genie reads table and column names, descriptions and key relationships to write SQL. A column called bal_eod_vnd with no description will be misread.
Shared definitions in metric views. Overdue ratio, CASA ratio and active customer each have one agreed definition in a bank. Putting them in a metric view stops Genie from improvising its own, and lets dashboards and Genie report the same number.
A named owner. A data analyst who knows both SQL and the business reviews questions and maintains the agent.

Instructions and trusted assets

There are three ways to teach an agent, and the documentation ranks them. SQL expressions in the agent’s knowledge store define business terms such as metrics, filters and dimensions. Example SQL queries show how to answer complex or ambiguous questions. Plain-text instructions come last, for guidance that cannot be expressed in SQL, because too many of them make it harder for Genie to prioritise. Each agent allows 100 instructions (each example query, each SQL function and the whole general-instructions block count as one) and 200 knowledge store snippets.

A useful text instruction in a bank is a clarification rule: when a user asks about outstanding loans without a reporting date, ask for the date before answering. Another concerns language. Genie works in languages other than English, but the underlying prompts are in English and responses can drift into English, so Databricks recommends writing metadata in the users’ language and adding a summary instruction such as “always respond in Vietnamese”.

Trusted assets are the strongest tool. They are parameterised example queries and SQL functions registered in Unity Catalog whose logic an author has verified. When Genie answers through one of them, the response is marked as a verified answer. For figures that reach a management report, such as overdue balances by branch or deposit movement by product, a trusted asset is the difference between “Genie wrote some SQL” and “this is the agreed calculation”. Users need EXECUTE on any function used this way, and Genie cannot see or modify the SQL inside the function.

Before release, add benchmark questions, up to 500 per agent, each phrased several ways and optionally paired with the correct SQL, then run them after every change. After release, the monitoring tab shows the questions asked, user feedback and responses flagged for review, and Genie events appear in the audit logs.

Limits to know before committing

Language-model processing location. Genie’s chat mode relies on models hosted by partner providers. In the Asia Geo, for a workspace in Singapore, the nearest region to Vietnam, chat mode requires cross-Geo processing to be enabled. That is a data-flow question under the Personal Data Protection Law, covered in our article on what the law means for a data platform, and it should be decided by the compliance team, not by the platform team alone.

The partner model setting. Genie chat mode needs the workspace setting that lets features use models hosted by partner providers. It is not available when this setting is disabled, and it is disabled by default on workspaces with the compliance security profile. Databricks removes the toggle on 1 November 2026; after that, changing it requires the Databricks account team.

Structured data in chat mode. Chat mode answers from tables. Questions about PDFs and documents need agent mode with Unity Catalog volumes, still in Beta, and agent-mode traffic from the Asia Geo can be processed in Japan, South Korea or Singapore.

Accuracy is managed, not guaranteed. Every answer shows its SQL. Outside trusted assets, someone still has to check that the SQL means what the user intended. That is why benchmarks and an owner are not optional.

Cost. Usage of Genie Agents by named users is free until 31 January 2027 according to Databricks’ documentation; service principals are billed. The SQL warehouse that runs the queries is always billed separately.

Where Sancire comes in

Our Analytics Use Case Sprint takes 6 to 8 weeks and starts at $30,000. It delivers one use case in production with real users: the governed data model, the metric definitions, a dashboard and a Genie Agent with trusted assets and benchmarks, plus an adoption review after go-live. If row filters and column masks are not yet in place, they belong in Unity Catalog Governance, and the 90-minute discovery workshop is the place to decide which comes before which.

Sources: Databricks documentation, read on 16 October 2026: Genie Agents concepts, creating and sharing a Genie Agent, curating a Genie Agent, instructions and trusted assets, row filters and column masks, Designated Services by Geo, benchmarks and monitoring, partner-powered AI features, Genie cost monitoring. Feature names, limits and availability change quickly; check the current documentation before designing.