mlsanityData to 14 Oct 2026

Data Flow Control: Data Safety Policies for AI Agents

arXiv 2606.05679 ↗First posted 4 Jun 2026cs.DB cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Agents increasingly generate SQL, orchestrate pipelines, and automate data analysis on behalf of users. While recent work improves query correctness, correctness is not safety. A query may be semantically valid yet violate regulatory, privacy, or business constraints that govern how data may be combined and released. We argue that enforcing such constraints is fundamentally a data infrastructure problem. This paper introduces Data Flow Control (DFC), a framework to declaratively specify and guarantee policy enforcement over tuple-level data flows within a DBMS query. A key challenge is defining a policy language that is optimizer-invariant yet efficient to enforce at scale. We formalize data safety as aggregate predicates over provenance monomials and present Passant, a portable query rewriting layer that enforces DFC policies without materializing provenance. Across five DBMS engines -- DuckDB, Umbra, PostgreSQL, DataFusion, and SQLServer -- Passant achieves ~0% overhead and outperforms alternatives by orders of magnitude. As a result, Data Flow Control is the first step towards moving data safety from prompts and post-hoc checks into the data infrastructure. Data Flow Control is available open source at https://github.com/dataflowcontrol/data-flow-control.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 18 of its 55 references that are in the map. First posted on arXiv 4 Jun 2026.

Builds on

18 of 55 references.

References · 18

  1. 2018Spider: A Large-Scale Human-Labeled Dataset for Complex and Cross-Domain Semantic Parsing and Text-to-SQL Taskcited by 1,139
  2. 2023Can LLM Already Serve as A Database Interface? A BIg Bench for Large-Scale Database Grounded Text-to-SQLscited by 688
  3. 2023Text-to-SQL Empowered by Large Language Models: A Benchmark Evaluationcited by 385
  4. 2025Defeating Prompt Injections by Designcited by 297
  5. 2024CodeS: Towards Building Open-source Language Models for Text-to-SQLcited by 187
  6. 2025Securing AI Agents with Information-Flow Controlcited by 121
  7. 2025Contextual Agent Security: A Policy for Every Purposecited by 59
  8. 2024ShieldLM: Empowering LLMs as Aligned, Customizable and Explainable Safety Detectorscited by 51
  9. 2025Supporting Our AI Overlords: Redesigning Data Systems to be Agent-Firstcited by 32
  10. 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systemscited by 25
  11. 2016Towards Linear Algebra over Normalized Datacited by 12
  12. 2019A Layered Aggregate Engine for Analytics Workloadscited by 12
6 more
  1. 2018Smoke: Fine-grained Lineage at Interactive Speedcited by 6
  2. 2021Functional Collection Programming with Semi-Ring Dictionariescited by 6
  3. 2025Trustworthy AI in the Agentic Lakehouse: from Concurrency to Governancecited by 5
  4. 2025Toward Systems Foundations for Agentic Explorationcited by 4
  5. 2025GAF-Guard: An Agentic Framework for Risk Management and Governance in Large Language Modelscited by 2
  6. 2018You Say 'What', I Hear 'Where' and 'Why': (Mis-)Interpreting SQL to Derive Fine-Grained Provenancecited by 1

Built on by

Not cited yet.