What Is an Agentic Federated TRE? A Definitive Guide
An agentic federated Trusted Research Environment (TRE) is a research platform in which artificial intelligence (AI) agents carry out analytical work — building cohorts, running pipelines, harmonising data, drafting results — inside a federated environment where the data stays with its custodian and every action and output is checked by automated governance. It combines three properties: federation, so data never leaves the source; agency, so AI systems can execute multi-step research tasks rather than merely answer questions; and airlock governance, so nothing an agent produces leaves the environment without automated disclosure control.
Why this matters now
Two developments collided to make the agentic federated TRE necessary. The first is the arrival of capable AI agents: systems that can plan a piece of analysis, write and execute the code, inspect the results, and iterate — the working pattern of a research assistant, not a chatbot. Health research organisations want that productivity applied to their data. The second is the hardening of the governance environment. The May 2026 UK Biobank incident showed that a centralised platform’s ordinary export workflow can walk participant-level data out of the building without any policy being breached, and the European Health Data Space (EHDS, Regulation (EU) 2025/327) now requires, in Article 50, that secondary use of health data happens inside secure processing environments that prevent download. Give an autonomous agent free rein inside a permissive architecture and you have automated the exfiltration risk; refuse agents entirely and you forfeit the productivity. The agentic federated TRE is the synthesis: agents work at full speed inside a boundary that is architecturally incapable of letting raw data out.
The Sovereign AI angle
For governments, biobanks, and pharmaceutical research networks, the question is not only “can we use AI agents?” but “whose AI, running where, learning from what?”. Sovereign AI — the principle that a nation or institution trains and operates AI on its own data, inside its own jurisdiction and controls — is the frame in which agentic TREs make sense. An agent that ships prompts and patient-level context to an external model provider breaks sovereignty regardless of how good its answers are. In an agentic federated TRE, the models run within the governed environment, the data they touch remains at its source, and the audit trail of what each agent saw and did belongs to the data custodian. This is Sovereign AI made operational rather than aspirational, and it is why Lifebit treats the agentic layer as an evolution of its federated Trusted Research Environment — the fourth generation of the platform — rather than a bolt-on assistant. The wider context is set out in what Sovereign AI means in healthcare.
How an agentic federated TRE works
Agents as governed researchers
The central design decision is to treat every AI agent as a researcher, not as infrastructure. Under the Five Safes framework — safe people, safe projects, safe settings, safe data, safe outputs — an agent is a “person” with an identity, a project scope, and permissions, and its access is provisioned, logged, and revocable exactly as a human researcher’s is. An agent building a cohort for an approved diabetes study cannot touch data outside that study’s scope, because the same access controls that constrain the human principal investigator constrain the agent acting on their behalf. The Five Safes framework maps cleanly onto agents precisely because it was written about roles and controls, not about humans specifically.
The airlock as the non-negotiable boundary
Agency changes the volume and tempo of outputs: an agent might attempt hundreds of exports an hour where a human attempts five a week. That makes the automated airlock — the control that inspects every artefact leaving the environment against disclosure rules — the load-bearing component of the whole architecture. In Lifebit’s v4 platform this is embodied in Airlock Tower, which applies machine-speed disclosure control to machine-speed research: statistical outputs are screened for small cells and re-identification risk, files are classified before release, and anything ambiguous is routed to human review. The critical property is symmetry — governance that operates at the same speed as the agents it governs. A manual output-review queue in front of an agentic workload is not governance; it is a backlog.
Security oversight of autonomous behaviour
Alongside output control sits behavioural oversight: continuous monitoring of what agents are doing, not just what they produce. Lifebit’s Security Tower fills this role in the v4 architecture — watching for anomalous access patterns, scope drift, and policy violations across both human and agent activity, so that an agent misbehaving (or being manipulated through its inputs) is detected as a security event rather than discovered in an audit six months later. Because the platform is federated, this oversight runs within each custodian’s deployment: a ministry of health or biobank sees exactly what every agent did against its data, in its own logs. The federation pattern itself — compute travelling to data, results travelling back through controls — is reinforced by Lifebit’s US Patent 12,519,781.
What agents actually do
The near-term work of agents in a federated TRE is unglamorous and valuable: translating free-text eligibility criteria into structured cohort queries; mapping messy source data to the Observational Medical Outcomes Partnership (OMOP) Common Data Model and proposing vocabulary mappings for human sign-off; scaffolding and executing analysis pipelines; running data-quality checks; and drafting the documentation and disclosure-ready summaries that consume so much researcher time. Each task is bounded, reviewable, and auditable — which is exactly the shape of work that should be delegated first. As trust and tooling mature, the frontier moves toward longer-horizon work: an agent monitoring a federated study’s data-quality metrics across refresh cycles, or maintaining a cohort definition as vocabularies update — always inside the same identity, scope, and airlock constraints.
