# Trustworthy AI in the Agentic Lakehouse: from Concurrency to Governance

arXiv: https://arxiv.org/abs/2511.16402 · HTML: https://mlsanity.com/paper/2511.16402/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 3 of its 13 references that are in the map.
- First posted on arXiv 20 Nov 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 3 of 3)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Supporting Our AI Overlords: Redesigning Data Systems to be Agent-First](https://mlsanity.com/paper/2509.00997/) (2025)
- [Eudoxia: a FaaS scheduling simulator for the composable lakehouse](https://mlsanity.com/paper/2505.13750/) (2025)

## Built on by (most cited first, 5 of 5)

- [Building a Correct-by-Design Lakehouse. Data Contracts, Versioning, and Transactional Pipelines for Humans and Agents](https://mlsanity.com/paper/2602.02335/) (2026)
- [Querying Everything Everywhere All at Once: Supervaluationism for the Agentic Lakehouse](https://mlsanity.com/paper/2603.13380/) (2026)
- [A Query Engine for the Agents](https://mlsanity.com/paper/2605.27785/) (2026)
- [Data Flow Control: Data Safety Policies for AI Agents](https://mlsanity.com/paper/2606.05679/) (2026)
- [GitLake: Git-for-data for the agentic lakehouse](https://mlsanity.com/paper/2607.08319/) (2026)

## Abstract (arXiv)

Even as AI capabilities improve, most enterprises do not consider agents trustworthy enough to work on production data. In this paper, we argue that the path to trustworthy agentic workflows begins with solving the infrastructure problem first: traditional lakehouses are not suited for agent access patterns, but if we design one around transactions, governance follows. In particular, we draw an operational analogy to MVCC in databases and show why a direct transplant fails in a decoupled, multi-language setting. We then propose an agent-first design, Bauplan, that reimplements data and compute isolation in the lakehouse. We conclude by sharing a reference implementation of a self-healing pipeline in Bauplan, which seamlessly couples agent reasoning with all the desired guarantees for correctness and trust.