Databricks Brings Permission-Aware AI Actions to Slack

By Olivia Hart

Databricks announced on November 12, 2026 that its Genie app for Slack is generally available, putting permission-aware questions, file analysis, charts, scheduled analyses and approved tool actions inside Slack conversations. Databricks said the release makes Slack another front end for its existing governance model; it does not replace controls around the underlying data.

What can employees do inside Slack?

Databricks says employees can send Genie a direct message or mention @Genie in a channel or group DM. According to Databricks, replies stay in the relevant conversation or thread, cite their sources and can open in Databricks for more context; Google Drive, Confluence and Jira can serve as connected enterprise knowledge sources.

Under Databricks’ default setup, Genie One routes requests across the connected data estate. Databricks also allows a conversation or channel to be pinned to a curated Genie Agent, which keeps answers within that agent’s data and instructions.

Databricks lets channel owners select the connected Databricks workspace, public or private response visibility and the Genie scope. The practical distinction is between a broad default and a deliberately bounded agent.

How does Genie turn answers into actions?

Databricks says Genie can use MCP connectors to external tools to create or modify documents, comment on tickets and update records with the requesting user’s credentials. The company prepares each change for approval before execution, and only the employee who submitted the request may approve or deny it.

Databricks says an approval can apply once, always for that chat or always when a scope selector appears. The app lets users create recurring analyses in natural language or with a scheduling button beneath an answer, with results delivered to the requester’s Genie DM.

Databricks says the app accepts uploaded files and can return documents such as PDFs, tables and charts inside Slack. One restriction is explicit: charts do not appear when response visibility is private.

Genie can therefore support action, but Databricks still places the decision with the employee who made the request. The system’s automation does not remove that approval step.

Who can see a Genie answer?

Databricks evaluates each request under the asker’s identity, with Unity Catalog and connected-source permissions limiting the information Genie can retrieve. Those retrieval permissions do not, by themselves, restrict the Slack audience, which Databricks treats as a separate control.

Under Databricks’ default setting, public responses are visible to every member of a channel or group DM, including people who cannot access the underlying data. Visibility can be set for an individual, a channel or an entire workspace; workspace settings override channel settings, channel settings override personal settings, and administrators can require every response to remain private.

Databricks therefore separates authorization to query data from authorization to share the answer. That gap can disclose information to colleagues without direct source access unless an administrator tightens visibility.

Where does Databricks process the requests?

Databricks says question processing and answer generation occur inside the customer’s Databricks workspace, while conversation history is stored in that workspace’s region. The central service that relays messages with Slack does not persist or log request or answer content; it stores only the mapping between the Slack and Databricks workspaces.

According to Databricks, the workspace’s geography and cross-geography processing setting determine where large language model processing occurs. Slack functions as the interface, but Databricks says the customer workspace configuration governs that location.

Databricks makes data residency conditional on the selected workspace and its processing settings. The relay does not become the record of the exchange, according to Databricks’ architecture description.

How are deployment and actions controlled?

Databricks says Unity Gateway provides centralized MCP policies, cost controls and monitoring, including traces of Genie’s actions and the users who requested them. Audit logs identify Slack as the request origin separately from Databricks web and Microsoft Teams activity.

Databricks says installation requires a Slack workspace administrator, after which users authenticate to Databricks and select a workspace. Workspaces using Private Link also require a Databricks account administrator to configure a context-based ingress rule for the app.

Databricks says the app automatically selects an authorized SQL warehouse rather than offering a compute choice. That design keeps compute selection within existing permissions, though users cannot make an independent choice in Slack.

What limitations did Databricks flag?

Databricks says users cannot create Genie agents from Slack, and pinning a specific agent affects only new conversations. The company warns that “agents can generate inaccurate responses” and tells users to verify output before acting on it.

Databricks’ warning matters because Genie can move beyond analysis into document changes, ticket comments and record updates. Verification and approval remain the employee’s responsibility even when the system uses that employee’s credentials.

Databricks’ announcement provides no pricing, accuracy benchmark or deployment-performance metric. Those omissions leave the commercial case and operational reliability unquantified.

Databricks describes Slack as another front end for its existing governance model. The near-term test is whether administrators can keep retrieval rights, audience visibility and action approvals aligned as employees use Genie in business conversations.