1. A computer-implemented method comprising: receiving, by a first trusted process a) executing in a first trusted processing environment and b) that manages data access for an untrusted processing environment, a data flow graph for an untrusted application, executing in the untrusted processing environment, that identifies one or more data objects and one or more untrusted functions; and managing, by a second trusted process i) executing in a second trusted processing environment and ii) that manages data access for an untrusted worker environment, execution of the untrusted functions to produce materialized data objects corresponding to the data objects by: determining, by the second trusted process, input data for one of the untrusted functions using the data objects; providing, by the second trusted process to an untrusted worker process in the untrusted worker environment, the input data to cause the untrusted worker process to execute the one of the untrusted functions using the input data; and receiving, by the second trusted process, output data generated by the untrusted worker process using the one of the untrusted functions and the input data.