Agents — getting your data AI-ready without giving it the keys.
Agents
Retrieval is the easy half. The hard half is what happens when an autonomous agent decides to act on what it retrieved. The 2026 literature on agent governance and the zero-copy discipline are, we think, the same argument in different vocabularies.
The market currently equates "AI-ready data" with vectorized, embedded, indexed. That is the easy half. An agent does not fail because it couldn't retrieve; it fails because it retrieved something it was never supposed to touch and then acted on it. Retrieval is a read problem. Action is a contract problem.
The same discipline that keeps a warehouse honest — one boundary, one schema, one owner — is what keeps an agent honest. Every tool an agent can call is a copy of authority into a runtime. If that copy isn't under a contract you wrote on purpose, you are, functionally, letting an LLM issue database credentials to itself.
Every tool call is a copy of authority. Copy at the boundary, under contract, or not at all.
The 2026 literature has converged on a striking claim: agent safety cannot be bolted on at the model layer. It has to be enforced deterministically, outside the model, before the side-effect happens. Uchibeke's Open Agent Passport specifies pre-action authorization as a protocol. Palumbo et al. compile natural-language policy into Datalog and evaluate it on every proposed action. Salfeld-Nebgen makes the same move at the institutional layer — attest the action, not the agent.
In zero-copy terms, this is release/acquire ordering for authority. The producer (the model) proposes; the consumer (the tool) commits only after a deterministic check against a policy that a human wrote. No policy, no acquire. This is not friction — it is the only place the audit trail can live.
The model proposes. The policy commits. Never the other way around.
Logs are what an agent said it did. Proofs are what actually ran. Rhodes & Kang's Proof of Execution and Jin et al.'s Proof-of-Guardrail push the same idea from opposite ends: the runtime that executes the tool call, and the guardrail that gates it, both need to emit evidence that a third party can verify without trusting the agent's own transcript.
For a data platform, this collapses to a familiar request: emit the alarm with the row. If a pipeline can't tell you which policy version approved which write, at the moment of the write, you are running on faith. Faith is fine until the regulator asks.
If the agent's own log is the only evidence, you don't have evidence.
AgentGuardian frames the containment problem as access control: learn the smallest set of capabilities an agent needs, then deny everything else by default. Bhattarai & Vu's "Lethal Trifecta" names the failure mode when you don't — untrusted input, sensitive data, and external side-effects, colocated in one context, is a breach waiting for a prompt.
This is the zero-copy argument, restated for agents. Every place a row exists is a place it can be exfiltrated. Every tool an agent holds is a capability it can be tricked into using. Fewer copies, fewer capabilities, narrower contracts. The stack that is cheapest to operate is also the one that is cheapest to defend.
Fewer copies. Fewer capabilities. Narrower contracts. Same discipline, both directions.
References
All entries are arXiv preprints from 2026 and are not yet peer-reviewed. Included because the ideas travel, not because the venue confers authority.
Uchibeke, U.
Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI AgentsarXiv:2603.20953 (2026) — Open Agent Passport (OAP)
Salfeld-Nebgen, J.
Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI SystemsarXiv:2606.26298 (2026)
Rhodes, J. & Kang, G.
Proof of Execution: Runtime Verification for Governed AI Agent ActionsarXiv:2607.05397 (2026)
Palumbo, N. et al.
Policy Compiler for Secure Agentic Systems (PCAS)arXiv:2602.16708 (2026) — Datalog-derived enforcement
Abaev, N. et al.
AgentGuardian: Learning Access Control Policies to Govern AI Agent BehaviorarXiv:2601.10440 (2026)
Bhattarai, M. & Vu, M.
Trustworthy Agentic AI Requires Deterministic Architectural BoundariesarXiv:2602.09947 (2026) — the Lethal Trifecta
Jin, X. et al.
Proof-of-Guardrail in AI Agents and What (Not) to Trust from ItarXiv:2603.05786 (2026) — TEE-backed proofs
Coda
We help teams get to AI-ready without handing the model a set of keys it wasn't audited to hold. First conversation is 30 minutes and free.
hello@xerocopy.sh →