Overview
Governance is the smallest section of the Generative AI Engineer Associate exam at 8%, about three or four questions, and has four official objectives. The first is using masking as a guardrail, for example redacting personal data in prompts, retrieved context or responses while keeping the application useful enough to meet its performance goal. The second is selecting guardrail techniques against malicious user input such as prompt injection and jailbreak attempts.
The third objective is legal: checking license and usage terms of data sources and models so the application does not create legal risk, such as using non-commercial data in a commercial product. The fourth is recommending an alternative when a data source contains problematic text, such as toxic, biased, outdated or sensitive content. On Databricks these controls draw on Unity Catalog access controls and column masks, AI Gateway guardrails and data cleaning in pipelines.
How it's tested
Governance questions present a risk, such as exposed personal data, a hostile prompt, a license condition or offensive text in a source, and ask for the most appropriate control. The best answer usually reduces the risk while keeping the application working, rather than shutting it down or ignoring the issue.
-
Mask without breaking
Sensitive data appears in inputs, context or outputs and you choose the masking approach that protects it while preserving usefulness.
-
Block the attack
A malicious input pattern is described and you choose the guardrail that detects or neutralizes it.
-
License and source fix
A data source has legal or content problems and you choose whether to filter, replace, license or exclude it.
A RAG app over support transcripts sometimes repeats customer phone numbers in answers. Removing the transcripts entirely is tempting but would destroy the knowledge they hold. Masking phone numbers during ingestion, and adding PII detection on outputs through AI Gateway, keeps the useful content while preventing exposure. That targeted control meets both the privacy and quality goals.
Objectives 4
Official objectives from the Databricks outline, in outline order.
5.1 Use masking techniques as guard rails to meet a performance objectiveRedacting or tokenizing sensitive data while keeping output quality.
- What it means
- Masking replaces sensitive values such as names, emails, card numbers or account IDs with placeholders or tokens. This objective asks where and how to mask so the application stays compliant without degrading its answers below the required performance level.
- What to understand
- Mask at ingestion so sensitive values never reach the index, at the input so prompts sent to external models are clean, and at the output to catch leaks. Typed placeholders such as [EMAIL] keep sentence meaning for the model. Unity Catalog column masks restrict sensitive columns by user. AI Gateway can detect PII and block or mask it on serving traffic.
- How it shows up
- Sensitive data must be protected without harming answer quality and you choose the masking point or method.
- Common confusion
- Deleting entire records containing PII, which loses useful content that masking would preserve.
5.2 Select guardrail techniques to protect against malicious user inputs to a Gen AI applicationDefending against prompt injection, jailbreaks and abuse.
- What it means
- Users may try to override instructions, extract system prompts, trigger harmful content or misuse tools. This objective covers choosing controls: input classification with safety models, AI Gateway safety filters, separating instructions from user content, limiting tool permissions and rate limiting.
- What to understand
- Defense works in layers. Screen inputs for injection and unsafe intent, keep user text clearly delimited from instructions, give agents least-privilege tools so injected instructions cannot do much, filter outputs, and limit request rates to slow abuse. Retrieved documents can also carry injected instructions, so treat them as untrusted content.
- How it shows up
- A malicious input pattern is described and you choose the guardrail that addresses it.
- Common confusion
- Believing a firm system prompt alone stops prompt injection.
5.3 Use legal/licensing requirements for data sources to avoid legal riskChecking licenses and terms before using data or models.
- What it means
- Data and models come with terms. This objective covers reading licenses and usage terms for documents, datasets, web content and models so that the application's use, especially commercial use, redistribution or training, is permitted.
- What to understand
- Public availability does not grant usage rights. Non-commercial licenses rule out commercial products. Some licenses require attribution or share-alike terms. Website terms may forbid scraping. Model licenses can restrict use cases or user counts. Record source provenance in table metadata and choose licensed or internal alternatives when terms do not fit.
- How it shows up
- A data source with stated license terms is described and you decide whether and how it can be used.
