No code, lots of rules: Why 'citizen data scientists' need guardrails