Enforce partner guardrails with external service policies

External service policies allow you to send model request and response content or MCP service payloads to a third-party security vendor. The Unity Gateway evaluates the returned verdict and blocks calls when denied, without requiring any application changes.

Use cases

Imagine you need to apply existing data-loss-prevention or moderation rules from your security vendor to all model calls in Databricks. With this feature you can:

• Validate inbound and outbound traffic using partner tools.
• Automatically block malicious requests or those violating company policies.
• Monitor traffic behavior in Log mode before enforcing blocks.

How to use

You can create the HTTP connection in Unity Catalog through the policy form or via SQL using OAuth M2M authentication.

CREATE CONNECTION external_guardrail
TYPE HTTP
HOST 'https://api.example.com'
OPTIONS (
  auth_type 'oauth2',
  client_id 'your_client_id',
  client_secret 'your_client_secret',
  token_endpoint 'https://api.example.com/oidc/v1/token'
);

What happens in this code:

1. Defines the connection name as external_guardrail in Unity Catalog.
2. Sets the host URL for your external security vendor.
3. Configures OAuth M2M authentication using credentials provided by the partner.

Limitations and requirements

• This feature is in Beta and requires account admin enablement.
• Only supports OAuth M2M authentication (Client ID, Client Secret, and Token Endpoint).
• Features fail-closed behavior: if the vendor endpoint times out, errors out, or fails, the call is denied.
• Policies only return ALLOW or DENY; content redaction or human-in-the-loop approval are not supported.