Databricks Shipped The Switch Nobody Named An Owner For

So, What Actually Happened?

Saturday morning, coffee, and I keep going back to a forum post. Databricks documented allow, ask and deny lists for its AI connectors, which is about as unglamorous as software gets. A settings screen. Then a piece out of Washington asking what all these new AI auditors will audit, because the auditing market is hiring faster than anyone has agreed a standard. Then a Dublin law firm on whether insolvent companies can sell their data. We scanned 190,000 articles this week so you don't have to. Three desks, no overlap between them, and the same question underneath all three: not what the rules are, but which switch enforces them and whose name sits on that switch.

The Bottom Line: The AI rulebook is still in draft. The switches that enforce it shipped this week.

The Tracks That Matter

1. Databricks Shipped A Deny List For AI Connectors

The dullest post of the day is the one that quietly rewrites a job description. Databricks published allow, ask and deny controls for pre-delivered MCP connectors, which means the question of which agent may reach which system is now a setting somebody owns rather than a paragraph in a policy document. Qlik moved the same week, extending MCP across AWS and Databricks, so the connector layer is consolidating on one protocol while the controls around it are still invented per vendor. That is the awkward middle: a standard for the plumbing, no standard for the tap. Whoever holds that list decides what your agents can touch, and right now it is probably a platform engineer nobody thought to tell.

Here's what works: Find who owns the connector allowlist in your data platform. If nobody can name them, that is your answer.

2. Your Vendor's Bankruptcy Is Now A Data Question

Here is a scenario nobody rehearses. A law firm asked whether insolvent companies can realise the value of their data, and the honest answer is messy: the data sits on the balance sheet as an asset, while the rights to it sit in contracts and privacy law that mostly never contemplated a liquidator. A separate note the same week worked through what AI vendor terms say about training rights, which is the same problem one step earlier in the story. You signed a contract about what a living vendor may do with your data. Very few of those contracts say what happens to it when the vendor stops being alive. After the year software valuations have had, that clause is not theoretical.

Here's what works: Pull your three largest AI vendor contracts and find the insolvency clause. If data rights are not named there, ask before you renew.

3. The New Threat Vector Is On Your Payroll

The security desks spent the week pointing at employees, politely. One argued that citizen developers are the new enterprise threat vector and that nobody is warning them, which is fair: we handed people tools that write code and call APIs, then filed the risk under training. Another traced when shadow AI became a compliance issue rather than an IT annoyance, which is the moment it earns a line in an audit report instead of a grumble in a standup. In our reading this week, shadow AI gained ground as the thing tying security, legal and procurement conversations together. It stopped being a tooling problem. It is a ”who approved this” problem, and those move slower.

Here's what works: Ask finance for every AI tool appearing on expense cards. That list, not the survey, is your real AI inventory.

Quick hits:

• Oracle put a triple-digit number on cloud growth. Its first-quarter results leaned on cloud rather than licences, which matters because the multi-cloud shortlist your architects drew up two years ago is now out of date.
• Z.AI went to Hong Kong for $5 billion. The post-IPO raise ranks among China's biggest AI deals and answers the open question about whether open-weight model companies can finance themselves.
• Media licensing has a geography. Seventy-one percent of AI deals with news outlets landed in anglophone countries, which shapes whose facts your models are fluent in and whose they are not.

Signal vs. Noise

🟢 Signal: shadow AI. It crossed this week from a security grumble into named compliance work, with buyer checklists for agent security shipping and citizen developers formally labelled a threat vector. Most coverage still files it under employee training, which is exactly why it keeps getting funded last.

🔴 Noise: the AI governance committee. ”AI governance” stayed one of the loudest phrases on the wires and lost its hold on everything actually moving. The work migrated into connector settings, contract clauses and audit scopes, and none of those need a steering group to sign them off.

From the 190K

We scanned 190,000 articles this week. Here's what no one's talking about:

Hammerspace published an architecture for enforcing policy on unstructured files, SAI360 published a catalogue of more than a dozen overlapping compliance regimes, and a hosting blog asked who actually signs the HIPAA business associate agreement in 2026.

Read separately, three vendors doing content marketing. Read on one morning, all three answer the same question, and it is not ”what are the rules.” It is: at what exact point does a rule bite, on what object, and whose signature is on that point. Hammerspace's answer is the file's own metadata. SAI360's is the pile-up where several regimes land on one document. The hosting piece's answer is a named counterparty on a contract.

