Databricks adds request-tag checks and OpenJev judging to Unity Gateway

Databricks announced two beta additions to Unity Gateway’s custom service policies on October 9, 2026: rules that check caller-supplied request tags, and the option to use OpenJev as a content evaluator. Its release notes caution that rollouts are staged, so an account may receive an update a week or more after the listed date.

OpenJev, identified as Qwen3.5 4B, had already appeared as a pay-per-token model service in the October 2 release notes. The new policy option puts it to work as an LLM-as-a-judge evaluator, classifying requests or responses against criteria written in natural language. Databricks says it typically responds faster than a chat evaluator because it generates no output tokens.

The mechanism is a multiple-choice question rather than a request for a written assessment. Databricks supplies the policy criteria and the content, with two options: flag or allow. The documentation says the flag option is deliberately worded to catch possible violations, making the judge lean toward flagging borderline content. OpenJev supplies no explanation, so a blocked caller receives the default denial message. For jailbreak and prompt-injection detection, Databricks recommends its built-in Jailbreak guardrail instead.

The tag addition handles more exact rules. Callers send string key-value pairs in the Databricks-Ai-Gateway-Request-Tags HTTP header, which custom policies can inspect for model services, model provider services and MCP tool calls. The same tags remain available before and after a service responds, including through retries and model fallback.

One published example requires a project tag from an approved list and denies requests when the value is missing, empty or unlisted. But this checks project eligibility, not the caller’s right to spend against it. Because callers supply the tags themselves, Databricks says permission must be checked against trusted identity and authorization data.

There is a separate trap for MCP approvals: the ASK decision neither displays nor distinguishes request tags. An approval can therefore be reused for an otherwise matching call carrying different tags. Databricks advises using ALLOW and DENY for tag-based enforcement, because those decisions are evaluated on every request. Tags also are not automatically added to judge prompts or included in events sent to external policy providers.