Genie One can run code unattended—and task instructions become the approval boundary

Databricks has extended Genie One beyond SQL with a public-preview code-execution feature that can perform statistical analysis, forecasting and what-if work in what the vendor describes as a secure, isolated sandbox. The more consequential detail is in the unattended path: scheduled tasks are allowed to execute generated code by default.

The approval moves into the task description

For an interactive chat, Genie One confirms that generated code matches the user’s request before running it. Scheduled tasks cannot ask a user at execution time, so Databricks uses the task instructions as the standing boundary instead. On every run, Genie One checks the generated code against those instructions; it executes when the two are consistent and declines when it cannot confirm the match.

That makes task wording operational policy, not merely a prompt. A useful scheduled-task review should therefore ask what data the task may read, what analyses it may perform, what outputs it may create and where those outputs may go. Broad instructions such as “prepare the weekly sales analysis” give the checker less explicit scope than a task that names the datasets, forecast horizon and permitted output.

Existing permissions still matter—but they answer a different question

Databricks says code runs as the user and grants no new permissions. Unity Catalog governance, data access controls and account entitlements continue to determine which data the execution can reach; requests outside those permissions stop. That is the authorization boundary.

The instruction check is a separate intent boundary. Permissions answer whether the scheduled identity can access an asset. The per-run comparison is meant to decide whether a particular generated program is consistent with what the operator asked the unattended task to do. Teams need both controls: narrow privileges do not prove that every allowed action belongs in a given automation, while precise task instructions do not revoke excessive warehouse access.

Scheduling also creates a cost surface

Code execution uses serverless compute and is billed as sandbox usage. A recurring task can therefore consume compute without an operator present, even when its data permissions are unchanged. Frequency, expected runtime and decline behavior belong in the operating checklist alongside task scope and identity.

The practical takeaway is simple: treat a Genie One scheduled task like a small production job. Review the identity it runs under, write a bounded specification rather than an open-ended request, and monitor both successful executions and refusals. The feature’s isolation and permission inheritance are useful foundations, but unattended safety depends on the quality of the standing instructions that replace a live approval.