Governance

A Generative AI Engineer deploys a customer-facing chatbot on a Databricks Model Serving endpoint. Compliance requires that any generated response containing toxic, hateful, or unsafe content must be blocked before it reaches the end user, and the blocking decision must happen on outputs the LLM produces (not just user inputs). The team wants to use Databricks-native tooling with minimal custom code. Which approach best satisfies this requirement?

A Generative AI team maintains a feature table in Unity Catalog that stores precomputed customer embeddings used by both a batch scoring job and a real-time agent serving endpoint. Compliance requires that data scientists can read the features for offline experimentation but must NOT be able to modify or delete the underlying feature table, while the automated pipeline service principal needs full write access to refresh features nightly. What is the most appropriate way to enforce this using Unity Catalog governance?

A GenAI engineer has registered a fine-tuned model in Unity Catalog at `ml.prod.support_summarizer` and deployed it to a Model Serving endpoint. The endpoint runs under a service principal used by the production application. During testing, queries to the endpoint fail with a permission error when the model version is loaded. The engineer confirms the endpoint configuration is otherwise correct. What is the MOST appropriate action to resolve this while following least-privilege governance practices?

A Generative AI Engineer maintains a production RAG application whose Vector Search index is built from a Delta table, and whose serving chain is a registered model in Unity Catalog. The data science team plans to replace the embedding model used to build the index, and leadership wants to know exactly which downstream assets (indexes, registered models, and serving endpoints) would be affected before any change is made. What is the most efficient way to determine the full set of impacted downstream assets?

A compliance auditor asks a Generative AI Engineer to demonstrate which source Delta tables ultimately feed a production RAG chatbot's Vector Search index, and to prove that a specific customer table was used to build the embeddings. All assets (source tables, embedding function, Vector Search index, and the registered chain model) are managed in Unity Catalog. What is the most reliable way to produce this evidence?

A healthcare company ingests patient support transcripts into a Delta table that feeds a RAG chatbot for internal staff. The transcripts contain patient names and medical record numbers (MRNs). Compliance requires that most staff never see raw MRNs, while a small clinical-audit group must retain full access. The Generative AI Engineer wants to enforce this at the data layer so the protection is applied consistently regardless of which pipeline or notebook reads the table. Which Unity Catalog capability best meets this requirement?

A financial services company deploys a customer-facing RAG chatbot whose model is registered in Unity Catalog. During a compliance audit, the security team must produce evidence of exactly which users and service principals have queried the production model serving endpoint and when, without relying on custom application-side logging. Which Unity Catalog / Databricks capability directly satisfies this requirement?

A GenAI engineer deploys a RAG chatbot as a Model Serving endpoint. The endpoint queries a Vector Search index and reads a Delta table that contains sales records restricted by row-level filters. The compliance team requires that each end user only sees rows they are individually entitled to, rather than every user seeing the same data through the service principal that owns the endpoint. Which approach best satisfies this requirement while using Unity Catalog governance?

A healthcare company deploys a RAG chatbot that answers clinician questions using patient-derived summaries stored in a Delta table. The compliance team requires that any table, function, or model that touches protected health information (PHI) be discoverable and enforceable through a single governance mechanism, so that access policies and audits can be applied consistently across all these assets in Unity Catalog. Which approach best satisfies this requirement?

A Generative AI Engineer has registered a fine-tuned customer-support model in Unity Catalog. A separate analytics team in the same Databricks account, working in a different workspace attached to the same metastore, needs read access to run batch inference against this model. The engineer wants to grant the minimum privileges required following Unity Catalog best practices. Which approach correctly grants the analytics team the ability to use the model?

A Generative AI engineer is building a RAG application that ingests thousands of PDF and DOCX files supplied by various business units. Before chunking and embedding, the raw unstructured files must be stored in a governed location that supports Unity Catalog access controls, lineage, and auditing, while allowing the ingestion pipeline to read the files as objects. Which storage approach should the engineer use?

A GenAI engineer builds a customer support RAG application. Source documents are uploaded as raw PDFs to a Unity Catalog volume, then parsed and stored as chunked text in a Delta table that backs a Vector Search index. The compliance team requires that only the 'support-engineers' group can query the deployed agent, while a separate 'legal-reviewers' group must be able to open and inspect the original PDF files but must NOT be able to read the parsed chunk table. Which Unity Catalog access-control configuration meets these requirements?