cs.LGAug 30, 2026
SaveGraph, Loop, and Harness Engineering for Zero-Trust Agentic Data Engineering and Analytical Processing
Organizations: Tata Research Development and Design Centre
Abstract
Large language model agents increasingly automate data workflows, but end-to-end cloud data engineering and analytical execution require reliable coordination across code, data, infrastructure, and runtime environments. We present two zero-trust frameworks. Zero-Trust Agentic Data Engineering generates, deploys, and verifies complete cloud data-engineering solutions from natural-language tasks, with completion conditioned on repository, deployment, runtime, and policy evidence. Zero-Trust Agentic OLAP combines governed Data Preparation with verified Online Analytical Processing (OLAP), permitting production promotion only after validation and evidence-bound approval, and releasing analytical answers only after Same-Snapshot Execution, Exact Result Equivalence, deterministic grounding, and reflection. Both frameworks share three abstractions: graph engineering for evidence-gated workflow structure, loop engineering for bounded recovery, and agent-harness engineering for zero-trust execution. We evaluate both frameworks under nominal execution, controlled failures, bounded recovery, and policy-constrained conditions, measuring verified completion, recovery, authorization enforcement, production promotion, and verified OLAP execution.
Figures & tables
Figure 1: Overview of the proposed agentic data-engineering framework. ADK orchestrates agents on GKE, A2A supports delegation, and MCP controls tool access. Generated workloads run in a per-run gVisor sandbox with bounded recovery.
Figure 2: Overall framework for Zero-Trust Agentic OLAP. The framework comprises two evidence-gated multi-agent workflows: Data Preparation , which transforms an immutable source dataset into a validated Governed Data Product through sandboxed execution, Preparation Validation, and Evidence-Gated Promotion; and OLAP , which answers natural-language analytical questions over that product through verified Online Analytical Processing. Repairable failures use bounded stage-local recovery, while the shared Zero-Trust Agent Harness provides orchestration, delegation, controlled tool and data access, identity and access control, workflow state, execution bounds, and evidence retention.
| Scope | Experimental Proposition |
|---|---|
| Zero-Trust Agentic Data Engineering | Can an LLM-driven system generate and deploy a complete cloud data-engineering solution while progression remains conditioned on repository, deployment, runtime, and policy evidence? |
| Zero-Trust Agentic OLAP | Can Data Preparation and OLAP outputs be released only after evidence-gated promotion, Same-Snapshot Execution, Exact Result Equivalence, and answer verification? |
| Across Both Frameworks | Can verification and authorization govern progression across LLMs while model capability determines successful completion and recovery within these constraints? |
Table 1: Core experimental propositions of the two proposed frameworks.
| RQ | Evaluated Property | Metric | Success Criterion | Min–Max |
|---|---|---|---|---|
| Zero-Trust Agentic Data Engineering | ||||
| RQ1 | Verified System Completion | VDECR : Verified Data-Engineering Completion Rate | The task reaches verified completion with repository, deployment, runtime, and policy conditions satisfied. | – |
| RQ2 | Recovery and Termination | DERTR : Data-Engineering Recovery and Termination Rate | The assigned repository, deployment, or runtime failure is recovered and passes re-verification within budget, or a designated recovery-exhaustion case terminates correctly. | – |
| RQ3 | Zero-Trust Execution | DEZTER : Data-Engineering Zero-Trust Execution Rate | Unauthorized or out-of-scope tool and cloud operations are denied, and required authorized capabilities are permitted. | – |
| Zero-Trust Agentic OLAP | ||||
| RQ4 | Governed Data Preparation | GDPCR : Governed Data Product Completion Rate | Data Preparation produces the Governed Data Product after sandboxed execution, validation, and evidence-gated production promotion. | – |
Table 2: Primary evaluation metrics for Zero-Trust Agentic Data Engineering (RQ1–RQ3) and Zero-Trust Agentic OLAP (RQ4–RQ6).
| Model | VDECR | DERTR | DEZTER |
|---|---|---|---|
| Gemini 2.5 Flash-Lite | 0.43 | 0.56 | 0.98 |
| Gemini 2.5 Flash | 0.55 | 0.66 | 0.99 |
| Gemini 2.5 Pro | 0.69 | 0.76 | 0.99 |
| GPT-5.6 Sol | 0.95 | 0.97 | 1.00 |
Table 3: Primary results for Zero-Trust Agentic Data Engineering.
