Why Data Agents Hallucinate On Your Data, And What Governed Context Fixes

Your data agents need context, and the place it has to live is a data context layer built for the data estate itself. A person reading a catalog entry can tell when it is wrong, ask a colleague, or check a dashboard. An agent cannot. It acts on the description it is handed, and when it finds two definitions of revenue it picks one. This paper explains what has to change underneath.

Key takeaways

• •The unit of trust is the fact: trust attaches to individual facts rather than asset records, so many producers can write at once.
• •A fail-closed write path: six checks stand between an agent's observation and a fact the fleet will act on, each one recorded.
• •Written, not crawled: a graph refreshed by the work that changed the estate, rather than by a crawl schedule that always lags.
• •Promotion needs a human: making a fact authoritative takes a named human signature, and an agent cannot sign for its own work.

Why data agents hallucinate even with warehouse access

Warehouse access gives an agent rows and schemas. It does not give it meaning. A catalog was always permanently incomplete, and that was fine because the reader could fill the gap with judgement. An agent has none to contribute. Handed an ambiguous column description, it acts on it. Handed two definitions of revenue, it does not escalate the conflict, it picks one. A raw text-to-SQL system then produces a fluent, plausible, wrong answer with no warning attached. A context layer for AI agents exists to make that failure harder to reach quietly, by grounding the answer in a fact the agent can cite or refuse.

Data catalog vs context layer vs semantic layer

A data catalog is an inventory of assets, made findable by a person searching. A semantic layer defines metrics inside one platform, and is authoritative there and blind outside it. Most estates are not one warehouse, so the questions that cause incidents, like whether a metric means the same thing in the finance mart and the product mart, are cross-platform by nature. A data ecosystem context layer sits across all of them. It models entities, metrics, schemas, tables, columns, pipelines and jobs, their owners, the policies that apply, and the relationships between them: containment, dependency, ownership, lineage and impact.

Why RAG and chat memory are not a data context layer

The instinctive fix for a model that lacks context is more context: a longer window, more aggressive retrieval, more documents in the prompt. That treats the symptom. More retrieved text does not resolve a disagreement between two retrieved documents, does not restore provenance stripped on the way in, and does not carry a confidence value. General agent memory has a different limit. It records what an agent did before, which is a habit, not an institution. It cannot say the definition changed last Tuesday, who owns it, or what breaks downstream, because it models the agent's experience rather than the estate.

Governed meaning at inference time: what a fact must carry

Governed meaning at inference time means every fact an agent reads arrives with an envelope, and the envelope is required rather than advisory. Whose it is, derived from authenticated identity rather than from whatever the caller claimed. Where it came from: source, author, an observation time and a confidence value. What it is about, as a deterministic identity, so the same fact seen twice is confirmed rather than stored twice. When it was true. And how far it is trusted, on an ordered scale from agent-asserted up to canonical. Whatever channel delivers this to a model, MCP context included, the envelope is what makes it safe to act on.

Keeping a context graph from going stale

A crawled catalog decays because the estate changes faster than anyone writes about it. That is arithmetic, not discipline. The answer this architecture gives is to change who writes. When an agent finishes a job, what it learned flows into the governed context layer through the same checked path, off the critical path, so a failure to enrich never breaks the work. Freshness rides the work instead of a schedule. Because a fact has a deterministic identity, re-observation confirms it and raises confidence toward a ceiling rather than minting a near-duplicate. Without that property a graph gets noisier at exactly the rate the fleet works.

Frequently asked questions

What is a context layer for data agents?

It is a governed store of what a company's data actually means, read by machines rather than searched by people. In the architecture the paper describes it takes the shape of a federated knowledge graph: entities, metrics, tables, columns, pipelines, jobs, owners, policies and quality signals, plus the relationships between them, so an agent can ground an action in a fact it can cite instead of guessing.

Why does the data layer need its own context layer, not a generic AI memory?

A generic memory records what an agent experienced. Learning that an agent once used a particular table for revenue captures a habit. It has no way to know the definition changed last Tuesday, no way to name the owner, and no way to say what breaks downstream. A data-layer graph holds the canonical definition, its owner, the decision that produced it and the lineage under it, so when the definition changes it can tell you what is affected.

How is a context layer different from a data catalog?

A catalog is written by people on a schedule, treats the asset record as the unit of trust, refreshes on a crawl cadence, resolves conflicts by last writer wins, and is read by a person searching. Its failure mode is silent decay. A context layer is written by the work continuously, trusts the individual fact, refreshes on the event that changed it, retains both sides of a conflict, and fails as a recorded, counted refusal.

How is a context layer different from a semantic layer?

A semantic layer native to one warehouse is authoritative inside that platform and blind outside it. Real estates span several clouds, a governance tool, a transformation framework and a spreadsheet, and the questions that cause incidents are cross-platform: does this metric mean the same thing in two marts, does this dashboard depend on the table we are about to alter. A layer that sees one cloud cannot answer those.

Why do data agents hallucinate even when they have warehouse access?

Because access to rows is not access to meaning. The record an agent reads was written for a human who could tell when it was wrong and ask a colleague. Agentic data engineering removes that human from the loop. Given an ambiguous description an agent acts on it, and given two definitions of revenue it picks one rather than escalating. The result is fluent, plausible and wrong, with no warning attached.

Can agents ask clarifying questions, or does context have to be complete up front?

An agent can ask a person, but it cannot tell when it needs to. That is the gap the paper is about: a catalog was tolerably incomplete because its reader noticed. The architecture answers this in two ways. Facts carry confidence as a value in the model rather than a hedge in a sentence, and a system grounded in governed definitions can return an honest refusal instead of a plausible answer it cannot verify.

Does a context layer replace Unity Catalog, Glue or Snowflake Horizon?

No. The approach the paper describes consumes existing catalogs as backends rather than replacing them. Anything ingested from a foreign system arrives marked as foreign and non-authoritative. The deployment path is federate, then hybrid, then native, and the paper says plainly that federating adds a layer rather than removing one. An AI-native data platform that claims to simplify your estate by adding a component to it is not being straight with you.

How do you keep a context graph from going stale?

By changing who writes. In AI-native data workflows the graph is a byproduct of the work: an agent's actions, outcomes and findings land in it as the job runs, so the event that made a fact stale is the event that refreshes it. Re-observation confirms a fact rather than duplicating it. This is not fully solved: superseded facts are not yet closed out automatically, and unconfirmed facts lose standing over time.

The whitepaper this is drawn from

This article summarises Why the Data Layer Needs Its Own Context Layer, a Data Workers Research paper. The full paper carries the figures, the citations and the limitations section, and is free behind a short form.