- Common confusion
- Assuming content published on the open web is free to use in a commercial application.
5.4 Recommend an alternative for problematic text mitigation in a data source feeding a GenAI applicationCleaning, filtering or replacing toxic, biased or outdated source text.
- What it means
- A source may contain offensive language, biased statements, outdated guidance or confidential material. This objective asks for a sensible alternative to using that text as is: filtering or redacting the problematic portions, replacing the source with a curated one, or adding review steps.
- What to understand
- Prefer targeted mitigation: classify and remove toxic passages, redact confidential parts, exclude superseded versions, or substitute an authoritative curated source. Where text cannot be cleaned reliably, exclude it. Output guardrails remain a backstop, not the main fix. Document the decision so later reviewers understand the source's treatment.
- How it shows up
- A source with problematic content is described and you recommend the mitigation.
- Common confusion
- Relying only on output filters while leaving toxic text in the index.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Masking
Replacing sensitive values with placeholders or tokens.
- Remember
- Mask early and check outputs too.
- Tested as
- Privacy guardrail questions.
- Trap
- Deleting whole records instead.
-
Typed placeholders
Tokens like [NAME] or [EMAIL] in place of values.
- Remember
- They keep sentence structure for the model.
- Tested as
- Masking quality questions.
- Trap
- Using blank removal that breaks meaning.
-
Unity Catalog column masks
Functions that hide column values based on the user.
- Remember
- Enforced at query time by the platform.
- Tested as
- Data access questions.
- Trap
- Masking only in application code.
-
AI Gateway PII detection
Detects personal data in endpoint traffic and blocks or masks it.
- Remember
- Works on inputs and outputs.
- Tested as
- Guardrail questions.
- Trap
- Assuming it replaces source cleaning.
-
Prompt injection
Input crafted to override instructions or misuse tools.
- Remember
- Can arrive via retrieved documents too.
- Tested as
- Malicious input questions.
- Trap
- Trusting the system prompt alone.
-
Jailbreak
Attempts to make the model ignore safety rules.
- Remember
- Use safety classifiers and output filters.
- Tested as
- Safety questions.
- Trap
- Treating it as a performance issue.
-
Least-privilege tools
Agents get only the permissions they need.
- Remember
- Limits damage from injected instructions.
- Tested as
- Agent safety questions.
- Trap
- Giving agents write access by default.
-
Rate limiting
Caps on requests per user or endpoint.
- Remember
- Slows abuse and controls cost.
- Tested as
- Abuse prevention questions.
- Trap
- Ignoring it as a security control.
-
Data license terms
Rights and restrictions attached to a source.
- Remember
- Public does not mean free to use.
- Tested as
- Legal risk questions.
- Trap
- Ignoring non-commercial clauses.
-
Problematic text mitigation
Filtering, redacting or replacing harmful source content.
- Remember
- Fix the source, keep output filters as backstop.
- Tested as
- Source quality questions.
- Trap
- Leaving toxic text indexed.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Where to apply masking
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| At ingestion | Mask before chunking and indexing | Sensitive data never stored in index | Masking only at output |
| At input | Mask prompts before model calls | Protects data sent to external models | Forgetting user-supplied PII |
| At output | Detect and mask before display | Catches leaks from any source | Treating it as the only control |
Defenses against malicious input
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Input safety classifier | Screens prompts for unsafe intent | Stops attacks before the model | Missing indirect injection in documents |
| Instruction separation | Delimits user text from system rules | Reduces override success | Relying on it alone |
| Least-privilege tools | Restricts what an agent can do | Limits impact of a successful attack | Granting broad write access |
| Rate limits | Caps request volume | Slows automated abuse | Seeing it only as cost control |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Delete instead of mask
- What candidates pick
- Drop every transcript that contains a phone number.
- Why it looks right
- It removes the risk completely.
- Why it's wrong
- It also removes useful knowledge; masking the numbers protects privacy while keeping the content available for retrieval.
Clue to watch for The requirement mentions keeping answer quality or coverage.
