The Enforcement Boundary

For four decades, database architecture rested on an unstated assumption: that a human authors the query. Interfaces, optimizers, and access controls were all shaped around a person expressing intent and a system executing it. That assumption is now false for a growing majority of workloads. The query author is a language model; the human has moved one level up, conversing with the agent rather than the engine.

The shift goes deeper than a new client. It inverts the platform's job. When people wrote the queries, the platform's role was to help humans express intent: worksheets, autocomplete, visual builders. When agents write the queries, that work is obsolete, and a different, harder job takes its place: making an autonomous, tireless, occasionally wrong author trustworthy at scale. An agent will ask a hundred questions where a human asked one, will attempt writes a human would have hesitated over, and will do both without the tacit judgment a trained analyst brings.

The naive response is to conclude that the database dissolves into a commodity file store that a sufficiently capable model reads directly. We will argue the opposite. Precisely because the author can no longer be trusted to self-regulate, the properties a database has always quietly provided (ground truth, permissions, reproducibility, an economic record) become more load-bearing, not less. The engine's value migrates from ergonomics to assurance.

We name the two concerns precisely, because the whole argument turns on where a given property lives.

Between them is a narrow interface: a stream of statements going down, results coming back up. Every guarantee a system can offer an agent is ultimately a property of what happens at that interface: which statements are admitted, how they are rewritten, what is recorded, what is refused. The central question of agent-native data systems is therefore not "how smart is the agent" but "on which side of the interface does each guarantee live."

Consider the dominant pattern of 2026: a capable coding agent connected to a conventional database through a tool protocol. Every safety and quality property in that arrangement is expressed in the reasoning plane. "Do not read personally identifying columns" is a sentence in a prompt. "Confirm before deleting" is a client-side dialog. "Here is what the schema means" is a file the harness may or may not load into context this session. Each is real engineering; none is a guarantee.

The same properties, relocated below the interface, change in kind rather than degree. A column policy applied inside the scan rewrite means the masked bytes never enter the result set: the agent cannot see them regardless of what SQL it composes, because the values are gone before the model is reached. A budget enforced at execution means the hundred-and-first statement is refused after the budget is spent, whatever the agent's plan. A write redirected onto a copy-on-write branch means the base data is untouched until a human merges, no matter how confidently the agent believed it should ship.

This reframes the build-versus-connect question. Connecting a model to a database is trivial and valuable; it is also the beginning, not the end. The interesting engineering is what the database must become once its principal author is an agent, which is to say how many of the guarantees currently living as advisory text can be pushed down into structure.

Five properties recur across agent workloads. For each, we contrast the advisory form (reasoning plane) with the enforced form (truth plane). The distinction is not academic: only the enforced column survives an adversarial or simply careless agent.

Two observations follow. First, every advisory form is reconstructable from the reasoning plane alone, which is exactly why a model-plus-database can approximate all five and guarantee none. Second, every enforced form requires state the store already holds: version history, a catalog, an executor that rewrites statements. The guarantees are not bolted on; they are what the truth plane was already for, now exposed to a new kind of caller.

"Will the same question return the same answer?" has no single correct answer for an agent-native system, because the right degree of determinism depends on the question. Exploration wants freedom; a board metric wants a bit-for-bit guarantee; most work sits between. A system that fixes one regime for everything is wrong for most requests.

The reasoning plane, on its own, offers only the loosest setting: a model re-derives SQL on each ask, choosing joins and filters afresh, so identical questions can yield quietly different numbers. The truth plane can offer the whole range, selectable per query:

Agent memory today is a text file. It is per-user, so a conclusion drawn from privileged data leaks to anyone who reads the file. It is ungoverned, so nothing checks that a reader is entitled to the answer. And it is inert: it has no relationship to the data it summarizes, so it rots in silence, confidently repeating a number that stopped being true a week ago.

