AgentProof

Inspiration

AI agents are moving from chat into execution: they call APIs, update systems, trigger workflows, and can eventually move money. That creates a dangerous gap between a decision that was valid when planned and an action that is still valid when executed.

AgentProof started from one question:

How can an autonomous agent prove that it was still authorized at execution time — and prove that the real-world outcome actually happened?

What it does

AgentProof is a verification runtime for high-value autonomous actions. Our demo uses a simulated $50,000 vendor payment and models the execution chain as: intent → plan → authority → execution gate → dispatch → state transition → evidence

Gemini can choose and invoke the payment workflow, but the LLM does not own the final success state. AgentProof emits VERIFIED only after deterministic checks observe the expected external state transition.

The live demo proves four outcomes:

VERIFIED — authorized payment settles and the ledger proves it. BLOCKED — vendor policy changes after authorization; stale authority is rejected at the execution seam and $0 moves. UNVERIFIED — provider accepts the request but settlement is absent; AgentProof refuses to convert acceptance into success. DUPLICATE — the same execution key is retried; no second payment is created.

The test suite also exercises concurrent retry protection so duplicate execution cannot win a check-then-act race.

Live deployment

AgentProof is deployed on Google Cloud Run:

https://agentproof-ssejdi5rra-uc.a.run.app

Verified cloud runtime results: /health → HTTP 200 NORMAL → VERIFIED STALE → BLOCKED FALSE SUCCESS → UNVERIFIED REPLAY → DUPLICATE

Live natural-language Gemini requests also pass through Cloud Run using gemini-3.6-flash and the run_agentproof_payment tool. Final verdict authority remains the deterministic AgentProof receipt rather than the model's prose.

How we built it

The system separates probabilistic planning from deterministic execution truth. User goal / event ↓ Gemini 3.6 Flash ↓ tool call AgentProof workflow ↓ Short-lived action-bound grant ↓ Freshness + action-binding check ↓ Atomic idempotent dispatch ↓ Outcome verifier ↓ Machine-readable evidence receipt

The implementation uses Python, FastAPI, Google ADK, the Google Gen AI SDK, Pydantic, Docker, pytest, GitHub Actions, Vertex AI settings, and Google Cloud Run. The deterministic verification core remains testable without an LLM.

Challenges

Authorization freshness and TOCTOU

A permission can be valid at planning time and stale seconds later. AgentProof revalidates authority at the execution seam, and freshness/action binding plus dispatch are enforced inside the same critical section so there is no check-then-dispatch gap.

Outcome grounding

An HTTP/API acceptance is not the same thing as a completed business outcome. AgentProof checks observable ledger state before allowing VERIFIED.

Replay races

A naive idempotency check can fail under concurrency. AgentProof makes duplicate detection and execution-key claiming atomic relative to dispatch.

Model authority

A language model can produce confident success text even when reality disagrees. In AgentProof, Gemini may plan and select tools, but it cannot override a deterministic BLOCKED, UNVERIFIED, or DUPLICATE receipt.

Verification

Current verified state:

local pytest: 10/10 PASS compileall: PASS Ruff: 8 non-blocking style findings (not a CI gate) ADK import: PASS Docker build + runtime: PASS GitHub Actions: PASS on Python 3.11 and 3.12 Live Gemini normal + stale: PASS Cloud Run deploy + health: PASS Cloud NORMAL / STALE / FALSE SUCCESS / REPLAY: PASS Secrets exposed: NO

A safe machine-readable verification record is stored in the repository under docs/evidence/.

What we learned

Reliable agent execution needs separate guarantees for:

Was the action authorized? Was that authorization still fresh when execution began? Did the executed action still match the authorized action? Did the intended external state transition actually happen? Could a retry execute the action twice?

AgentProof treats these as separate, testable contracts instead of trusting a final natural-language claim from the agent.

What's next

For the hackathon submission, the runtime is now frozen at a verified demo milestone. The remaining work is packaging the evidence for judges: architecture diagram, short demo video, and final Devpost submission materials.