Model Governance on Databricks: Approval Flow, Audit & Reproducibility

Model governance is the discipline of managing and controlling the entire lifecycle of ML models — answering the question "who deployed which model to production, when, and why?" In regulated industries such as finance, healthcare, and insurance, auditability of model decisions is often a legal requirement.

On Databricks, model governance is achieved by combining MLflow Tracking (reproducibility), Unity Catalog Model Registry (approval flow), and Unity Catalog audit logs (audit trail). This article walks through all three pillars and how to design them in practice.

The Three Pillars of Model Governance

Unity Catalog Model Registry

UC Model Registry manages MLflow-trained models inside Unity Catalog's three-level namespace (catalog.schema.model_name). Compared with the legacy Workspace Model Registry, the key differences are:

• Three-level namespace: models live at catalog.schema.model_name. UC's permission model (GRANT / DENY) applies to models as well.
• Aliases: replace fixed stages (Staging/Production) with freely-defined aliases (e.g., Champion / Challenger / Baseline). A single version can hold multiple aliases.
• Cross-workspace sharing: any workspace under the same UC metastore can access the same model.
• Lineage tracking: automatically tracks which tables a model was trained from.

import mlflow

# Register a model in UC Model Registry
mlflow.set_registry_uri("databricks-uc")
model_uri = f"runs:/{run_id}/model"
mlflow.register_model(model_uri, "prod_catalog.ml_schema.fraud_detector")

# Assign an alias
from mlflow import MlflowClient
client = MlflowClient()
client.set_registered_model_alias(
    name="prod_catalog.ml_schema.fraud_detector",
    alias="Champion",
    version=3
)

Designing Alias Operations

Reproducibility with MLflow Tracking

Model reproducibility is guaranteed by recording these four elements:

Designing the Approval Flow

Promoting a production model (Challenger → Champion) should follow an approval flow like this:

[Data Scientist]
  │
  ├─ 1. Train model + record with MLflow Tracking
  │     └─ mlflow.log_param / log_metric / log_model
  │
  ├─ 2. Register in UC Model Registry
  │     └─ mlflow.register_model("runs:/{run_id}/model", "catalog.schema.model")
  │
  ├─ 3. Attach the Challenger alias
  │     └─ client.set_registered_model_alias(..., "Challenger", version=N)
  │
  [CI/CD pipeline (automated)]
  │
  ├─ 4. Run validation tests
  │     ├─ Accuracy threshold (AUC > 0.85)
  │     ├─ Data drift detection
  │     ├─ Latency requirement (p99 < 100ms)
  │     └─ Fairness / bias checks
  │
  ├─ 5. Record test results in the MLflow run
  │
  [ML lead / risk officer (manual approval)]
  │
  ├─ 6. Review test results, approve or reject
  │
  ├─ 7. On approval, swap the Champion alias
  │     └─ client.set_registered_model_alias(..., "Champion", version=N)
  │
  └─ 8. Move the previous Champion to Archived

Audit Trail

The Unity Catalog audit log automatically records the following operations against a model:

• Model registration (CREATE_REGISTERED_MODEL)
• Version creation (CREATE_MODEL_VERSION)
• Alias change (SET_REGISTERED_MODEL_ALIAS)
• Permission change (UPDATE_GRANTS)
• Model deletion (DELETE_REGISTERED_MODEL)

These logs are queryable via the audit_logs table in System Tables, so you can retroactively trace "who promoted which model version to Champion, and when." This is the evidence required for model risk management and other regulatory compliance regimes (e.g., SR 11-7).

Practical Design Guidelines

• Standardize model naming: use catalog.schema.{team}_{use_case} consistently to keep models discoverable and manageable (e.g., prod_catalog.ml.fraud_detection_xgboost).
• Enable autolog() by default: turn on mlflow.autolog() across the team so parameters and metrics are never accidentally omitted.
• Record the Delta table version: log the training data's Delta version via log_param so the exact same data can be re-read for retraining.
• Apply least-privilege GRANTs: data scientists get model registration only; promoting to Champion is restricted to the ML lead or the CI/CD pipeline.

What the Exam Tests

• "How does Databricks manage promotion of models to production?" → UC Model Registry + aliases
• "What must you log to guarantee model reproducibility?" → Code, data, environment, parameters
• "What is the difference between aliases and stages?" → Aliases are freely-defined and multi-assignable; stages are fixed and limited to 3
• "How do you audit operations on a model?" → UC audit log (System Tables)

Test Your Understanding

Frequently Asked Questions