Skip to content
redactsure
Book a demo

Explore.

Comparison · By Chris Sowa · Published
Last updated

What Is the Difference Between RedactSure and Databricks for AI Agent Data Protection?

Databricks governs agents inside its platform, masking Unity Catalog data and filtering model and MCP traffic routed through Unity Gateway, while RedactSure tokenizes the rendered screen of browser-based work outside any data platform. Check where your agents work, since the Databricks pages reviewed do not describe agents that read pages in a browser.

A database platform contains several protected record views beside a separate browser workflow and agent cylinder.

Databricks governs agents inside its platform, masking Unity Catalog data and filtering model and MCP traffic routed through Unity Gateway, while RedactSure tokenizes the rendered screen of browser-based work outside any data platform. Check where your agents work, since the Databricks pages reviewed do not describe agents that read pages in a browser. Databricks protects the lakehouse; RedactSure protects the screen. The two questions arrive together in most organizations. A data team building agents on Databricks needs to know which tables and columns an agent may read, and Unity Catalog answers that at the data layer (Databricks, 2026). The same organization's operations teams want agents that work the claims system, the payer portal and the vendor payment screen, none of which sit in the lakehouse. For that work the question is what the model sees on the page and who approves what the agent does next, which sits at the render and workflow layers. That is the job of render-layer tokenization paired with named approval. A buyer evaluating browser-based agents should place each product at its own layer. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • Databricks describes Unity Gateway as "the Databricks governance solution for enterprise AI," built on Unity Catalog and governing traffic between models, agents, MCP servers and tools once that traffic is routed through the platform (Databricks, 2026).
  • Unity Catalog masks columns and filters rows through attribute-based access control, and those masks reach an agent when it runs with the user's identity, a capability Databricks lists in Public Preview (Databricks, 2026).
  • Unity Gateway's PII guardrail replaces values "with a placeholder token like [NAME] or [EMAIL]," or blocks the request; the pages reviewed describe no consistent or reversible tokens (Databricks, 2026).
  • Databricks documents an "ASK" service policy that "pauses a request for user approval before the tool runs," in Beta and limited to MCP tool calls; the pages reviewed do not address agents that work through a browser (Databricks, 2026).
  • OWASP lists sensitive information disclosure as a top risk for LLM applications, covering personal data and confidential business data that reach or leave a model (OWASP, 2025).
  • Researchers showed that instructions planted in content an LLM application reads can redirect it, which makes anything the model can see, including a rendered web page, a possible target (Greshake et al., 2023).

What does Databricks's documentation say its agent governance covers?

For AI agents, the relevant Databricks products are four. Agent Bricks is "the Databricks developer platform for building and deploying custom agents," and Databricks states that "Unity Catalog governs the data the agent reads," for agents built on that platform (Databricks, 2026; vendor documentation, accessed October 16, 2026). Unity Catalog governs tables inside the lakehouse, with attribute-based access control, row filters, column masks and automated data classification (Databricks, 2026). Unity Gateway, documented under the AI Gateway path, governs model, agent, MCP and tool traffic routed through Databricks (Databricks, 2026). Managed MCP servers expose Databricks tools such as Genie and SQL alongside connectors to Slack, GitHub, Atlassian, Google Drive, Gmail and Microsoft 365, each an API connection rather than a screen (Databricks, 2026).

Outside AI can be governed when it is routed in. Databricks describes routing coding agents such as Claude Code, Codex and Cursor "through a Databricks model service," which applies to "external AI, not just Databricks-hosted resources" (Databricks, 2026). External SaaS is reached through managed or registered MCP servers and OAuth.

Databricks also publishes the Databricks AI Security Framework. Version 3.0 added agentic AI as a 13th system component with 35 new risks and 6 new controls, including a control calling for human review of high-stakes actions (Databricks, 2026). The platform offers compliance profiles for HIPAA, PCI-DSS and FedRAMP for workloads it hosts (Databricks, 2026).

The pages reviewed do not describe agents that operate applications through a browser, computer-use agents, or values an agent reads from a rendered web page in an application Databricks does not host. Every path described runs through a Databricks object: a table in Unity Catalog, a model service, a governed MCP server or an OAuth connection. Other documentation may cover more.

What the pages do state places Databricks at the data layer and at the traffic layer around it. The gap between the two designs is the moment an agent leaves the platform to work an application whose only interface is the page.

What happens to a sensitive value in each design?

Take a single record: a vendor master entry with the vendor's name, bank account number, tax identifier and remittance address, next to an open invoice amount. An agent has been asked to match the invoice to a purchase order and schedule the payment in a bank's vendor payments portal.

