A new paper argues AI systems that turn plain English into database queries should refuse to answer rather than quietly guess wrong.
The researchers describe a core problem with LLM-powered text-to-SQL tools: a hallucinated column name or a botched aggregation produces an answer that reads just as fluently as a correct one, with nothing marking it as wrong. That's a bigger issue when nobody can check the underlying query, as in enterprise dashboards, or when the "user" is another AI agent chaining outputs downstream. Their proposed fix is an architecture they call a trusted kernel with a generative shell. An LLM only interprets the question and phrases the response, while a separate deterministic layer matches it against a fixed set of answerable "question shapes" and computes the actual value. Anything that doesn't fit one of those shapes gets declined outright, not approximated, and the system shows a confirmation before it runs anything.
The framing matters more than the mechanism. This treats the problem as reliability, not accuracy: the goal isn't a model that guesses right more often, it's one where a wrong guess never looks like a real answer. That's a different bet than confidence-based abstention, where a system estimates how sure it is before answering. Here, unanswerable requests simply can't be represented, so no confidence score is needed, and the authors say the same invariant extends to actions taken by autonomous agents, not just returned values.
The team backs the idea with a two-year production case study run against two generative alternatives, a fine-tuned parser and a tool-retrieval agent, which is a rarer level of real-world testing than most architecture proposals offer.