Unity AI Gateway, Governing AI Spend Like Any Workload

Pull-quote: “Twenty years of platform engineering taught us that anything without a governed front door eventually becomes an incident. AI traffic was the last workload running without one.”

Why this matters

Ask a CIO what their organization spent on model tokens last month, broken down by team, and watch the pause. AI traffic has been the one enterprise workload without the controls every other workload takes for granted: budgets, routing, audit, an inventory. Databricks was blunt about this at DAIS 2026 — AI costs are escaping governance, and agentic workloads are accelerating the escape — and shipped Unity AI Gateway as GA to close the gap. Their own platform figure, announced at the summit: over a quadrillion tokens have already flowed through AI Gateway.

What was announced

Two design choices matter more than the feature list. First, the gateway is open sourced as part of Unity Catalog and MLflow, which blunts the obvious objection that a governance chokepoint is also a lock-in point. Second, committed Databricks spend can be applied to tokens from OpenAI, Anthropic, or Google Gemini models across AWS, Azure, and GCP — announced at DAIS 2026 — which means the governed path and the commercially sensible path are the same path. Frontier models now turn over roughly every month; behind a gateway, swapping one is configuration, not a rewrite.

One front door

   Agents ─┐
   Apps   ─┤                        ┌──► Model providers (any cloud)
   Users  ─┼──► Unity AI Gateway ───┼──► MCP servers (registered)
   Jobs   ─┘        │               └──► Serving endpoints
                    │
          budgets · routing · auth
          policies · traces ──► MLflow / Unity Catalog
                                (governed in the lakehouse)

The tracing decision is quietly the most important row in the table. Agent reasoning traces land in MLflow under Unity Catalog governance — the same lakehouse, the same permissions, the same audit surface as the data. When an agent does something expensive or wrong, the investigation is a query, not an archaeology dig across vendor dashboards. And it composes with the security story Databricks told in the same keynote: Lakewatch, their agentic SIEM announced GA, stores security telemetry on the lakehouse in open formats. Gateway traces are exactly the telemetry a security team will want when agentic incidents stop being hypothetical.

What we would do with a client estate

Route before you restrict: get all agent and model traffic through the gateway first with generous budgets, because a week of real traces tells you more than a quarter of policy meetings. Then set hard limits where the traces show concentration risk, and let Smart Routing arbitrage the easy calls. Register every MCP server on day one — an inventory you build at leisure now is one you will otherwise build during an incident. Wire gateway traces into whatever the security team reads, Lakewatch or not. And resist the bypass: the first team that gets a “temporary” direct API key re-creates the shadow spend problem the gateway exists to end.

Closing

Unity AI Gateway is the least glamorous DAIS 2026 announcement and the one we would deploy first. It makes AI traffic a governed workload: budgeted, routed, inventoried, and traced into the same lakehouse as everything else. The pattern is twenty years old and it still holds — put a front door on it before the incident, not after.