AI agents that build data pipelines are getting graded, not just trusted.
Researchers describe two new systems, Zero-Trust Agentic Data Engineering and Zero-Trust Agentic OLAP, in a paper published on arXiv (arXiv:2609.29668). The first turns natural-language requests into deployed data-engineering code, but only marks a task done once it has evidence from the repository, the deployment, the runtime, and the relevant policy checks. The second governs analytical queries: results only ship after the system confirms it ran on the same data snapshot, produced an exact-matching result, and passed a grounding and reflection check. Both systems share three building blocks - graph engineering to gate each workflow step on evidence, loop engineering to recover from failures within limits, and harness engineering to keep execution untrusted by default. The researchers tested both under normal conditions, deliberate failures, and policy restrictions, tracking how often tasks completed, recovered, and were correctly authorized.
Handing an AI agent write access to a cloud data warehouse is a fast way to get a wrong number treated as gospel. This work is an attempt to make that agent show its receipts - deployment logs, matching snapshots, policy sign-off - before anything reaches production. That is a meaningfully higher bar than the trust-the-agent's-summary approach most current data-copilot tools quietly rely on.
Whether enterprises adopt anything this rigorous, or just bolt a chatbot onto their BI dashboard and call it a day, remains the open question.