Control how agents use data.

Why DFC

Many important safety policies are about data flows. A released statistic needs to aggregate across at least K users. Education reports need to keep protected groups separate while suppressing groups that are too small. Financial systems need to stop sensitive information from crossing internal barriers. Accounting systems need every inserted expense to come from an actual receipt rather than a value that merely looks plausible.

Existing guardrails are poorly matched to those requirements. Prompt rules ask the same unreliable agent to police itself. Access control can block data entirely, but cannot allow useful computation while restricting particular combinations or outputs. Input and output filters see only the edges of a request; they cannot prove which records contributed to a result or whether a new row was derived correctly.

DFC fills the gap with deterministic checks over derivations: the path from input records through transformations, joins, aggregations, releases, and writes. Unsafe rows are filtered, blocked, or fixed before they become part of an answer or a database update.

Papers

Please Don't Kill My Vibe: Empowering Agents with Data Flow Control
CIDR 2026