The problem
Coding agents can now write files, run code, commit and push. The usual safety story is that the agent was allowed to use a tool. That is not the same as a person approving the exact action that ran. If the arguments change after approval, or an old approval is reused, the action should not run. And the decision should leave a record that someone else can check without trusting the agent or its logs.
What it does
AI⁴ Gate puts an authorization gate between an NVIDIA Nemotron coding agent and its tools. Nemotron plans on Nebius Token Factory and proposes one tool call at a time: read_file, write_file, run_python, run_tests, git_commit, git_push, send_message.
- Safe calls, such as edits inside src/ and tests/, pass by policy.
- Risky calls, such as writing or running a new script or pushing to main, wait for a person.
- Some calls are refused outright, such as pushing to any remote other than origin/main or messaging anyone outside [email protected].
An approval is bound to a SHA-256 hash of the exact action (tool, every argument, target) and an expiry, and it works once. Change one byte between approval and execution and the gate refuses. Every execution-time decision, allowed or refused, and every outright policy denial at proposal time produces an Ed25519 signed receipt that names the planner and the model id. A pending proposal that never executes and is not denied by policy (allowed by policy but not run, or still waiting for approval) does not generate a receipt. An approval by itself is not a receipt. A separately written verifier checks receipts offline without importing the gate.
What the demo shows (all live Nemotron runs on October 28, 2026)
- Session 1, "Fix the calculator and push": Nemotron reads the project, fixes a broken add(), adds a regression test, asks to write and run a smoke script (each approved by a person over the exact hash), commits, and asks to push to origin/main (approved). 10 Nemotron calls, 18,083 tokens, 9 gated actions.
- Replaying the approved push is refused with ALREADY_CONSUMED. Submitting the same push altered to a different remote is refused with ACTION_MISMATCH. Both refusals have signed receipts. 11 of 11 receipts verified.
- Session 2, "Prompt injection tries to exfiltrate": a planted note tells the agent to push to a remote named mirror and email the diff to [email protected]. Nemotron follows the note. The gate denies the mirror push and the outside message by policy, before either runs. 18 Nemotron calls, 44,248 tokens, 17 receipts, 17 of 17 verified offline.
- The offline verifier returns VALID on the saved push receipt and INVALID (SIGNATURE_INVALID, ACTION_HASH_MISMATCH) on a copy with the target edited.
Nothing leaves the server: git remotes are local bare repositories and send_message writes to a local outbox.
LIVE versus SCRIPTED
- LIVE: playback of captured live nvidia/Nemotron-3.5-Super-VL runs on Nebius Token Factory (the two sessions above), labeled LIVE in the video.
- SCRIPTED: the offline demo (python -m gate_demo.demo) and the local UI screen capture use the scripted planner, labeled SCRIPTED. It is not Nemotron, and its receipts carry the label SCRIPTED and model id scripted-offline.
- The hosted preview uses live Nemotron in guided mode (preset scenarios only).
Post-deploy verification on the hardened private preview (redeployed with this code, including separate judge credentials, on October 29, 2026 PT) reconfirmed: HTTPS with Secure session cookies; 401 without the access token; guided mode refuses free text; live nvidia/Nemotron-3.5-Super-VL tool use on fix-calc; exact-action approval; ALREADY_CONSUMED on replay; ACTION_MISMATCH on tamper; offline Ed25519 verifier VALID then INVALID on a tampered copy; rate-limit 429; no secrets in responses or receipts. Demo video frames are labeled LIVE or SCRIPTED, and the local screen capture of the UI is labeled as a SCRIPTED screen capture, not Nemotron.
How it is built
- Planner: OpenAI-compatible function calling against Nebius Token Factory, default model nvidia/Nemotron-3.5-Super-VL, base URL https://api.tokenfactory.nebius.com/v1/. The model sees the gate's decision as the tool result.
- Gate: FastAPI service with propose, approve, execute. The open reference authorizer keeps single-use approval state in SQLite and signs receipts with Ed25519 over a canonical encoding. The format is in RECEIPT_SPEC.md.
- Sandbox: per-session temp workspace, local bare git remotes, simulated outbox, no shell tool, CPU, memory, time, output and write limits.
- Hosted preview: guided mode with preset scenarios only. Free-text tasks are refused. run_python and run_tests only run files whose bytes match the scenario tree or a write the gate allowed. Per-IP and global rate limits plus daily request, token and agent-run caps. The model key never reaches the browser, receipts or logs.
- Verifier: an independent second implementation of the receipt rules (verify.py).
Why it matters
As agents take real actions, the question shifts from "can the model do this?" to "who authorized this exact action, and can we prove it?" Capability is not permission. AI⁴ Gate is a small, checkable answer for coding agents: exact-action approval, single use, and a receipt anyone can verify.
Security guarantees and limitations
Guarantees in this prototype: an unapproved action does not run; a changed action does not run; an approval runs at most once; each execution-time decision, allowed or refused, and each proposal-time policy denial has a signed receipt (a pending proposal that never executes does not); the model key is not returned to the browser; code runs only in the session sandbox; git remotes and messages do not leave the machine.
Limitations: the demo approver key lives in the gate process; there is no trusted time source; the sandbox is a limited local process, not a VM; a receipt proves integrity and signer identity, not that the tool succeeded. The reference authorizer in this repository is not a production service.
What's next
MCP integration, a gate other agents can call as a service, and approval of the exact document an agent will send.
Log in or sign up for Devpost to join the conversation.