Databricks Omnigent Contextual Policies Prevent AI Agent Data Exfiltration

This article details how Omnigent Contextual Policies prevent data exfiltration from AI agents by blocking the "lethal trifecta"—a vulnerability where agents combine access to private data, untrusted input, and outbound communication.

Standard per-action authorization checks are insufficient because they evaluate individual actions in isolation, failing to detect dangerous sequences of legitimate actions that lead to data exfiltration. The threat lies in the combination, not any single step.

Contextual policies track "legs" (private data access, untrusted content ingestion, exfiltration) as session state. When an agent attempts an outbound call after accessing both private data and untrusted content, the policy denies the exfiltration, preventing data leakage.

A demonstration shows a support agent, instructed by a prompt-injected customer ticket, attempting to exfiltrate internal revenue figures. The policy intervenes at the outbound email step, blocking the confidential data from leaving.

The policy is designed to block only the dangerous combination of actions, not individual tools. It allows agents to perform routine tasks, such as responding to customer queries without sensitive data access, ensuring normal workflow is uninterrupted.

The classifications for "private data," "untrusted content," and "exfiltration" are explicitly defined by a human in the agent's configuration, not by the agent itself at runtime, to prevent prompt injection from manipulating policy definitions.