Relocated to the truth plane, memory becomes a first-class object with three properties the file cannot have. It is governed: reading a stored answer requires a role at least as privileged as the one that produced it, so conclusions never cross a permission boundary that the underlying data would have stopped. It is pinned: each answer records the exact data versions it was computed from. And because the store is version-chained, its freshness is computed, not guessed: an answer is current while its inputs are unchanged, stale the moment a source advances, invalidated if a source disappears.

The same argument governs context, the input side of memory. A hand-maintained schema document is wrong within a week and unauthored thereafter. A context briefing generated on demand from the live catalog, filtered to the caller's role and fitted to a token budget, is never stale and never over-shares, because it is a projection of the truth plane rather than a copy kept alongside it.

A conversational harness is, by construction, reactive: it acts when addressed and is otherwise inert. Yet the analytical work with the highest value is proactive: noticing that a rate has moved, that a pipeline has stalled, that a standing question now has a different answer. Nothing in the reasoning plane can initiate this, because nothing there is watching the data.

Proactivity requires an event substrate in the truth plane: change data capture that detects when a table advances, scheduled tasks that fire on that signal, standing definitions that re-answer themselves, and a mechanism to surface a material change to a human. Given those primitives, the distinction between a dashboard and an agent dissolves: a dashboard is merely a standing question that some process keeps true. The loop runs whether or not any chat window is open, because its trigger is a fact about the data, not a message from a user.

The case for enforcement locality sharpens under an explicit threat model. We assume no malicious operator. The adversary is the ordinary failure surface of an autonomous author, compounded because agents also process untrusted input and can be steered by it.

• Instruction drift. A rule stated at the top of a long task is diluted by everything after it; the model complies less as context fills. An enforced constraint has no such gradient.
• Indirect injection. Data the agent reads can contain instructions. If the only thing stopping a destructive act is a sentence in the prompt, a sentence in the data can countermand it. A structural refusal cannot be argued with.
• Context loss. Compaction, session boundaries, and tool limits routinely evict the very rules meant to protect the system. Enforcement in the store does not compact.
• Confident error. The sincerely mistaken agent, executing a wrong plan flawlessly, is more dangerous than the jailbroken one. Isolation (write staging, budgets, review) assumes error rather than malice, and contains both.

None of this argues for a particular agent, or against connecting the best available model to the store. The opposite: because the guarantees live below the interface, the reasoning plane above it is interchangeable. A stronger model, a different harness, an external coding agent speaking a tool protocol: each inherits meaning, isolation, receipts, economics, and memory automatically, because those properties are enforced beneath it and cannot be opted out of.

We validated this with a reference implementation. The same governed-execution path (budget check, write-staging onto a branch, redirected reads, an immutable receipt) was exercised through two entirely different callers: a built-in conversational surface, and an external coding agent connected over a standard tool protocol, with no knowledge that any of these guarantees existed. In both cases a write to live data was transparently staged on an isolated branch; the caller observed its own change; the base data was untouched until a human approved; and the action appeared in the review queue attributed to its session. The external agent could not bypass the contract, because the contract is not in the agent.

The argument rests on an empirical claim: that relocating a property below the interface changes its strength in kind, not degree. We evaluate all five guarantees of §4, and additionally subject the confidentiality boundary (the governance property on which the meaning and memory guarantees both depend) to an adversarial battery. In each experiment the advisory regime is the property absent from the truth plane: the same query path with enforcement removed, which is precisely the behavior of a capable model connected to a store that does not implement the guarantee. The enforced regime is the property made structural. The harness is deterministic, self-contained, and network-free; the figures below are its output.

Three of the rows illustrate the pattern quietly. Meaning: asked for a single quantity (average order value over data where some orders carry multiple line items), three defensible SQL formulations returned two different numbers, two of them wrong; the governed metric returned one value on every call, because the definition is executed rather than recalled. Receipts: after the underlying data advanced, the earlier answer was reconstructed exactly from the version chain while the live query returned a different number, an audit trail that is a property of the store rather than of a retained transcript. Memory: a stored answer refused to open for a lesser role, and its freshness moved current→stale→invalidated as its inputs changed and then vanished, a conclusion that knows when it has expired. In each case the advisory analogue (re-derived SQL, a lost number, an ungoverned text file) offers none of these.

