为AI生成的数据库操作添加数据安全策略，防止违规数据流动。
Data Flow Control: Data Safety Policies for AI Agents
- 用声明式语言定义数据流安全策略，不依赖查询优化器。
- 在五种数据库系统上实现零开销，性能优于现有方案数个数量级。
- 适合关注数据合规与隐私保护的数据库开发者和运维人员。
AI代理越来越多地代表用户生成SQL、编排数据管道并自动化数据分析。尽管近期研究提升了查询正确性，但正确性并不等于安全性。一条语义正确的查询仍可能违反监管、隐私或业务约束，即数据如何组合与发布。本文认为，确保此类约束是根本性的数据基础设施问题。提出数据流控制（Data Flow Control, DFC）框架，以声明式方式指定并保证在数据库管理系统中对元组级数据流的安全策略执行。核心挑战在于设计一种与优化器无关但可规模化高效执行的策略语言。我们形式化了数据安全为溯源单项上的聚合谓词，并提出Passant——一个无需物化溯源的可移植查询重写层，实现无开销的策略强制。在DuckDB、Umbra、PostgreSQL、DataFusion和SQLServer五个数据库引擎上，Passant实现了约0%的开销，性能优于替代方案数个数量级。数据流控制是将数据安全从提示词和事后检查推进到数据基础设施的第一步。代码开源：https://github.com/dataflowcontrol/data-flow-control。
原文摘要 · Abstract (English)
Agents increasingly generate SQL, orchestrate pipelines, and automate data analysis on behalf of users. While recent work improves query correctness, correctness is not safety. A query may be semantically valid yet violate regulatory, privacy, or business constraints that govern how data may be combined and released. We argue that enforcing such constraints is fundamentally a data infrastructure problem. This paper introduces Data Flow Control (DFC), a framework to declaratively specify and guarantee policy enforcement over tuple-level data flows within a DBMS query. A key challenge is defining a policy language that is optimizer-invariant yet efficient to enforce at scale. We formalize data safety as aggregate predicates over provenance monomials and present Passant, a portable query rewriting layer that enforces DFC policies without materializing provenance. Across five DBMS engines -- DuckDB, Umbra, PostgreSQL, DataFusion, and SQLServer -- Passant achieves ~0% overhead and outperforms alternatives by orders of magnitude. As a result, Data Flow Control is the first step towards moving data safety from prompts and post-hoc checks into the data infrastructure. Data Flow Control is available open source at https://github.com/dataflowcontrol/data-flow-control.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。