Inspiration
AI agents are quickly moving from simple chat experiences into real enterprise operations. They can answer customers, process refunds, call APIs, access business systems, and influence decisions that affect money, data, and trust.
But there is a serious gap.
Most teams focus on building the AI agent. Very few teams can prove that the agent is safe enough to release into production.
That question became the starting point for AgentSeal:
Can an enterprise prove that an AI agent was tested, red-teamed, reviewed, certified, and monitored before it went live?
That is why we built AgentSeal.
AgentSeal is not another AI agent. It is the release governance layer around AI agents — a TrustOps system that helps enterprises decide whether an AI agent is safe enough for production.
Our core principle is simple:
Proof before production.
What it does
AgentSeal validates enterprise AI agents before production release.
For this project, we built a realistic Customer Refund AI Agent scenario. This agent must follow refund policy, protect customer private data, block duplicate refunds, reject prompt injection, require manager approval for high-value refunds, and prevent unsafe API calls.
AgentSeal turns those requirements into a complete release-gate workflow:
- A user submits the AI agent and its business rules.
- AgentSeal extracts the policy, safety, approval, and API constraints.
- Test Forge generates functional, policy, privacy, and API-safety test cases.
- Gladiator Engine generates red-team attacks for prompt injection, PII leakage, system prompt leakage, role impersonation, duplicate refund attempts, and unsafe API calls.
- The validation flow is mapped to UiPath Test Cloud / Test Manager.
- RiskSeal calculates an explainable production-readiness risk score.
- Human Seal Gate lets a reviewer approve, request remediation, block, or escalate the release.
- Evidence Vault stores audit-ready release evidence.
- Release Certificate shows whether the AI agent is safe enough to release.
- LiveSeal Monitor turns future risky behavior into regression tests.
In the unsafe baseline run, the refund agent fails critical release checks. It approves a high-value refund without manager approval, allows duplicate refund risk, exposes private customer data, and fails prompt-injection resistance.
AgentSeal blocks the release with a 92/100 risk score.
After remediation and retesting, the risk score drops to 22/100, and the agent becomes seal-ready.
AgentSeal also includes a live UiPath integration page where the deployed Vercel frontend connects to the Render FastAPI backend and verifies the UiPath release-gate flow through configuration check, OAuth token test, real Orchestrator job start, and latest job status.
How we built it
We built AgentSeal as a full-stack hackathon MVP with live deployment, UiPath proof, and an end-to-end enterprise release story.
The frontend is built with Next.js, TypeScript, and Tailwind CSS and deployed on Vercel. It includes the complete governance journey: assessment, test generation, red-team validation, test execution, risk scoring, human review, evidence vault, release certificate, LiveSeal monitoring, UiPath proof, backend health, and live UiPath integration.
The backend is built with FastAPI and deployed on Render. It exposes health checks, UiPath proof APIs, Test Cloud mapping, Maestro BPMN flow proof, Action Center-style human task modeling, risk case modeling, Orchestrator planning, and live UiPath integration endpoints.
For UiPath, we focused on the UiPath Test Cloud track and used the UiPath ecosystem as the validation and orchestration backbone:
- UiPath Test Cloud / Test Manager for AI-agent release validation.
- Maestro BPMN for modeling the release-gate workflow.
- UiPath Orchestrator for live release-gate job execution proof.
- Human Seal Gate to represent reviewer control.
- Risk Case modeling for high-risk remediation flow.
The live integration verifies that AgentSeal can connect to UiPath Automation Cloud, check configuration, request an OAuth token, start a deployed Maestro BPMN release-gate workflow through Orchestrator, and read the latest UiPath job status.
Challenges we ran into
The biggest challenge was making AgentSeal feel like a real enterprise governance product, not just a polished demo screen.
We had to connect many layers into one clear workflow: business rules, generated tests, red-team prompts, UiPath Test Manager proof, risk scoring, human review, remediation, evidence, certification, monitoring, live backend APIs, deployment, and UiPath Orchestrator integration.
Another challenge was making the UiPath usage meaningful. We did not want to simply mention UiPath in the pitch. We wanted AgentSeal to clearly show how UiPath fits into AI-agent release governance: Test Cloud for validation, Maestro BPMN for release workflow, Orchestrator for live execution, and human review for controlled release decisions.
We also worked through real deployment issues, environment configuration, frontend/backend connection, live API testing, proof screenshots, and public links so the project could be verified by judges instead of only running locally.
Accomplishments that we're proud of
We are proud that AgentSeal became a complete AI-agent release governance system with live proof.
AgentSeal includes:
- A polished live frontend deployed on Vercel.
- A live FastAPI backend deployed on Render.
- A public GitHub repository with CI workflow.
- UiPath Test Manager proof.
- Maestro BPMN release-gate proof.
- Live UiPath Orchestrator integration.
- RiskSeal scoring.
- Human Seal Gate review.
- Evidence Vault.
- Release Certificate.
- LiveSeal Monitor.
- A before-and-after release story: 92 risk blocked → 22 risk seal-ready.
The strongest part is that AgentSeal does not only test whether an AI agent gives a correct answer. It tests whether the agent is safe enough for production.
That is the difference between a demo AI agent and an enterprise-ready AI-agent governance layer.
What we learned
We learned that AI-agent quality is not only a testing problem. It is also a governance, compliance, evidence, and release-decision problem.
AI agents need to be tested against normal business rules, adversarial prompts, sensitive data requests, unsafe tool calls, approval bypass attempts, duplicate transactions, and real-world monitoring signals.
We also learned that human judgment still matters. Some AI-agent failures should not be handled by automation alone. Reviewers need clear evidence, risk scores, failed tests, remediation notes, and certification status before approving a release.
Most importantly, we learned that the future of enterprise AI will not only be about building more agents. It will be about proving which agents are safe enough to trust.
What's next for AgentSeal
Next, we want to turn AgentSeal from a hackathon MVP into a production-ready AI-agent governance platform.
Planned improvements include:
- Persistent database storage for assessments, evidence, and certificates.
- Role-based access control for QA, compliance, developers, and business owners.
- Deeper UiPath Test Manager result synchronization.
- Direct Action Center task creation for human reviewers.
- More advanced red-team prompt generation.
- Multi-agent and multi-team release governance.
- Enterprise audit export.
- Full production monitoring integrations.
- Automated regression test creation from real production incidents.
- Stronger organization-level policy management.
Our long-term vision is for AgentSeal to become the release governance layer enterprises use before trusting AI agents in production.
AgentSeal — Proof before production.
Built With
- ai-agent-governance
- fastapi
- github-actions
- maestro-bpmn
- next.js
- oauth
- python
- red-team-testing
- render
- rest-apis
- risk
- tailwind-css
- typescript
- uipath-orchestrator
- uipath-test-cloud
- uipath-test-manager
- vercel
Log in or sign up for Devpost to join the conversation.