The confidentiality result is the sharpest, because it separates enforcement in the scan from masking at output, a distinction that a naive implementation blurs and an adversarial agent exploits. Output masking passes the direct-read test yet fails the filter probe: an agent that cannot see a column can still confirm a suspected value by observing whether WHERE ssn = '…' selects a row. When the policy is applied inside the scan rewrite, the filter itself sees masked bytes, so equality against a real value matches nothing, and the probe returns zero. Across twelve attempts (transforms, substrings, concatenation, a length side-channel, equality and LIKE probes, order-by, aggregates, a CTE, a self-join) the enforced path leaked nothing, while the same queries against an unprotected copy leaked fourteen values. The control matters too: the privileged role still reads every real value, so the guarantee is precise: a scoped confidentiality boundary rather than a blanket denial. The inference risk itself is old: that a querier can reconstruct a hidden value by probing predicates is a classic result in statistical-database security¹⁴, and vendors' own documentation shows output masking failing in exactly this way. Our claim concerns the placement of the defense, in the scan rather than at projection, and its demonstration against an agent running the attack.

The isolation result is the one that most directly refutes the connect-a-model position. The identical governed-execution path was driven by two callers that share no code above the interface (a built-in conversational surface and an external coding agent speaking a standard tool protocol) and produced identical behavior: three writes apiece, live data byte-for-byte unchanged until a human approved, each caller nonetheless observing its own staged changes, and every statement recorded for review. The external agent had no knowledge that any of these guarantees existed and no way to bypass them, because the contract is enforced beneath it.

Authority-path controls

The guarantees above bound an agent's blast radius: what it can break once it acts. A second, sharper class of control bounds the authority path: how an agent is permitted to ask, and whether it can be steered by what it reads. The same enforcement locality applies, and the reference implementation exposes five such controls, each measured against the advisory analogue.

Two of these bear directly on the §8 threat model. Compelled governance answers instruction drift and the raw-SQL escape hatch at once: an agent that cannot emit raw SQL cannot misdefine a quantity or reach an ungoverned column, whatever it is told, because the refusal is in the executor rather than the prompt. Injection resistance answers indirect injection: the privileged and irreversible operations that bypass write-staging are refused structurally, so an instruction hidden in a data cell that says to drop a database or grant a role has nothing to act on. The remaining three extend the earlier guarantees, closing the inference channel that in-scan masking alone leaves open (§10), pushing freshness from a read-time discovery to a write-time fact (§6), and turning a governed answer into a reusable, vetted query. Each was exercised through the same external tool protocol as the isolation experiment, with no cooperation from the agent required.

Reproducibility: the harness is a single file with a fixed seed and no network dependency; every figure above is regenerated by running it against the reference implementation.

The argument here draws three converging lines of work together. None, to our knowledge, unifies them, and it is the union we claim rather than the parts.

The principle that enforcement must sit outside the model is established in agent security. CaMeL¹ extracts control and data flow from a request and enforces capability policies in a deterministic interpreter the model cannot override; a companion catalogue of design patterns² and the earlier dual-LLM pattern³ share the stance that a language model is reliably steerable and therefore cannot be its own guard. We adopt this principle wholesale and generalize it, from defending against prompt injection to enforcing the full analytics guarantee set at the data plane.

The meaning guarantee is not ours to claim. The governed semantic layer as a corrective to text-to-SQL error is the explicit thesis of a substantial literature and its vendors^6,7,8, sometimes phrased almost exactly as here (“governance before the SQL, not after”). Benchmarks report large accuracy gains from answering through governed metrics rather than generated SQL⁶, though the finding is contested: at least one careful study found a well-instrumented text-to-SQL setup competitive with a semantic layer. We treat governed metrics as one established guarantee among the several, and as the determinism dial's middle setting; we do not claim it.

