A data agent has three tables attached to it. Its instructions also name a fourth table that nobody added under Sources. Today that reference can expand what the agent uses. In late September, Databricks says it will not.
Databricks announced an upcoming Genie Agent source restriction on September 11, 2026. Genie Agents will soon use only data sources explicitly attached under the agent’s Sources. Instructions that merely mention other tables or Unity Catalog functions will no longer bring those resources into scope.
A concrete example of the behavior change
| Agent configuration | Current behavior described by Databricks | Late-September behavior |
|---|---|---|
| Table A attached under Sources | Available | Available |
| Table B named only in instructions | May be used | Not available to the agent |
| Unity Catalog function named only in instructions | May be used | Not available to the agent |
The crucial distinction is configuration versus prose. A resource name inside an instruction will no longer substitute for attaching the resource through the dedicated source list.
Why the tighter boundary is useful
An explicit source list is easier to inspect, approve and compare over time. It gives an administrator a smaller answer to the question: what data can this agent use? It also reduces the chance that a well-meaning instruction silently expands the retrieval surface.
This is a configuration boundary, not a complete security guarantee. Permissions, view definitions, functions and downstream connectors still determine what the attached resource can expose. Teams need both the source attachment and the underlying access review.
Where existing agents may break
- Instructions tell the agent to join a table that is not attached.
- A named Unity Catalog function performs a calculation but exists only in the prompt.
- A copied agent inherited instructions without inheriting its source configuration.
- A test workspace attached a resource that production never attached.
- A rarely used question depends on a source that normal smoke tests do not touch.
Build a source manifest before the change arrives
Export or record each production agent’s attached sources. Then parse its instructions for table and function references. The difference between those two lists is the migration queue. Each unmatched name needs one decision: attach it deliberately, replace it with an attached source, or remove the dependency.
- Inventory agents, owners and business-critical questions.
- Record every attached source with its workspace and catalog identity.
- Extract table and function names from instructions.
- Review every mismatch with the data owner.
- Update attachments and run an answer-level regression set.
Test answers, not only connectivity
A green connection check proves that a source is reachable. It does not prove that the agent still produces the expected join, filter, aggregation or citation. Save representative questions with expected source usage, then compare the retrieved tables and final answer before and after the restriction.
Our data-agent permissions review provides a reusable read, decide and change inventory. For a broader view of agent execution controls, see the Codex versus Claude Code guide, where tool scope and observability determine how safely an agent can work.
The rollout needs an owner and a date
Databricks says the restriction arrives in late September 2026, not on a precise day in the notice. That uncertainty argues for finishing the inventory early. Assign one owner per agent, capture a known-good answer set and avoid waiting for a failure in production to reveal an unattached dependency.
What this signals about enterprise agents
The shift makes agent scope more declarative. A prompt can describe how to work, but a dedicated configuration surface decides which resources exist inside the job. That separation is healthy because prose changes frequently and is difficult to audit as an access-control system.
Primary source
Checked September 13, 2026. The timing and behavior change are attributed to Databricks. Administrators should confirm the final rollout timing in their own workspace.