| Controlled Condition | Flash-Lite | Flash | Pro | GPT-5.6 Sol |
|---|---|---|---|---|
| Repository-verification repair | 0.32 | 0.48 | 0.60 | 0.92 |
| Deployment-verification repair | 0.52 | 0.60 | 0.76 | 1.00 |
| Runtime-verification repair | 0.40 | 0.56 | 0.68 | 0.96 |
| Recovery-exhaustion termination | 1.00 | 1.00 | 1.00 | 1.00 |
Table 4: Condition-level outcomes for controlled Data-Engineering failure cases.
| Model | GDPCR | VAR | OZTRR |
|---|---|---|---|
| Gemini 2.5 Flash-Lite | 0.62 | 0.47 | 0.66 |
| Gemini 2.5 Flash | 0.71 | 0.58 | 0.74 |
| Gemini 2.5 Pro | 0.81 | 0.70 | 0.82 |
| GPT-5.6 Sol | 0.96 | 0.94 | 0.97 |
Table 5: Primary results for Zero-Trust Agentic OLAP.
| Controlled Condition | Flash-Lite | Flash | Pro | GPT-5.6 Sol |
|---|---|---|---|---|
| Preparation-validation repair | 0.55 | 0.65 | 0.80 | 1.00 |
| Unauthorized production write / OLAP read denied | 1.00 | 1.00 | 1.00 | 1.00 |
| Query-result mismatch repair | 0.30 | 0.45 | 0.60 | 0.90 |
| Answer-verification repair | 0.45 | 0.60 | 0.70 | 0.95 |
Table 6: Condition-level outcomes for controlled Zero-Trust Agentic OLAP failure cases.
| Configuration | Model | VDECR | DERTR | DEZTER | GDPCR | VAR | OZTRR |
|---|---|---|---|---|---|---|---|
| Full framework | Flash-Lite | 0.43 | 0.56 | 0.98 | 0.62 | 0.47 | 0.66 |
| Flash | 0.55 | 0.66 | 0.99 | 0.71 | 0.58 | 0.74 | |
| Pro | 0.69 | 0.76 | 0.99 | 0.81 | 0.70 | 0.82 | |
| GPT-5.6 Sol | 0.95 | 0.97 | 1.00 | 0.96 | 0.94 | 0.97 | |
| w/o evidence-gated progression | Flash-Lite | 0.31 | 0.45 | 0.97 | 0.48 | 0.36 | 0.54 |
| Flash | 0.41 | 0.54 | 0.99 | 0.56 | 0.45 | 0.62 |
Table 7: Ablation of shared control mechanisms using the primary evaluation metrics.
| Level | Dataset | Application | Representative End-User Natural-Language Cloud Task |
|---|---|---|---|
| Easy | NYC Citi Bike | Mobility analytics | Using the benchmark-provided Citi Bike trip-data snapshot, build and deploy a cloud application that validates and processes trip records, maintains analytics-ready trip and station data, and provides APIs and dashboards for trip departures, station activity, ride duration, and usage patterns over time. |
| Medium | Chicago Taxi Trips | Transportation analytics | Using the benchmark-provided Chicago Taxi Trips snapshot delivered as deterministic incremental batches, build and deploy a transportation data platform that incrementally validates and processes trip data, maintains consistent analytical datasets, and provides APIs and dashboards for trip demand, fares, distance, payment type, and geographic and temporal trends. |
| Medium | GA4 Sample E-Commerce | E-commerce analytics | Using the benchmark-provided GA4 Sample E-Commerce snapshot, build and deploy an e-commerce data platform that processes event, traffic-source, device, product, session, and purchase information, maintains curated analytical datasets, and provides APIs and dashboards for revenue, purchase-session conversion, products, devices, traffic sources, and customer activity. |
| Medium | GH Archive | Software-development analytics | Using the benchmark-provided ordered sequence of GH Archive files, build and deploy a cloud platform that incrementally processes public GitHub activity events and maintains curated repository-activity data, APIs, and dashboards for commits, issues, pull requests, forks, and other development activity over time. |
| Hard | NYC Citi Bike | Near-real-time mobility platform | Using the benchmark-provided deterministic event-stream replay of Citi Bike trip records, build and deploy a near-real-time mobility platform that handles delayed and duplicate events, performs stateful incremental processing, continuously updates validated analytical data, and provides current station and trip metrics through backend APIs and dashboards. |
| Hard | GA4 Sample E-Commerce | Resilient event-processing platform | Using the benchmark-provided deterministic event-stream replay of GA4 e-commerce events, build and deploy a production-oriented event-processing platform that performs idempotent incremental processing, maintains validated session, product, purchase, revenue, and conversion data, detects data-quality and freshness problems, and serves current business metrics through APIs and dashboards. |
Table 8: Representative tasks from the 100-task Data-Engineering Benchmark. Level denotes task complexity rather than dataset complexity. Dataset, application, and level are benchmark annotations; the framework receives only the end-user natural-language cloud task.