Write isolation via branching is likewise a shipping category. Iceberg's write-audit-publish, Nessie, Dolt¹⁰, and lakeFS⁹ provide zero-copy branches and pre-merge review, and lakeFS now frames branch-per-agent with a human merge gate as a data-layer mandate in nearly the terms used here. Our contribution is the automatic, engine-side application of that branch to every agent write through one governed path. Governed agent memory with source-linked freshness has emerged as its own category^11,12; we differ in computing freshness as a fact of the version chain rather than a heuristic of elapsed time.

The closest data-systems vision is the agent-first program⁵, which argues, as we do, that agents will dominate the database's workload. Its concern is throughput: redesigning query processing to serve agents efficiently. Ours is trust: constraining agents through the data plane. The two are complementary. A word on terminology is owed here, because some governance frameworks invert the labels, casting the reasoning layer as the trusted adjudicator and the data layer as mere execution. We assign them the other way, and not arbitrarily. Governance cannot live in the reasoning plane, because that plane is exactly the part meant to be interchangeable, and by the argument of §3 it is the part that cannot be trusted to enforce a rule against itself. Siting enforcement in the data plane is what makes a guarantee hold independently of which model is attached: bring any reasoner, and the result is the same. The label follows the locus of trust, and the locus of trust is the layer no model can route around.

Against this backdrop the contributions are three: the unification of the data-plane guarantees under a single enforcement boundary, spanning both blast-radius and authority-path controls and evaluated end to end (§10); determinism as a per-query dial, for which we find no precedent; and the incentive analysis that follows, which states more precisely than prior commentary why the platforms best placed to build this are structurally disinclined to.

If the truth plane is where these guarantees belong, the parties best positioned to supply them are the established cloud data platforms. Yet the pattern is conspicuously absent from them, and the reasons are structural rather than accidental: one architectural, one economic.

The architectural obstacle is legacy. The mainstream platforms were designed around the human author. Versioning, where it exists, is treated as an internal concern, a mechanism for recovery and snapshots, rather than a product surface a caller can branch against, diff, and pin to. Access control models a human operator; the interfaces optimize human ergonomics. The guarantees of §4 are not edge features that bolt onto such a system. Each is woven through the executor, in the path every statement takes: the policy rewrite, the version pin, the write redirect. Retrofitting them means reworking the layer the whole platform stands on, the kind of change incumbents make slowly if at all.

The deeper obstacle is incentive. The dominant commercial model for cloud data platforms is consumption-based: revenue scales with the compute a customer burns. Now read the agent-native feature set through that lens. Answering a cheap question cheaply, whether from metadata, a sample, or a cached or pinned result, reduces consumption. Reusing a materialized answer instead of recomputing it reduces consumption. Honest metering and a hard per-agent budget reduce consumption most of all. Every guarantee that most protects the customer in the agent era is, for a consumption-priced vendor, a reduction in revenue.

The mechanism is structural, not a matter of intent. A firm does not enthusiastically ship the feature that most lowers its own top line, and so cost transparency and spend-capping remain perennially underbuilt on platforms whose income is the meter. The agent era turns the latent conflict acute: an autonomous author multiplies query volume by orders of magnitude. Under consumption pricing that surge is a windfall for the vendor and a runaway bill for the customer, so precisely when the customer most needs the platform to be on their side about cost, the platform's incentive points the other way.

A natural objection invokes Jevons's paradox: if each query becomes cheaper, agents will simply run more of them, so aggregate consumption, and vendor revenue with it, may rise rather than fall.¹⁵ The objection holds for efficiency that lowers unit cost while leaving the workload intact. It does not hold for the guarantees at issue. A pinned answer reused instead of recomputed removes the repeat query rather than making it cheaper. A hard per-agent budget caps the number of calls rather than lowering the price of the marginal one. These features suppress the very demand expansion the paradox assumes, which is why a consumption-priced vendor cannot embrace them and call it growth.

This closes the argument. The guarantees belong in the truth plane (§3); they are what the store was already for (§4); an interchangeable reasoning plane inherits them, as three experiments confirm (§9–10); and the incumbents positioned to provide them are structurally and commercially disinclined. The design space this opens sits beneath the model: a data plane rebuilt around a caller it was never meant to serve, and priced for the customer who now depends on it.