In the design Databricks describes, the vendor table sits in Unity Catalog. Data Classification "uses an agent to automatically classify and tag tables," typically within 24 hours of a table's creation, and the results pre-fill a policy that masks tagged columns (Databricks, 2026). When the agent queries the table with the user's identity, the masks and row filters apply; Databricks lists "Automatic enforcement of row-level filters and column masks" as a benefit of on-behalf-of authorization, in Public Preview. If the forwarded user token is missing, the agent falls back to its service principal (Databricks, 2026). In model traffic, the PII guardrail can replace the vendor's name with a placeholder or block the request, and the documentation says guardrails evaluate a "single message, not the full conversation." When the agent then opens the bank's portal in a browser, the page renders the record in full, and the pages reviewed do not describe a control on that path.

In RedactSure's design, the agent works inside a governed environment. Before any model reads the screen, the environment replaces the vendor name, bank account number and tax identifier with consistent tokens such as NAME_001, ACCT_001 and TAX_001. The invoice amount, dates and purchase order number stay in clear because the match runs on them. Consistent means ACCT_001 on the vendor record and ACCT_001 on the payment screen are the same account, so the agent can reconcile without the digits. The real account number resolves only in the portal's payment field, at the moment a named person approves the payment. This is screen-level tokenization applied per task.

The difference matters because of what a model does with what it reads. OWASP names sensitive information disclosure as a top LLM risk (OWASP, 2025), and an instruction hidden in a remittance note on the portal arrives through the screen (Greshake et al., 2023). A column mask narrows what a query returns. Tokenizing the render narrows what the model learns from each page it opens. The two controls stack.

How do the two compare side by side?

The table records what each side's documentation states. For Databricks, that is the documentation pages listed in Sources, dated between May and October 2026 and accessed October 16, 2026 (Databricks, 2026). For RedactSure, it is the current published design.

Dimension Databricks, per its documentation RedactSure, per its published design
Where protection runs Unity Catalog for lakehouse data; Unity Gateway for model, agent, MCP and tool traffic routed through Databricks The rendered screen inside a governed environment, before any model reads it
Applications covered Data in Databricks; agents built on or routed through Databricks; SaaS reached through MCP and OAuth Any application the agent works in through the browser, including ones without an API
Integration Data must be in Unity Catalog and traffic routed through Databricks; legacy workspace endpoints "bypass Unity Gateway" No per-application integration; the environment is the integration
Treatment of a sensitive value Column masks and row filters by policy; PII guardrail redacts to placeholders such as [NAME] or blocks Consistent tokens per entity, such as NAME_001, across every screen in the run
Agent identity On-behalf-of user authorization applies masks (Public Preview); falls back to the service principal if the user token is missing Existing user permissions, unchanged; what changes is what the model sees
Restoring real values Not described for guardrail redaction in the pages reviewed Real values resolve only at approved destinations at the moment of an approved action
Human approval ASK service policy pauses MCP tool calls for user approval (Beta); on model services ASK blocks A named person approves every payment, submission and record change, in any application
Record Usage tables, audit system tables, inference tables with raw request and response payloads AI Control Record: every screen as tokens, every action, every approval with a name, exported to the customer's SIEM
Browser and web portal agents Not addressed in the pages reviewed The design center

The closest overlap is approval. Databricks documents a real approval step for MCP tool calls, and RedactSure does not claim to govern lakehouse tables, model serving or MCP traffic inside Databricks. Cells that read "not described" or "not addressed" describe the pages reviewed, not the full capability of the platform, and a buyer should confirm each one with Databricks directly or in a demonstration. Several Databricks capabilities cited are in Beta or Public Preview. The RedactSure column describes a design in pilot.

Who or what is being governed, platform traffic or an agent's run?

In Databricks, protection follows the data and the traffic into the platform. Data must be in Unity Catalog for its masks to apply, agents must be built on or routed through Databricks for the gateway to see them, and outside services must be connected through MCP or OAuth. MCP servers are Unity Catalog securables with grants, tool filtering, rate limits and service policies; a tool that is not selected returns "Tool not allowed by MCP service configuration" (Databricks, 2026). Databricks notes that legacy workspace endpoints "bypass Unity Gateway" and that service policies "generally don't transform content" (Databricks, 2026). The unit is the platform: its tables, its endpoints and the calls that pass through them.

RedactSure governs a run. The unit is one agent doing one piece of work for one named person, in the applications that person chose. The work falls on the environment rather than on each application. A payer portal that will never connect to a data platform costs a field-by-field policy confirmed by a named person, not an integration project.

Both questions are real. The NIST AI Risk Management Framework organizes work into Govern, Map, Measure and Manage, separating accountability and context from handling a specific risk in operation (NIST, 2023). Classification and catalog grants fit the mapping and measuring work for data. Per-run tokenization and named approval fit the managing work for an agent that leaves the platform. A buyer should map which functions each product claims, and at which layer.

The practical test is to name one agent, one application and one task, then ask each vendor to show what the model receives on the first screen. A platform focused on governed data will show the masked query result. A control focused on the run will show the page as the model sees it.

How do approval and the record differ?