What changes on Monday is who you invite. The person who owns your AI policy and the person who owns the switch that enforces it are usually two different people, and they have probably never been in the same meeting.

By The Numbers

• Microsoft is adding 26 gigawatts of compute to triple its data-center capacity — capacity, not model quality, is what sets enterprise AI roadmaps for the next two years.
• 79% of AI predictive-model studies carried a high risk of bias — a systematic review across 14 Asia-Pacific countries found most failed on external validation and on handling missing data.
• 71% of AI licensing deals with media went to anglophone outlets — the training-data market is far narrower geographically than the products built on it claim to be.
• NASA and IBM open-sourced a lunar model that locates moon ice 22% more accurately — the open-weight argument is being won in science long before it is won in procurement.
• Loft Orbital and Marlan Space are planning a $1 billion AI satellite fleet — inference is moving into orbit while most companies have not moved it off a laptop.
• See what's rising across AI and data this week →

Deep Dive: The Rider And The Load-In

Every gig has a rider. It is the document listing what you need: the decks, the monitors, the power, the bottle of water nobody drinks. I have handed over riders that were beautiful. Then you arrive at load-in and the room tells you the truth. The socket is on the wrong wall, one monitor hums, and a sound engineer you have never met decides what actually happens tonight. The rider is the policy. The load-in is where it either happens or it does not. This week the industry spent its time at load-in.

The rider is not the room

Documents scale beautifully and enforce nothing. A connector allowlist, a retention rule bound to a file's own metadata, a deny setting on an agent: small, ugly, and they actually stop things. One of these is presentable to a board. The other one works.

Somebody has to sign

The through-line in the boring stories is a named counterparty. Who signs the business associate agreement. Who holds the deny list. Who owns the data if the vendor liquidates. Policy spreads responsibility around a table. Enforcement concentrates it onto one person, usually someone who was not at that table when the policy was written.

The audit arrives before the standard

Washington is already asking what the new AI auditors will audit, which sounds backwards and is how every previous control regime started. Nobody waits for a finished rulebook. They hire the people who will eventually apply one, and those people start asking for evidence years before anyone agrees what counts as evidence.

What Actually Works

1. Name the switch, not the principle: for every AI rule you hold, write down the setting, clause or system that enforces it. The blanks are your real risk register.
2. Put the enforcer in the policy meeting: the engineer holding the allowlist belongs in the governance session, not in the summary email afterwards.
3. Read the insolvency clause: before renewal, know what happens to your data if the vendor does not survive the year.
4. Inventory by expense card, not by survey: people tell surveys what they should be using and tell finance what they are actually using.

Anybody can write a rider. The show is whatever the room lets you do at eight o'clock.

What's Coming

Allowlists Become A Procurement Question

Qlik extended its connector layer across AWS and Databricks this week, pushing MCP further toward being the default integration standard. Expect the first RFPs that ask vendors to document their agent permission model rather than their benchmark scores. That question is much harder to answer with a demo.

Duty Of Care Lands On Platforms

Australia is consulting on a digital duty of care for online services, the next phase of its online safety reforms. Duty-of-care framing travels well between jurisdictions precisely because it spares legislators from defining the technology. Expect the same shape to show up in AI rules within a year.

Renting The Stack Becomes The Default

One argument doing the rounds: build data platforms that outlive their stacks by renting the technology and owning the model of the business. If that thinking wins, the durable asset in your architecture is the meaning of your data, and every tool underneath it becomes a swappable line item.

For Your Team

Monday's meeting prompt: ”Take our three most important AI rules. For each one, name the exact setting, contract clause or system that enforces it, and name the person who can change it. Anything we cannot answer in one sentence is not a rule, it is an intention, and we should stop presenting it as a control.”

Share-worthy stat: A systematic review of AI predictive models across 14 Asia-Pacific countries found 79% carried a high risk of bias, mostly for two unglamorous reasons: no external validation, and careless handling of missing data. The models were not exotic. The evidence under them was thin.

Go deeper: Track where AI enforcement and AI evidence are actually moving →

The Track of the Day

”The gap between written policy and enforced policy is where regulatory exposure lives.”
On why governance documents keep passing audits that systems fail

I have watched that gap for twenty years under a dozen different names. The policy gets signed, the control gets assumed, and nobody checks the two are connected until somebody external does the checking for you.

We scanned 190,000 articles this week so you don't have to. Data Pains → Business Gains.

Published: September 12, 2026 | Curated by Yves Mulkers @ Ins7ghts