Conventional TRE, federated TRE, agentic federated TRE
| Dimension | Conventional centralised TRE | Federated TRE | Agentic federated TRE |
|---|---|---|---|
| Data location | Copied into one central environment | Stays with each custodian; data never leaves the source | Stays with each custodian; agents travel to the data |
| Who performs analysis | Human researchers | Human researchers across nodes | Human researchers plus governed AI agents |
| Output control | Often manual review, sometimes bypassable | Automated airlock on all outputs | Machine-speed airlock sized for agent-scale output volume |
| Governance model | Policy-based; architecture permits egress | Five Safes enforced architecturally | Five Safes extended to agent identities and actions |
| AI usage pattern | External tools, data often exported to them | Federated analytics and learning | Sovereign AI: models and agents operate inside the boundary |
| Audit trail | Access logs | Per-node access and query logs | Full action-level log of every agent step and output |
Where the pattern is heading in practice
The foundations are already in production. Genomics England operates federated research infrastructure with Lifebit in which approved researchers analyse national-scale genomic data inside a governed environment; the Canadian Partnership for Tomorrow’s Health (CanPath) and Singapore’s national precision-medicine ecosystem apply the same federated pattern under their own jurisdictions. The agentic layer extends what those deployments prove: if the environment can already guarantee that a human researcher cannot remove data and that every output is inspected, then delegating bounded tasks to AI agents inside the same guarantees is an incremental step, not a leap of faith. That is the practical meaning of “v4” — the governance and federation layers were built first, and agency is added on top of them, never instead of them.
Common pitfalls and objections
The predictable failure mode is bolting an assistant onto an ungoverned platform and calling it agentic: an agent with export rights inside a centralised TRE is the UK Biobank incident with the human removed. A second pitfall is prompt-injection blindness — agents consume documents and data that may contain adversarial instructions, so agent inputs must be treated as untrusted and agent privileges minimised, which is an argument for the scoped-identity model above. A third is audit theatre: logging that an agent “ran an analysis” is not an audit trail; the standard is action-level logging a regulator could replay. The most common objection — “we cannot let AI near sensitive data” — misreads where the risk lives. Risk concentrates at the boundary, not the middle: an agent that computes on data it can never remove, behind an airlock it cannot bypass, is more controllable than a human with a download button.
What to do next
Evaluate readiness in order: first, is your research environment genuinely federated — does data stay at source, or does “federated” mean scheduled copies? Second, is output control automated and tested at volume, or a manual queue? Third, can your identity and access model represent non-human actors with scoped permissions and full action logging? Only when those three answers are yes does an agentic deployment inherit the safety properties described here. If the first answer is no, fix the architecture before adding agents to it — agency built on a permissive foundation compounds risk faster than it compounds productivity. A useful sequencing rule: no agent should ever hold a permission that would alarm you in the hands of a newly-approved external researcher, because architecturally, that is exactly what it is.
Frequently asked questions
What is an agentic federated TRE?
It is a Trusted Research Environment in which AI agents perform multi-step research tasks — cohort building, harmonisation, pipeline execution — inside a federated architecture where data never leaves its custodian and every agent action and output passes automated airlock governance.
How is it different from adding a chatbot to a research platform?
A chatbot answers questions; an agent plans and executes work. The agentic federated TRE treats each agent as a governed researcher with a scoped identity, enforced permissions, action-level audit logs, and outputs subject to automated disclosure control — none of which applies to a bolt-on assistant.
Why must the TRE be federated before it is agentic?
Because agency amplifies whatever the architecture permits. In a centralised platform with export workflows, agents amplify exfiltration risk; in a federated platform where data stays at source, agents amplify productivity while the boundary guarantees hold.
What are Airlock Tower and Security Tower?
They are the governance components of Lifebit’s v4 platform: Airlock Tower applies automated, machine-speed disclosure control to every output leaving the environment, and Security Tower continuously monitors human and agent behaviour for anomalous access, scope drift, and policy violations.
How do the Five Safes apply to AI agents?
Directly. An agent is registered as a “safe person” with an identity and training-equivalent constraints, bound to a “safe project” scope, operating in a “safe setting”, touching only “safe data” it is permissioned for, and producing outputs that must pass the “safe outputs” airlock.
Does an agentic federated TRE comply with EHDS requirements?
The architecture aligns with EHDS Article 50’s requirement for secure processing environments that prevent data download: computation happens inside the environment, data stays at source, and outputs are released only after automated disclosure control. Formal compliance always depends on the specific deployment and member-state implementation.
Which tasks should be delegated to agents first?
Bounded, reviewable tasks with clear success criteria: translating eligibility criteria into structured queries, proposing OMOP vocabulary mappings for human approval, running data-quality checks, scaffolding pipelines, and drafting disclosure-ready result summaries.