Databricks documents an approval step for MCP tool calls only. The ASK action pauses an MCP tool call until a user approves, and for external agents the prompt arrives through MCP elicitation; on model services ASK blocks rather than pauses (Databricks, 2026). The feature is in Beta and requires an account admin to enable it. It governs tool calls that pass through Databricks, and it is consistent with the DASF control calling for human review of high-stakes actions. The pages reviewed do not describe approval of an action an agent takes inside a third-party application it reaches through a browser.

RedactSure's approval is not tied to a protocol. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms the tokenization policy, can watch and pause the run, and approves every consequential action in whatever application the agent is working, before a real value resolves into the destination. The choice between screens and APIs is set out in should AI agents use screens, APIs or MCP.

The reason to hold actions outside the model is that model behavior can be redirected. OWASP describes prompt injection as a risk that can cause a model to take unintended actions (OWASP, 2025). If an injection succeeds against a RedactSure agent, it collects tokens, and the payment still stops for a named person.

The record follows the same split. Databricks keeps usage tables, audit system tables and inference tables; inference tables log "the raw JSON request payload" and the raw response, and the pages reviewed do not state that those payloads are masked (Databricks, 2026). The AI Control Record holds every screen as tokens, every action and every approval with a name, and exports to the customer's own SIEM, so the audit trail does not become a second copy of the identifiers it describes. The two records answer different audit questions, and an organization may want both.

Where does RedactSure sit?

For AI agent data protection in work that leaves the data platform, RedactSure sits at the render and workflow layers, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. Databricks remains the data layer underneath: Unity Catalog decides what an agent may query in the lakehouse, and RedactSure decides what an agent sees and who signs for what it does when it works an application through the browser.

Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on Databricks documentation for Unity Gateway, guardrails, AI governance, MCP governance, service policies, managed MCP servers, inference tables, attribute-based access control, data classification, agent authentication, Agent Bricks and privacy and compliance, and on the DASF v3.0 blog post of March 20, 2026, all accessed October 16, 2026 (vendor documentation); the OWASP Top 10 for LLM Applications 2025 and the NIST AI Risk Management Framework (standards and guidance); preprint research on indirect prompt injection; and RedactSure's published design.

No hands-on testing of Databricks or any other named product was performed. Where a Databricks page does not state a capability, the table says so; "not described" means the pages reviewed, and other Databricks documentation may describe it. Databricks renamed its AI Gateway to Unity Gateway; documentation still uses the ai-gateway path, and this page uses the current name. Several capabilities cited are in Beta or Public Preview. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. The vendor record is an example of a record type; no specific organization is described.

Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not stated" cell directly with Databricks and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.

What the record shows

Databricks governs what an agent may read inside the platform, filters the traffic routed through it, and has added a Beta approval step for MCP tool calls. That is governance for agents whose work is data. The agent that opens a third-party application in a browser, reads a screen of customer records and submits a form does that work outside the lakehouse, and the pages reviewed do not describe that path. The test is to name one agent and one task and ask each vendor to show what the model receives on the first screen and who approves the step that changes the record.

Frequently asked questions

Does Databricks mask sensitive data before an AI agent sees it?

For data in Unity Catalog, yes: column masks and row filters apply when an agent queries with the user's identity, a capability in Public Preview. Unity Gateway can also redact PII in model traffic to placeholders such as [NAME] or block the request. The pages reviewed do not describe either control applying to values an agent reads on a web page outside Databricks.

Does Databricks require human approval for agent actions?

Databricks offers an ASK service policy that pauses an MCP tool call until a user approves, in Beta and enabled by an account admin; on model services ASK blocks rather than pauses. RedactSure requires a named person to approve every consequential action in any application the agent works, not only calls routed through a specific protocol.

Can Databricks govern agents that use a browser?

The pages reviewed do not describe browser or computer-use agents. Databricks governs outside services through managed or registered MCP servers and OAuth connections, and governs outside AI such as coding agents when it is routed through a Databricks model service; none of those paths is a rendered page. A buyer with browser-based agents should ask Databricks directly how that path is covered.

Are Databricks redaction placeholders reversible?

The pages reviewed describe placeholders such as [NAME] and [EMAIL] without consistent per-entity tokens or a route back to the original value. RedactSure's tokens are consistent per entity across every screen in a run, so the agent can match records, and they resolve only at approved destinations, at the moment of an action a named person approves.

Where are the audit records kept?

Databricks keeps usage tables, audit system tables and inference tables in the platform; inference tables log raw request and response payloads. RedactSure's AI Control Record holds every screen as tokens, every action and every approval with a name, and exports to the customer's own SIEM, so the record does not hold a second copy of the identifiers.

Can an organization use Databricks and RedactSure together?

Yes, the designs protect different layers. Databricks governs the data and the agents built in or routed through the lakehouse. RedactSure governs agents that work applications through the browser, tokenizing each screen and holding each consequential action for a named person. Classification in Unity Catalog can also inform which fields a RedactSure policy tokenizes.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.