AI DataVault

A zero-trust security gateway that protects sensitive data from autonomous AI agents by detecting prompt injection, blocking exfiltration, and enforcing human approval for risky actions.

Comment

Inspiration

As AI agents become capable of browsing the web, calling tools, accessing files, and taking autonomous actions, a new security problem is emerging: what happens when an AI agent is tricked into accessing or exposing sensitive data? AI DataVault was created to address this problem by putting a Zero-Trust Security Gateway between AI agents and sensitive resources. Instead of automatically trusting an agent's requested action, DataVault evaluates every action before execution.

What it does

AI DataVault evaluates autonomous AI-agent actions using security policies and classifies requests into three outcomes: ALLOW — safe actions can proceed. HUMAN APPROVAL — sensitive or uncertain actions require human authorization. BLOCK — dangerous actions are rejected. The system is designed to detect and defend against scenarios such as: Indirect prompt injection Confidential-data exfiltration Unauthorized tool access Sensitive-data requests High-risk autonomous actions Every decision can be recorded as an auditable security event, helping users understand what the AI agent attempted and why the gateway allowed, escalated, or blocked it.

How we built it

The project combines an AI-agent security workflow with a policy-enforcement layer. Each simulated agent action is represented as an action request and evaluated against deterministic security rules before the action is allowed to proceed. The interface provides a Security Operations Center-style dashboard where users can run attack simulations and observe the security decision in real time. The key workflow is: AI Agent → Action Request → Zero-Trust Gateway → Risk/Policy Evaluation → ALLOW / HUMAN APPROVAL / BLOCK → Audit Log

Challenges we ran into

One of the biggest challenges was making the security concept demonstrable rather than presenting it only as a dashboard. The project therefore focuses on observable security decisions: an agent attempts an action, the gateway evaluates it, and the interface shows the resulting enforcement decision. Another challenge was designing the system so that sensitive operations could require human approval rather than relying entirely on automatic AI decisions.

Accomplishments that we're proud of

Future versions could integrate with real enterprise AI agents, identity providers, cloud storage, databases, SIEM systems, and enterprise policy engines. The long-term goal is to provide an independent security control layer for autonomous AI systems so organizations can adopt AI agents while maintaining control over sensitive data and high-risk actions.

What we learned

Building AI DataVault helped me understand that AI security cannot depend only on the intelligence of the model. An AI system also needs an independent enforcement layer that limits what the agent is actually allowed to do. I learned how to design security policies around agent actions, model threat scenarios, create security demonstrations, and turn an abstract security problem into an interactive product.

What's next for AI DataVault

Upgrade my existing AI DataVault into a working hackathon-ready Zero-Trust AI security demo.

Keep the existing UI and features, but implement a real security gateway:

AI Agent → Action Request → Policy Engine → ALLOW / HUMAN APPROVAL / BLOCK → Audit Log

Add 4 working simulations:

  1. Prompt Injection → BLOCK
  2. Data Exfiltration → BLOCK
  3. Sensitive PII/Confidential Data → HUMAN APPROVAL
  4. Safe Request → ALLOW

Make HUMAN APPROVAL functional:

  • Show pending request
  • Approve → action allowed + audit log
  • Deny → action blocked + audit log

Add Run Full Security Demo that executes all 4 scenarios and shows actual results.

Connect dashboard counters and audit logs to the simulated events. Clearly label simulations as demo data. Make everything mobile-responsive and ensure all buttons/actions actually work.

Do not use fake security claims or expose real credentials/secrets.

Built With

  • ai
  • ai-agents
  • artificial-intelligence
  • cloud
  • cybersecurity
  • data-security
  • generative-ai
  • llm
  • machine-learning
  • privacy
  • prompt-injection
  • python
  • security-gateway
  • web-application
  • zero-trust
Share this project:

Updates

Submission history