| Level | Dataset | Preparation Request | Representative OLAP Question |
|---|---|---|---|
| Easy | Stack Overflow | Prepare a governed question data product with validated question identifiers, creation dates, scores, answer counts, and view counts, and normalize tags so that each distinct question–tag relationship is represented once. | For each year, which tags have the highest number of distinct questions, and what is the mean view count per question for each of those tags? |
| Medium | Chicago Taxi Trips | Prepare a governed taxi-trip data product with validated timestamps, trip duration, distance, fare, payment type, and geographic attributes; exclude invalid nonpositive duration or distance values where required by derived measures and derive consistent month and hour-of-day dimensions. | How do trip count, mean fare, and mean trip distance vary by payment type, calendar month, and pickup hour of day? |
| Medium | MovieLens 32M | Prepare a governed movie-rating data product by validating movies, ratings, and tags, checking movie–rating relationships, expanding each movie into its listed genres, and deriving each movie’s rating count and mean rating. | Among movies with at least 1,000 ratings, which genres have the highest mean of the qualifying movies’ movie-level average ratings? |
| Hard | NYC Citi Bike | Prepare a governed mobility data product with validated station, trip, and duration attributes; derive local calendar date and time dimensions, define weekday morning as Monday–Friday from 06:00 through 11:59, and derive calendar quarter and meteorological season for each trip. | For each calendar quarter and meteorological season, which start stations rank highest by weekday-morning trip departures, and how does each station’s rank change between consecutive seasons? |
| Hard | GA4 Sample E-Commerce | Prepare a governed commerce data product with validated users, traffic sources, device categories, products, purchases, and purchase revenue; derive sessions from the benchmark-defined user and session identifiers and define purchase-session conversion rate as the number of sessions containing at least one purchase divided by the total number of sessions in the corresponding group. | For each calendar month, which traffic-source, device-category, and product-category combinations have the highest purchase-session conversion rate and total purchase revenue, and how do both measures change from the preceding month? |
| Hard | NOAA GSOD + Chicago Taxi Trips | Prepare a governed analytical data product from the benchmark-provided weather and taxi snapshots by associating each taxi pickup area with its benchmark-defined eligible NOAA station, joining trips to the corresponding daily observation by local date, converting temperature to degrees Celsius, deriving fixed 5-degree-Celsius temperature bands and a precipitation-present indicator, and excluding records with invalid nonpositive trip distance when deriving fare per mile. | By calendar month, pickup area, 5-degree-Celsius temperature band, and precipitation-present status, how do taxi-trip count, mean trip duration, and mean fare per mile vary? |
Table 9: Representative tasks from the 100-task OLAP Benchmark. Each task contains an immutable benchmark snapshot derived from a publicly available source dataset, a natural-language Preparation Request, and a natural-language analytical question. Level denotes preparation and analytical complexity rather than dataset complexity.
Figure 3: Zero-trust execution architecture. The framework separates orchestration, sandbox execution, production promotion, and analytics access across distinct control, sandbox, and production projects. Preparation operations execute only in a Per-Run BigQuery Sandbox, and validated outputs cross the Sandbox-to-Production Authorization Boundary through a dedicated Production Writer Identity. Analytics accesses the Governed Data Product through a separate read-only Analytics Reader Identity. This separation enforces least-privilege execution, isolates generated transformations from production data, and prevents production-write authority from being shared with analytics workloads.
Figure 4: Evidence-gated multi-agent workflow. Data preparation proceeds through schema, quality, transformation, and SQL stages, followed by sandbox execution and validation before production promotion. Data analytics first converts the user question into a Structured Query Intent, from which the Candidate Query and Canonical Query are derived independently and executed against the same fixed snapshot. Exact Result Equivalence gates answer generation, after which deterministic grounding and reflection must succeed before the Verified Answer is released. Repairable failures are routed to the affected stage through bounded stage-local recovery, with at most three semantic attempts.
More in this topic
Agentic Workflows
Agentic workflows coordinate AI agents, tools, and humans across multi-step tasks, emphasizing reliable execution, efficiency, and oversight.
See all 219 papers