Databricks Genie respects data permissions—but its channel answers are public by default

Databricks is pushing Genie out of the analytics workspace and into the places where employees already talk. Its current Genie hub points users to Slack, Microsoft Teams, Microsoft 365 Copilot and an MCP server, making conversational access part of the product surface rather than a separate integration project.[1]

That convenience creates an important distinction for administrators: query authorization and answer visibility are different controls.

The query runs as the asker

In Slack, Genie answers with the credentials of the person who mentions it. Databricks says Unity Catalog therefore limits each user to data they are already permitted to access.[2] The Teams app similarly connects a user to a Databricks workspace and can route a question either to Genie One or to a pinned, use-case-specific Genie Agent.[3]

This is the expected control for execution. It prevents a user from asking Genie to retrieve data that their own Databricks identity cannot read.

But after the answer is generated, collaboration-platform visibility takes over. Databricks explicitly warns that a public Slack response is visible to everyone in the channel or group DM, including members without access to the underlying data.[2] Both the Slack and Teams integrations default channel responses to public.[2][3]

The practical consequence is straightforward: a correctly authorized query can still become an over-broad disclosure when its result is posted into a shared channel.

Change the default before rollout

Databricks provides three levels of message-visibility configuration: workspace, channel and personal. Workspace settings have the highest precedence, followed by channel-owner settings and then an individual user’s configuration. Administrators can disable public messages for collaboration platforms, forcing answers to remain private to the asker.[2][3]

That workspace-level switch is the safer enterprise baseline. Teams can selectively relax it only after deciding which channels, agents and data domains are appropriate for shared answers. Relying on every user to notice and change a per-channel default turns a governance decision into a usability test.

Tool use needs the same review. Both apps can expose connected external tools and present approval prompts with scopes such as once or always in the chat. Databricks says only the user who asked can approve the action, but an “always” approval still changes the operating boundary of that conversation and deserves an explicit policy.[2][3]

The relay region is another boundary

Databricks says conversation processing and history remain in the workspace region, while messages pass through a central relay that does not persist or log request or answer content. The Slack relay runs in us-west-2; the Teams relay runs in East US 2, regardless of the workspace region.[2][3] Private Link deployments also require a controlled ingress exception because neither collaboration platform reaches the workspace over Private Link.[2][3]

The rollout checklist is therefore larger than installing an app: force private answers by default, map relay regions into data-flow reviews, constrain ingress, audit pinned agents and tool approvals, and only then enable selected shared-channel use. Unity Catalog answers “may this person query the data?” It does not, by itself, answer “who may read the response?”