-
System prompt as shield
- What candidates pick
- Strengthen the system prompt to refuse injected instructions.
- Why it looks right
- It is the simplest change.
- Why it's wrong
- Injection works by overriding instructions, so it needs input screening, output checks and limited tool permissions as enforcement.
Clue to watch for Users are deliberately trying to subvert the application.
-
Public means permitted
- What candidates pick
- Scrape a public forum to train or ground a commercial assistant.
- Why it looks right
- The content is freely viewable.
- Why it's wrong
- Viewing rights are not usage rights; site terms and content licenses may forbid scraping or commercial reuse.
Clue to watch for The source has terms of use or a non-commercial license.
-
Output filter only
- What candidates pick
- Leave offensive source passages indexed and filter answers.
- Why it looks right
- The user never sees the bad text.
- Why it's wrong
- Problematic text still shapes retrieved context and answers; cleaning or replacing the source addresses the root cause.
Clue to watch for The issue is located in the source data.
-
Trusted retrieved content
- What candidates pick
- Treat instructions found inside retrieved documents as safe.
- Why it looks right
- The documents are internal.
- Why it's wrong
- Indirect prompt injection can hide in documents or web pages, so retrieved text must be treated as untrusted input.
Clue to watch for An agent reads external or user-uploaded documents.
Answer framework
For a Governance scenario, locate the risk and apply the least disruptive control that fully addresses it.
- Identify the risk type: sensitive data exposure, malicious input, licensing or legal terms, or harmful and outdated content in a source.
- For sensitive data, mask at ingestion and input where possible, add AI Gateway PII detection on outputs, and use Unity Catalog column masks for table access.
- For malicious input, layer safety classification, instruction separation, least-privilege tools, output filtering and rate limits, treating retrieved text as untrusted.
- For licensing, confirm the source and model terms allow the intended use, record provenance, and replace sources whose terms do not fit.
- For problematic text, clean, redact or replace the source first, exclude what cannot be fixed, and keep output guardrails as a backstop.
Practice question
Want more like this? The Databricks GenAI Assoc practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Governance is small, so keep study short and concrete. Start with masking: write a simple redaction function that replaces emails and phone numbers with typed placeholders, run it on sample text, and ask an LLM to answer a question from the masked and unmasked versions. You will see how placeholders keep answers useful. Then read the Databricks documentation for AI Gateway guardrails and Unity Catalog column masks, and note which layer each protects.
Next, study malicious inputs. Write three prompt injection examples, including one hidden inside a retrieved document, and list the control that would stop each. This builds the layered-defense habit the exam expects.
For licensing, read a few dataset and model licenses, including one non-commercial license and one permissive license, and summarize what each allows. Finally, list four kinds of problematic text, such as toxic, biased, outdated and confidential, and write the preferred mitigation for each. Revisit these ideas while studying other sections, since governance clues often appear in development and deployment questions as well.
FAQ
How much of the Databricks GenAI Associate exam is Governance?
Governance is 8% of the exam, roughly three or four scored questions, the smallest of the six sections.
What is masking in a generative AI application?
Replacing sensitive values such as names, emails or account numbers with placeholders so they are not stored, sent to models or shown to users.
Can a system prompt stop prompt injection?
Not reliably. Combine it with input screening, output filtering, least-privilege tools and rate limits.
Which Databricks features support these controls?
AI Gateway provides safety filtering, PII detection and rate limits on serving endpoints, and Unity Catalog provides access control, column masks and row filters.
Is public web content free to use?
No. Website terms and content licenses may restrict scraping, commercial use or redistribution, so check terms before using it.
What should I do with a source containing offensive text?
Filter or redact the offensive passages, or replace the source with a curated alternative, and keep output guardrails as a final safeguard.
Other Artificial Intelligence & Machine Learning certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered masking, defenses against malicious input, data licensing and problematic text mitigation. Test whether you can pick the responsible control that keeps the application working.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Databricks GenAI Assoc AI tutor Get any concept explained your way