Anti Ultron

ANTI ULTRON
Architecture Diagram

Inspiration

AI coding agents can turn a single high-level request into dozens of low-level actions: reading files, running commands, modifying source code, changing configuration, creating files, and executing tests.

The problem is that we often give these agents broad repository access before we actually know what they are going to do.

We wanted to explore a different trust model:

The AI can request authority. It cannot grant itself authority.

That idea became Anti-Ultron, a zero-trust execution middleware layer for Agent Launchpad.

Instead of treating an Agent's plan as permission, Anti-Ultron separates the process into:

Plan → Permit → Enforce → Observe → Recover

What it does

Before an autonomous coding Agent executes, Anti-Ultron runs an unprivileged AI preflight.

The planner proposes an Execution Contract describing:

the goal;
planned actions;
requested writable paths;
protected paths;
risk level.

The planner has no shell access, no Codex execution, no Docker execution, and no workspace-write capability.

The human can then review the proposal, edit it manually, or negotiate it in natural language.

For example:

Keep README.md and tests/** protected.
Only allow writes to src/**.

The planner may revise its proposal, but it still cannot approve itself.

Only after explicit human approval does Anti-Ultron validate the contract and compile it into actual Docker/Linux filesystem authority.

The enforcement rule is:

Protected paths
      >
Approved writable paths
      >
Default read-only workspace

Anti-Ultron also independently observes execution using Runtime events and PRE/POST workspace manifests, so planned intent remains separate from what actually happened.

Before execution, a trusted workspace snapshot is also created so the user can restore the pre-run state without asking the Agent to undo its own work.

How we built it

Anti-Ultron was built on top of the provided Agent Launchpad starter repository.

We added a new control plane around autonomous execution.

Every task first creates an awaiting_approval Run. Codex is not started yet.

An unprivileged planner generates the proposed Execution Contract. The backend validates the contract, including writable and protected workspace paths.

If the planner fails because of a timeout, rate limit, malformed response, or invalid proposal, Anti-Ultron fails closed:

Writable authority = none

Once the human approves the contract, the backend freezes the exact approved authority and compiles it into Docker/Linux filesystem permissions.

Conceptually:

/workspace                READ ONLY
approved writable scopes  READ + WRITE
protected scopes          READ ONLY

This means the Agent cannot bypass the policy simply by using a different tool or programming language.

For observability, Anti-Ultron combines sanitised Codex JSONL Runtime events with trusted PRE/POST workspace manifests. Regular-file contents are fingerprinted before and after execution so the system can independently identify resulting created, modified, and deleted files.

We also built trusted Workspace Rollback. A bounded snapshot is created before execution, and trusted backend code can restore the workspace afterward.

Challenges we ran into

One of the biggest challenges was realizing that blocking an action and proving why it was blocked are different problems.

We did not want the UI to claim that Anti-Ultron blocked a specific file unless the runtime evidence could deterministically support that attribution. Ambiguous permission failures therefore remain ambiguous instead of being overclaimed.

Shell command evidence was another challenge. Commands such as:

npm test || true
npm test; true
npm test | tee output.txt

can hide the real test result. Anti-Ultron therefore treats these conservatively rather than falsely reporting that a test passed.

Filesystem enforcement also introduced real OS-level edge cases. Exact-file bind mounts can conflict with tools that save files using temporary files followed by atomic renames, so directory authorities such as src/** became the preferred V1 primitive.

Finally, AI planners are inherently nondeterministic. Instead of assuming they will always behave correctly, we designed planner failure so that it can never increase the Agent's privileges.

Accomplishments that we're proud of

We are especially proud that Anti-Ultron is not just another prompt-based guardrail.

The approved contract is enforced at the Docker/Linux filesystem layer, below the model itself.

In our final demo, the Agent is asked to:

Fix src/greet.js
Run the existing test
Update README.md

The human approves:

Writable

src/**

Protected

tests/**
README.md
package.json
.env
deployment/**

The result is:

✓ Modified src/greet.js
✓ Test command passed
🚫 Blocked README.md — Explicitly protected

The key moment is simple:

The Agent wanted to do it. The human didn't authorize it. So it physically couldn't.

We are also proud of:

Independent execution evidence
Immutable Approved Contract history
Fail-closed planning
Natural-language contract negotiation
Trusted Workspace Rollback

The repository currently passes 134 deterministic tests, the mandatory real Docker integration test, and has zero known production dependency vulnerabilities.

What we learned

The biggest lesson was that a security system around autonomous Agents cannot depend on the Agent itself being trustworthy.

The planner can propose permissions, but it should not grant them.

The execution Agent can perform useful work, but it should not enforce its own limits.

The Agent can explain what it did, but it should not be the only source of truth about what actually happened.

That led us to the architecture behind Anti-Ultron:

AI proposes
      ↓
Humans authorize
      ↓
Trusted backend code validates
      ↓
The operating system enforces
      ↓
Independent evidence observes
      ↓
Trusted infrastructure recovers

We also learned that least privilege is not only a security problem, but also a UX problem. If configuring permissions is too difficult, users will simply approve everything.

Natural-language contract negotiation helps make least-privilege control easier while preserving explicit human approval.