Apple details Glyph agents for enterprise data catalog governance

Apple researchers have detailed Glyph, a production system that coordinates two language-model agents to document enterprise data columns and assign governed sensitivity labels. According to Apple’s research page and the full paper, it grounds descriptions in the code that produces a column, runs three tagging methods in parallel and records the source of each selected tag.

The authors say Glyph operates on a catalog of about 3.4 million columns across roughly 98,000 tables, four business lines and three storage backends. The system does not inspect cell values. Instead, it relies on structural metadata and source code, allowing it to work where access rules prevent automated systems from reading the underlying data. The reported scale and performance have not been independently reproduced.

Two stateful agents divide the work. The Descriptor explains what a column means in plain language, while the Tagger maps it to a governed sensitivity ontology. The paper identifies Kostia Kudriavtsev, Parvez Rafi and Sha Sundaram as its authors. It follows other recent Apple research, including SimpleDesign for joint protein sequence and structure generation.

To generate descriptions, Glyph fetches schema metadata and can handle as many as 50 columns in one model call. The Descriptor can search GitHub Enterprise for context in the data-pipeline code that creates each column. Its default budget is three tool calls per column, with batch caps and forced finalization to prevent open-ended searches. An optional judge scores descriptions for plausibility, specificity, completeness and awareness of personally identifiable information. Columns that fall below the threshold can go through another search-and-generation pass, with two passes allowed by default.

The Tagger works against a governed Data Classification Ontology with 275 leaf annotations and sensitivity dimensions. Apple says the names in the paper are placeholders because the production classification codes are confidential. The authors also report that an internal non-sensitive class covers about 72% of columns.

Three methods propose tags at the same time. A description-based model selects from ontology candidates retrieved for the column. Business-line-specific regular expressions scan column names for patterns. A metadata method uses a fine-tuned encoder and vector index to retrieve verified historical assignments. The description method cannot introduce an arbitrary label: validation rejects anything outside the ontology candidates.

Glyph combines the three ranked lists with Reciprocal Rank Fusion, using a constant of 60, and normalizes the result by the number of active methods. It then removes duplicates deterministically, applies sensitivity-tier weights and drops low-scoring results. That active-source normalization is the paper’s concrete basis for graceful degradation, because the remaining methods can still produce a ranking when fewer methods contribute. The paper does not report fault-injection tests, uptime or outcomes for individual dependency failures.

Each selected tag keeps reasoning about the contributing method and its confidence. If several methods nominate the same tag, a fixed priority determines which method’s explanation, ontology and grade fields remain. Confidence still reflects the cross-method fusion score. The result gives data stewards a trace for each recommendation, not just a final label.

For the retrieval component, the paper reports large gains on an in-distribution, column-level held-out split. The authors say fine-tuning a six-layer all-MiniLM-L6-v2 encoder raised NDCG@10 from 0.5497 to 0.9225 and MAP@100 from 0.1888 to 0.9009. They caution that these are retrieval metrics rather than end-to-end tagging results, and call them an upper bound because the split does not control for leakage between columns in the same table.

A separate end-to-end test covered four files and three groups. Full fusion reached an overall micro-averaged F2 score of 0.890, compared with 0.880 for the metadata tagger alone. Median request latency was 57.80 seconds for full fusion and 40.41 seconds for the metadata-only method. The authors chose F2 because sensitivity tagging gives recall more weight than precision. They say the evaluation included 1,905 tables that were disjoint from the 15,205-table vector index, although catalogs and databases overlapped.

Glyph sits behind a governance workflow in which stewards accept or reject proposed column-tag pairs. The training pipeline refreshes weekly from those decisions. Across about 24,000 adjudicated pairs over six weeks, the authors report that acceptance rose from 63.3% to 99.8%, but they describe the trend as an association rather than a causal effect. Acceptance also does not capture tags the system failed to propose.

The production controls described in the paper include temperature-zero decoding, per-request model handles, token limits, typed state validation, authentication, structured tracing, stateless horizontal scaling and versioned encoder and index artifacts. Code search uses rate-limit-aware retries with exponential backoff. The private catalog, ontology, steward decisions and training data remain unavailable for outside inspection. The authors also say that public-benchmark generalization and agreement between automated judges and people have yet to be demonstrated.