OME ContextGuard

A human-in-the-loop safety gate that uses DataHub context before an AI agent changes data.

AI agents can edit schemas, queries, and metadata faster than a person can review them. The missing control is context: who owns the asset, whether it contains sensitive data, what depends on it, and whether it already has incidents. OME ContextGuard retrieves that context from DataHub, produces an explainable risk decision, pauses risky actions for a human, and creates a tamper-evident audit artifact.

Built for Build with DataHub: The Agent Hackathon (2026). The project was created during the hackathon submission period and is licensed under Apache-2.0.

Demo

• Watch the 88-second demo on YouTube
• Open the pitch deck
• Browse the Devpost media package

What the demo proves

1. An AI transformation agent proposes a change to analytics.customer_orders.
2. ContextGuard reads ownership, tags, schema, and downstream lineage through DataHub MCP.
3. A deterministic engine assigns a reproducible score and cites its evidence.
4. Local Ollama explains the decision but cannot change the score or authorize execution.
5. High-risk work pauses until a named human approves or rejects it.
6. The complete decision is saved as JSON with a SHA-256 evidence hash.
7. After approval, the decision is written back to DataHub as a linked Decision document.

Safety boundary

• DataHub reads are performed with the official get_entities and get_lineage MCP tools.
• Broad DataHub metadata mutation tools remain disabled. The live demo enables only the separate save_document document tool, and ContextGuard calls it only after an allowed or approved_for_execution decision plus explicit --write-back authorization.
• Ollama is an explanation layer, not the policy authority.
• Critical decisions remain blocked even if a human attempts to approve them.
• The offline fixture follows the same normalized contract as the live DataHub adapter.
• No cloud AI key is required; business metadata stays local.

Quick start on Windows

Requirements: Python 3.11+ and Ollama with llama3.2:1b (or another local model).

cd ome-contextguard
python -m pip install --no-deps -e .
ollama serve
python -m ome_contextguard --model llama3.2:1b

The first run is intentionally pending because the risk is high. Add an explicit reviewer decision:

python -m ome_contextguard `
  --model llama3.2:1b `
  --approve-by "Naiman Muratovich Yelubayev" `
  --rationale "Reviewed downstream impact and rollback plan"

On a machine with an incompatible CUDA stack, ContextGuard uses CPU by default (OLLAMA_NUM_GPU=0). It safely falls back to a deterministic explanation if Ollama is unavailable; the gate decision never changes.

Live DataHub MCP mode

Start DataHub quickstart and seed the demo graph with the dedicated DataHub CLI environment:

python -m venv .venv-datahub
.\.venv-datahub\Scripts\python.exe -m pip install acryl-datahub uv
.\.venv-datahub\Scripts\datahub.exe docker quickstart --version stable
.\.venv-datahub\Scripts\python.exe .\scripts\seed_datahub.py --downstreams 24

Run the full live flow with one command:

.\scripts\run_live_demo.ps1 -Python python -Model llama3.2:1b

Or configure the official DataHub MCP server manually:

$env:DATAHUB_GMS_URL = "http://127.0.0.1:8080"
$env:DATAHUB_GMS_TOKEN = ""
python -m ome_contextguard `
  --source mcp `
  --change .\examples\changes\mask_customer_email.json `
  --mcp-command-json '[".\\.venv-datahub\\Scripts\\uvx.exe","mcp-server-datahub@latest"]'

The example change contains the target DataHub URN. Use a URN that exists in your DataHub instance. Keep TOOLS_IS_MUTATION_ENABLED=false so broad metadata mutation tools remain unavailable. To persist an approved Decision document, keep SAVE_DOCUMENT_TOOL_ENABLED=true on the MCP server and add --write-back. The server flag makes the document tool available; ContextGuard's application gate authorizes its use only after an allowed or approved_for_execution outcome. Pending, rejected, blocked, and critical decisions never call save_document.

See the committed live audit example for evidence generated from the local DataHub MCP integration.

Verify that the evidence was not modified:

python .\scripts\verify_audit.py .\examples\artifacts\live-audit.example.json

Tests

python -m unittest discover -s tests -v

The tests cover scoring boundaries, sensitive fields, blast radius, non-overridable critical blocks, human approval transitions, evidence hashing, official DataHub MCP response mapping, and approval-gated write-back.

Project layout

src/ome_contextguard/       risk engine, approval gate, Ollama, audit workflow
src/ome_contextguard/datahub/ fixture and official MCP adapters
examples/                   proposed change, DataHub-shaped context, audit output
docs/                       architecture, demo, and Devpost copy
tests/                      dependency-free unit tests

References

• DataHub documentation
• DataHub MCP Server
• Ollama API