# Safe, Untrusted, "Proof-Carrying" AI Agents: toward the agentic lakehouse

arXiv: https://arxiv.org/abs/2510.09567 · HTML: https://mlsanity.com/paper/2510.09567/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 17 of its 25 references that are in the map.
- First posted on arXiv 10 Oct 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 17 of 17)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Executable Code Actions Elicit Better LLM Agents](https://mlsanity.com/paper/2402.01030/) (2024)
- [Agentic Context Engineering: Evolving Contexts for Self-Improving Language Models](https://mlsanity.com/paper/2510.04618/) (2025)
- [If LLM Is the Wizard, Then Code Is the Wand: A Survey on How Code Empowers Large Language Models to Serve as Intelligent Agents](https://mlsanity.com/paper/2401.00812/) (2024)
- [LLM With Tools: A Survey](https://mlsanity.com/paper/2409.18807/) (2024)
- [Supporting Our AI Overlords: Redesigning Data Systems to be Agent-First](https://mlsanity.com/paper/2509.00997/) (2025)
- [Argos: Agentic Time-Series Anomaly Detection with Autonomous Rule Generation via Large Language Models](https://mlsanity.com/paper/2501.14170/) (2025)
- [Building a serverless Data Lakehouse from spare parts](https://mlsanity.com/paper/2308.05368/) (2023)
- [Reasonable Scale Machine Learning with Open-Source Metaflow](https://mlsanity.com/paper/2303.11761/) (2023)
- [Data Pipeline Quality: Influencing Factors, Root Causes of Data-related Issues, and Processing Problem Areas for Developers](https://mlsanity.com/paper/2309.07067/) (2023)
- [Reproducible data science over data lakes: replayable data pipelines with Bauplan and Nessie](https://mlsanity.com/paper/2404.13682/) (2024)
- [Eudoxia: a FaaS scheduling simulator for the composable lakehouse](https://mlsanity.com/paper/2505.13750/) (2025)
- [The Data Lakehouse: Data Warehousing and More](https://mlsanity.com/paper/2310.08697/) (2023)
- [An Empirical Study of Developers' Challenges in Implementing Workflows as Code: A Case Study on Apache Airflow](https://mlsanity.com/paper/2406.00180/) (2024)
- [Bauplan: zero-copy, scale-up FaaS for data pipelines](https://mlsanity.com/paper/2410.17465/) (2024)
- [FaaS and Furious: abstractions and differential caching for efficient data pre-processing](https://mlsanity.com/paper/2411.08203/) (2024)
- [Hub Star Modeling 2.0 for Medallion Architecture](https://mlsanity.com/paper/2504.08788/) (2025)

## Built on by (most cited first, 6 of 6)

- [Building a Correct-by-Design Lakehouse. Data Contracts, Versioning, and Transactional Pipelines for Humans and Agents](https://mlsanity.com/paper/2602.02335/) (2026)
- [AI for Distributed Systems Design: Scalable Cloud Optimization Through Repeated LLMs Sampling And Simulators](https://mlsanity.com/paper/2510.18897/) (2025)
- [Querying Everything Everywhere All at Once: Supervaluationism for the Agentic Lakehouse](https://mlsanity.com/paper/2603.13380/) (2026)
- [AgileLog: A Forkable Shared Log for Agents on Data Streams](https://mlsanity.com/paper/2604.14590/) (2026)
- [GitLake: Git-for-data for the agentic lakehouse](https://mlsanity.com/paper/2607.08319/) (2026)
- [Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races](https://mlsanity.com/paper/2609.29522/) (2026)

## Abstract (arXiv)

Data lakehouses run sensitive workloads, where AI-driven automation raises concerns about trust, correctness, and governance. We argue that API-first, programmable lakehouses provide the right abstractions for safe-by-design, agentic workflows. Using Bauplan as a case study, we show how data branching and declarative environments extend naturally to agents, enabling reproducibility and observability while reducing the attack surface. We present a proof-of-concept in which agents repair data pipelines using correctness checks inspired by proof-carrying code. Our prototype demonstrates that untrusted AI agents can operate safely on production data and outlines a path toward a fully agentic lakehouse.