Reliability by Design: A Shared Schema-Metadata Grounding and Catalogue-Constrained Extraction Architecture for Safe Natural-Language Access to Legacy Enterprise Systems

In the vast, quiet machinery of modern institutions, from universities to hospitals, data sits locked away in massive digital archives. These systems, known as enterprise resource planning platforms, hold the records of admissions, exams, research grants, and governance. For years, the people who need to ask questions about this data—administrators, quality officers, and coordinators—have been unable to do so directly. They cannot speak the language of the database, a complex code called SQL, so they must rely on a small group of technical specialists to translate their questions into queries. This creates a bottleneck, slowing down decision-making and keeping non-technical staff dependent on intermediaries. Recently, a new type of computer program, called a large language model, has promised to solve this by allowing anyone to ask questions in plain English and receive answers instantly. However, when these powerful models are connected directly to live, critical business systems, they become dangerous. Without strict guardrails, they can invent connections between data tables that do not exist, guess at the meaning of coded values, or accidentally expose sensitive information. The result is a system that might sound helpful but produces wrong answers or, worse, breaks the rules of safety and privacy.

A team of researchers at Desh Bhagat University has built a new way to connect natural language to these legacy systems that prioritizes safety over the raw power of the computer model. They argue that reliability in this setting is not a matter of making the artificial intelligence smarter or larger, but of changing the architecture of the system itself. Instead of letting the language model write the database queries directly, they created a structure where the model is only allowed to pick from a pre-approved list of options. The researchers tested this approach on a real-world university system containing roughly 800 tables of data, a system that lacks the standard safety markers found in modern databases. Their findings show that by strictly controlling what the model can do, they can achieve zero errors in the final database commands, regardless of how large or small the language model is. The system works not by guessing, but by grounding every request in a curated map of the data that exists before the conversation even begins.

The core of this solution is a new way of organizing the hidden structure of the software. In many older enterprise systems, the database does not explicitly state how different pieces of information relate to one another; these connections exist only inside the application code. To fix this, the researchers built a "Schema-Metadata Navigation Graph." Imagine this as a detailed, machine-readable map that translates the messy, implicit connections of the software into a clear, structured guide. This map links the high-level functional areas of the system, like "admissions" or "research," down to specific pages, columns, and the actual data tables. Crucially, this map also contains a list of approved report templates and the exact, pre-written code needed to retrieve data for each one. It acts as a substitute for the missing safety markers, ensuring that the computer knows exactly how to join different pieces of information without having to guess.

When a user asks a question, the system does not let the language model write a new database command from scratch. Instead, the model acts as a selector. It listens to the user's request and, using the context of where the user is currently working in the software, it identifies the most relevant parts of the pre-approved map. The model then extracts a structured specification, essentially choosing from a whitelist of known, safe report templates. It never generates the actual database code. Once the model has made its selection, a separate, trusted piece of software takes over. This deterministic code assembles the final query using the fixed, pre-verified fragments stored in the map. Because the code is assembled from known, safe parts rather than generated on the fly, it is impossible for the system to produce a command that injects malicious code, references a column that does not exist, or joins tables in a way that returns the wrong data.

The researchers deployed this architecture on a live higher-education system serving five different accreditation frameworks. They tested the system rigorously, including a benchmark where they tried to trick the model into making errors. The results were definitive: the system produced zero invalid database commands. This safety held true whether they used a small, open-source language model or a much larger, proprietary one. In fact, the smallest model performed just as well as the largest, proving that the safety comes from the design of the system, not the size of the brain behind it. In real-world use, stakeholders reported that the system returned correct reports about 85 percent of the time. The remaining requests were safely refused rather than guessed at, preventing the silent errors that plague other systems.

This approach also solves a problem of cost and maintenance. Because the system relies on a curated list of what users actually ask for, rather than trying to understand the entire database schema, the effort required to maintain it is much lower. The researchers found that they could add new reporting capabilities simply by adding a single entry to their map, without needing to retrain the artificial intelligence or rewrite complex code. Furthermore, they designed the system to have two layers: a reactive layer that answers user questions and a proactive layer that automatically monitors compliance metrics. Both layers share the same underlying map, meaning the organization does not need to build two separate systems to get both conversational help and automated safety checks.

The study concludes that for critical enterprise systems, the path to reliable natural language access is not to build bigger models that can reason their way through complex data, but to build architectures that constrain the models to safe, verified paths. By moving the task of generating database commands away from the language model and into a trusted, deterministic process, the researchers have created a system that is both safe and practical. This design offers a way for institutions to unlock the value of their data without risking the integrity of their records, proving that in the world of enterprise data, safety is a property of the structure, not the scale.