Airlock

Inspiration

Every team that builds an AI agent repeats the same setup: connecting tools, choosing a model, writing instructions, adding monitoring. And most of them paste API keys straight into the prompt and hope a malicious email doesn't redirect a payment. We wanted a platform where an agent is a short config file, and the safety comes from how the system is built rather than from hoping the model behaves.

What it does

Airlock is a platform for building internal company agents.

Agent templates: each agent is one YAML file: purpose, tools, contacts, keys (as references to environment variables), budget, guardrails, test scenarios and saved tasks. You can also create one in the dashboard by describing it in a sentence.
Secret firewall: the model only ever sees placeholders like [[secret:STRIPE_KEY]]. The real key stays on the server and is filled in only when a tool allowed to use it runs, and only for its permitted site. Keys that turn up in emails, web pages or tasks are caught and swapped too. In our attack test, an unprotected agent sent real keys to the model in 3 runs; Airlock sent 0.
Protection against hidden instructions: a planner model decides the steps without ever seeing untrusted content. A separate reader model handles emails and web pages but can't use tools. Data from outside can't choose who receives email or money unless a person approves.
Approvals and guardrails: risky actions pause for a person, hard spending limits can't be overridden, and a denial stops the run so later steps can't act on something that didn't happen.
Model selection: Airlock runs an agent's test scenarios against every Muse model and reasoning level and picks the cheapest one that passes. For our refund agent, that was 67% cheaper and 2.6x faster with the same results. It can also write an agent's test scenarios for you.
Budgets: a per-run cost cap enforced before every model call, plus a check that refuses a run before it starts if it probably won't fit.
Usage dashboard: runs, spend, secrets kept from the model, approvals, blocked calls, a per-agent table, an activity log, and model and provider health.
Real actions: real web search through SerpApi, and real email through SMTP to an allowlist of addresses.

How we built it

TypeScript on Node.js, using Meta's Model API (Muse Spark and Muse Wonder) through its OpenAI-compatible endpoint. Every request to the model passes through a single checkpoint that strips secrets. The dashboard is plain HTML, CSS and JavaScript with live updates from the server. Templates are YAML validated with Zod, and 58 automated tests cover the firewall, guardrails, budgets and evals.

Challenges we ran into

Muse resisted all 15 of our prompt-injection attacks on its own, so we had to be honest that Airlock's advantage there is a guarantee rather than a measured difference. The key-leak test does show a measured difference.
Our evals surfaced real bugs: YAML silently cutting off text at a #, an exact-plural word check failing good answers, and the firewall mistaking Google tracking links for keys.

Accomplishments that we're proud of

Zero keys sent to the model across every Airlock run, including the attack suite.
Model selection that pays for itself.
A demo that shows the key being swapped, step by step.

What we learned

Structural guarantees beat asking the model to behave. And measuring our own claims mattered: our first attack results argued against our pitch, which pushed us toward better tests.