Databricks Maps Three Enterprise Paths for OpenAI Tools on Governed Data

Databricks published an enterprise adoption guide on November 13, 2026 that details three ways companies can run OpenAI tools against governed corporate data: ChatGPT analytics through Genie, centrally controlled Codex deployments, and custom agents hosted as Databricks Apps. The guide turns a partnership announced more than a year earlier into concrete deployment patterns, and it arrives as enterprises weigh how to expand OpenAI usage without losing control of permissions, definitions and costs.

The stakes are straightforward. AI tools that cannot reach company data produce generic answers, and uncontrolled access to that data produces governance risk. The Databricks-OpenAI architecture attempts to solve both problems at once.

What is the foundation of the partnership?

The guide builds on a multi-year partnership announced on September 25, 2025. The original release valued the deal at $100 million and stated that native OpenAI models would become available to more than 20,000 Databricks customers across clouds.

OpenAI co-founder and president Greg Brockman framed the problem the partnership addresses: “it’s like hiring someone with 20 PhDs and never inviting them to a meeting.” That sentence, from the announcement, has become the shorthand for AI systems cut off from the data a business actually runs on.

Under the joint architecture, the division of labor is explicit. OpenAI supplies GPT models, ChatGPT, Codex and its Agents SDK. Databricks contributes the lakehouse that stores governed company data, plus business definitions, access rules, model-request routing and application infrastructure. Genie Ontology adds company-specific context on top of that stack.

How does Genie bring governed data into ChatGPT?

The first path targets business users who need figures but do not write SQL queries. Through the Databricks Genie plugin, a ChatGPT user asks a question in natural language. Genie identifies the relevant data, applies approved metric definitions, runs the query in Databricks and returns graphs or charts.

The metric definitions matter more than the interface. Genie Ontology records metrics, business definitions and the relationships among company data, so a metric such as revenue follows the company's own definition rather than whatever an underlying table happens to contain.

Access stays inside existing permission boundaries. A user sees only data that user already has permission to see, and each answer links back to its Databricks sources for verification. ChatGPT Work extends the path beyond queries: it can recommend next steps and who should be involved, share findings through Slack or email, and carry out user-approved actions through connected tools.

OpenAI's plugin listing for Genie also covers SQL generation, summaries of dashboards or Genie outputs, and packaging findings for teams. Availability depends on the plugin, the subscription plan and workspace settings, and some connections require administrator setup or approval.

How does Unity Gateway control Codex deployments?

The second path addresses engineering teams. Codex sends requests through Unity Gateway instead of contacting OpenAI directly. Developers keep their existing workflow and authenticate with a Databricks credential, while the OpenAI API key stays centralized in the gateway.

Every request is logged. Engineering leaders can set team budgets, review spending by team and choose which GPT model handles each task — three controls that matter for companies scaling AI-assisted coding across hundreds of developers.

The recommended setup installs the Unity Gateway command-line tool and runs ug codex. Databricks' setup documentation also covers manual configuration and running Codex on Databricks compute.

Subscription support spans the ChatGPT lineup. Eligible ChatGPT Go, Plus, Pro and Enterprise subscriptions can connect through an administrator-configured model-provider service, with requests billed against the ChatGPT subscription rather than a separate API account.

The release state is mixed. Unity Gateway itself is generally available. The documented SQL, sandbox and web-search tools and Unity Gateway skills remain in beta.

How do custom agents use governed data?

The third path covers custom agents for business processes that operate on data under strict security and governance rules. Databricks Model Serving runs OpenAI models beside that governed data, and no external API key is needed when Databricks serves the model — the request never leaves the governed perimeter for key management.

Teams have two build routes. They can build and evaluate agents in Agent Bricks, or they can use the OpenAI Agents SDK and deploy the result as a Databricks App.

The official app template supplies a conversational REST API, an interactive chat interface and MLflow evaluation code. Its MLflow AgentServer manages request routing, logging and error handling, with built-in tracing and observability. A ResponsesAgent interface provides compatibility with Databricks evaluation and deployment tools, and the Model Context Protocol connects the agent to external tools and data sources.

Why does the shared architecture matter?

The three paths differ in audience but share one control plane. Unity Catalog supplies permissions across all patterns. Unity Gateway handles request routing and cost controls. Lakebase provides managed Postgres storage for agent memory and state.

That consolidation is the strategic point. Business queries, coding requests and custom agents run under a single permission and cost-control framework, which makes governance a common foundation as OpenAI use expands across a company rather than a set of per-tool exceptions.

For the more than 20,000 Databricks customers named in the original partnership announcement, the pattern guide reduces the adoption question from whether to use OpenAI tools to which of three sanctioned routes fits a given workflow. Databricks said it plans follow-up posts covering architecture, setup and customer lessons for each pattern.