Idea
Platform enforcing data safety policies within DBMS queries to ensure regulatory and privacy compliance at scale.
Research Paper
Core Innovation
This paper introduces Data Flow Control (DFC), a framework that declaratively specifies and enforces data safety policies at the tuple level within DBMS queries. It formalizes data safety as aggregate predicates over provenance monomials and implements Passant, a portable query rewriting layer that enforces policies efficiently without materializing provenance, achieving near-zero overhead across multiple DBMS engines.
Why It Matters
Organizations face increasing regulatory and privacy constraints on data use that current query correctness tools do not address. Data Flow Control ensures data safety policies are enforced directly within database queries, preventing unauthorized data combinations and releases. This approach scales across multiple database systems with minimal performance impact, transforming data governance workflows and reducing compliance risks.
Market Size (TAM)
$10–20B TAM for data governance and compliance platforms; $2–5B SAM from enterprises and cloud providers. Driven by increasing data privacy regulations and AI adoption.
Potential Customers & Pain Points
- Enterprises with sensitive data – Risk of regulatory non-compliance
- Cloud data platform providers – Need scalable data governance
- AI service providers – Ensuring privacy in automated data analysis
- Financial institutions – Preventing unauthorized data sharing
- Healthcare organizations – Protecting patient data privacy.
Business Model
Open source core with enterprise licensing for advanced features, support, and integration services targeting large organizations and cloud providers.
Competitive Landscape
- Immuta
- Privacera
- Collibra
- BigID
- Alation
Implementation Challenges
- Integration complexity with diverse DBMS environments
- Adoption resistance due to existing governance workflows
- Ensuring policy language expressiveness without performance trade-offs
Validation Strategy
- Pilot deployments with enterprise data teams to measure compliance improvements
- Performance benchmarking across diverse DBMS platforms
- Customer feedback on policy language usability and integration ease
Research Paper Overview
Data Flow Control: Data Safety Policies for AI Agents
Summary
Agents increasingly generate SQL, orchestrate pipelines, and automate data analysis on behalf of users. While recent work improves query correctness, correctness is not safety. A query may be semantically valid yet violate regulatory, privacy, or business constraints that govern how data may be combined and released. We argue that enforcing such constraints is fundamentally a data infrastructure problem. This paper introduces Data Flow Control (DFC), a framework to declaratively specify and guarantee policy enforcement over tuple-level data flows within a DBMS query. A key challenge is defining a policy language that is optimizer-invariant yet efficient to enforce at scale. We formalize data safety as aggregate predicates over provenance monomials and present Passant, a portable query rewriting layer that enforces DFC policies without materializing provenance. Across five DBMS engines -- DuckDB, Umbra, PostgreSQL, DataFusion, and SQLServer -- Passant achieves ~0% overhead and outperforms alternatives by orders of magnitude. As a result, Data Flow Control is the first step towards moving data safety from prompts and post-hoc checks into the data infrastructure. Data Flow Control is available open source at https://github.com/dataflowcontrol/data-flow-control.