Unity Gateway rate limit says permission denied: separate admin rights from quota

An administrator can discover a system.ai model but cannot edit its rate limit; a call also returns an error saying the endpoint is disabled by a Databricks-set limit of zero. A recent Databricks Community question puts both symptoms together. They should be investigated separately: one concerns authority to change a model service, the other concerns whether the service is enabled and has capacity.

Check the securable and grants

Record the exact three-part model-service name, workspace, metastore and caller. Inspect effective Unity Catalog grants on the service and system.ai schema. Account administration and Unity Catalog management are different scopes. Databricks documents EXECUTE for calling services, team-scoped grants, and separate model services when groups need different quotas. Do not grant metastore-wide control merely to change one setting; ask the UC owner for the narrow documented management path.

Treat a zero limit as its own signal

Test an authorized call after confirming the service is available in that region and account. Capture the precise error, request ID, model-service name and time. A Databricks-set limit of zero should not be assumed to disappear when a user's UI permission changes. If the configured model is not available, involve Databricks support or the platform owner with that evidence rather than repeatedly changing grants.

Design the operating boundary

Separate who may invoke a service, who may change policy and who owns spending. Use a small test principal to prove the intended rights. Set an application response for 403 and 429 paths: stop, surface a useful message, and avoid unbounded retries. The buyer should ask for an access matrix, a quota owner and usage visibility before connecting production agents.

Adovo’s view

Governance fails when “admin” is treated as one universal permission. A model service is a business capacity with distinct readers, operators and budget owners. Name those roles, then make errors tell you which boundary refused the request.