Context
Every research platform is now asked the same question: “can we just talk to the data?” On an open dataset that is a weekend project. On governed health data it is an architecture problem, because an agent that can run arbitrary analysis is also an agent that can exfiltrate.
The problem
The interface had to let researchers explore datasets, clean data, assemble ML pipelines, and run inference conversationally — while guaranteeing the agent could never do anything its human’s certifications did not already allow.
What we built
The system is built on the Model Context Protocol: every capability the agent has is an explicit, typed tool. There is a tool for schema exploration, a tool for cleaning operations, tools for pipeline assembly and inference — each scoped per modality, each carrying its own governance checks aligned to NIST guidance.
Above the tools sits a sub-agent architecture with skills-based context optimization: specialist sub-agents handle tabular, imaging, and text modalities with only the context they need, which keeps both quality and audit trails tight.
Key decisions
Security lives at the tool layer, not the prompt layer. Prompts can be jailbroken; a tool that refuses to return raw identifiers cannot be sweet-talked. That single decision is what makes the system defensible in front of a governance committee.
Humans keep the last word: destructive or boundary-adjacent operations surface for approval rather than executing silently — the same accountable-agent pattern we now ship everywhere.
Outcome
A governance-compliant conversational layer over sensitive health data, in active development, and the concrete blueprint behind JES’s agentic-AI practice: agents where they help, accountability everywhere.