A policy document that describes how agents should behave will not stop a send. A control stops the action when the grant is missing, and leaves a record either way.
Databricks publishes the Data and AI Security Framework, DASF, as a map of risks across the AI lifecycle, from the data and the models through serving and the platform underneath. It is a useful map. You do not install it. The work is deciding which of those risks you actually have, then putting a gate in the runtime.
Where we put the gates
Data. Unity Catalog decides who can see what. Agents and apps run under their own service principal, on the same path a person uses. If the catalogue coverage stops halfway, that is a Health Check finding, and it will show up in an agent programme later as an incident.
Models and tools. Unity AI Gateway is where model serving is governed. Tools an agent can call resolve through the catalogue, so it cannot reach a table its principal has no grant for. Fabric Harness is how we deploy that agent as a Databricks App without rewriting it for each target.
Actions. Every domain change goes through one mutation pipeline. Fabric Platform makes an illegal transition structurally impossible. An agent actor passes the same policy and state-machine gates as a human one, and the event that explains the change is part of the same transaction.
Approvals. Anything that would leave the workspace parks at a ticket a person answers. Fabric Tower is the console. The supervisor cannot approve itself.
The DASF PDF already walks the twelve components, and a paraphrase here would be worse than the source. The useful question is whether your agents pass the same gates as your people. A second, weaker path is the incident.
DASF is Databricks' framework, not a certification we hold. We use the surfaces it assumes: Unity Catalog, AI Gateway, Model Serving, Apps. We do not claim a partner specialisation we do not have.
Almost every team that asks us about AI security has not yet written down what a good answer is. Build the rubric first. Genie Accuracy and Fabric Experiments are that work. Then the gates have something real to protect.
The service line is AI systems. Troy's line still holds: draw the permissions boundary in the first conversation.