How I built agent-based security reviews on Databricks

We already had automation in parts of our security review process. It was useful, but it did not reduce the manual work enough.

I kept seeing the same pattern in the queue: a routine integration using a familiar design could sit next to a genuinely novel, high-risk architecture, both waiting for the same scarce resource, an experienced reviewer.

The issue was not that our existing automation had failed. It had simply reached its limits. We were still spending expert time on predictable work, leaving less room for the decisions that truly required expert judgment.

So I built an agent-based layer to extend what we already had. The goal was not to replace the process or the people behind it. It was to help the system understand a request, apply our standards, ask for missing information, and recognize when a person needed to step in.

The first agent-based version focused on one review path. My team saw the broader pattern and expanded it into a set of agents that now support additional parts of our security intake and review process. I built that first version entirely on Databricks, the same platform our customers use.

I could move quickly because the core pieces were already available in one environment.