Databricks lets Unity Gateway policies check request tags and use OpenJev as a judge

Databricks added two Beta features to Unity Gateway's custom service policies on October 9, 2026, according to its October release notes. Custom policies can now check tags that callers attach to a request, and a classification model called OpenJev (Qwen3.5 4B) can act as the evaluator in custom LLM-as-a-judge policies.

Request tags are string key-value pairs sent in the Databricks-Ai-Gateway-Request-Tags HTTP header. A policy can read them for model services, model provider services and MCP tool calls, and it sees the same tags before and after the service responds, including through retries and model fallback. A request with no header gets an empty tag object. By default the decoded keys and values may total 10 KiB. Malformed or oversized headers are rejected, and for MCP tool calls the gateway rejects them before evaluating policies, even in Log mode.

Databricks' own example requires a "project" tag drawn from an approved list and denies requests where it is missing, empty or unlisted. The documentation adds a warning: because the caller supplies the tag, it does not prove the caller may charge that project, so permission should be checked against trusted identity data.

A second caveat matters for MCP tools. Approvals under the ASK decision do not distinguish tags, so an approval can be reused for a similar call with different tags. Databricks advises using ALLOW and DENY for tag-based enforcement. Tags are also not added to judge prompts or sent to external policy providers.

For OpenJev, Databricks says the model classifies content without generating output tokens, so it typically responds faster than a chat evaluator. The company has not published timing figures in these pages. The guidance says OpenJev does not explain its verdicts, so a blocked caller sees a default denial message. It is built to lean toward flagging borderline content, works best on English text, and should be tested in Log mode before enforcement. For jailbreak detection, Databricks points to its built-in guardrail instead.

Account admins control access to both features from the account console's Previews page. Policies fail closed, so an evaluation error or missing field results in a denial.

What remains uncertain is how well either feature performs in practice. Every claim here comes from Databricks documentation, so this is a single-publisher account. A search found no independent reporting or testing, and the Beta label means behavior may change. For teams governing AI agents, the practical point is that tags are a convenient routing and cost-control signal, while the documentation itself says they should not stand in for authorization.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. The earlier version remains available as revision 1.