Our Review Finds Databricks Has No Public Map for SaaS Write Approvals

A bounded review completed September 22 finds that Databricks’ public documentation does not provide a complete connector-by-connector specification for AI-agent writes into workplace software. Genie One-related connectors have different documented actions and layered authorization, while Unity Gateway offers detailed logging; default approval rules and a uniform cancellation or rollback path are not publicly mapped to each write action.

That is a material distinction for agents that can do more than retrieve company context. A draft email, a newly created calendar event, a Jira update, a Slack message, or a GitHub change can alter the systems where teams communicate and run work. General governance capabilities matter, but administrators also need to know what happens before and after a particular action executes.

The review separates analytics from connected applications

The review covers Databricks material available through September 22 for Google Workspace, Microsoft 365, Atlassian, Slack, and GitHub. It distinguishes the generally available Genie One MCP service from the connected SaaS services and native Genie One connections that can reach third-party applications.

That separation matters because the external Genie One server is documented as an analytics toolset. It can start a natural-language data question, poll for a response, retrieve query results, request cancellation of an in-flight response, and render an interactive view. Databricks documents Slack, GitHub, Atlassian, Google, and Microsoft 365 separately; a client connected only to system.ai.genie_one_mcp is not documented as automatically receiving their write tools.

Where the controls differ

The documented action surface is uneven by design. Google Workspace connections can search and read, draft Gmail messages, create calendar events, and create Google Docs, Sheets, and Slides. Editing is more limited: the connector can edit only Google Docs it created. Microsoft 365 is documented for search and Outlook drafts, not sending. Atlassian can search and update Jira and Confluence; Slack can search and send messages; GitHub can search and update file contents, issues, and pull requests.

The access boundaries

• Calling an MCP service requires Unity Catalog EXECUTE privileges and access to its parent catalog and schema.
• Users authenticate individually to connected providers, and their own provider permissions still restrict effective access.
• OAuth scopes and GitHub App permissions define the maximum actions a connection can attempt, not a published list of every tool the connector exposes.

That final distinction makes consent screens an incomplete guide to connector behavior. Databricks’ managed OAuth reference lists Gmail modify access, Microsoft SharePoint read-write and Teams sending permissions, Slack canvas-write permission, and GitHub read-write permissions. Yet the Genie One connector page describes narrower exposed actions in several cases, including Gmail and Outlook drafting rather than sending. Provider authorization establishes an outer boundary; it does not establish the tool surface by itself.

Approval can pause a call, but defaults remain unclear

Unity Gateway service policies can return ALLOW, DENY, or ASK. ASK pauses a call before execution for human approval. For external agents, the MCP client must support protocol version 2025-11-25 or later, and approval for an identical call is cached for one hour. Databricks’ examples include blocking a GitHub push and requiring approval before repository deletion, demonstrating a policy model that can operate on individual tool calls.

The uncertainty is how that general mechanism applies to Databricks-managed SaaS services. Databricks says built-in services use platform-managed tools and built-in service policies, governed with grants rather than custom tool selection or policy functions. Its external-source documentation also says the gateway applies built-in policies and approval requirements. The reviewed pages do not identify which listed connector writes require approval by default.

Logs are detailed; recovery is connector-specific

Observability is the most fully described control layer. Unity Gateway records MCP activity in usage and audit tables, including call volume, errors, latency, control-plane changes, and invocations. With account-level trace logging enabled, the unified trace table can capture caller identity, tool names and arguments, serialized requests and responses, HTTP and JSON-RPC status, policy decisions, and failure classifications such as policy denial or upstream error.

What remains unspecified

The review found no uniform connector-level cancellation or rollback control in the bounded documentation. Genie One’s cancellation tool concerns an in-flight analytics response, not a SaaS write. Slack messages cannot be edited or deleted through the connector after sending. Gmail and Microsoft 365 email are draft-only in the documented Genie One experience, and Google Docs editing is limited to documents created through the connector. Recovery behavior for Atlassian and GitHub updates is not specified in the reviewed pages.

This is not evidence that recovery is impossible in a provider product or a customer workflow. It establishes a narrower point: the public documents reviewed here do not show one shared recovery model across these services. Teams considering agent-driven writes therefore need to evaluate the exposed action, the provider permissions behind it, any applicable approval setting, and what the destination system allows after the change is made.