Databricks beta adds proactive failure analysis and AI-object deny policies

Databricks opened Genie ZeroOps in beta to monitor jobs, pipelines and tables, investigate failures or data-quality issues and propose fixes. In the same release cycle, Unity Catalog ABAC DENY policies expanded to model, provider, MCP, agent and skill securables and can attach to individual objects.

What changed

Why it matters

Operations agents and explicit access denial are converging in one governed platform. ZeroOps can reduce investigation time while the expanded policy surface gives administrators a stronger way to prevent access-control changes around AI services.

What to do

Enable ZeroOps on one non-HIPAA workload with read-only Git credentials, review every diagnosis and proposed patch, and stage AI-object DENY policies in log or test scope with a trusted exempt group before enforcement.

Caveat

Both features are beta. ZeroOps continuously processes selected code and data with hosted models, can expose excerpts to shared users and does not monitor cost or performance regressions; DENY remains easy to mis-scope and requires recovery access.