Inspiration
The hackathon theme made us think about what an "AI apocalypse" might actually look like. It probably would not begin with a robot suddenly deciding to take over the world. A more realistic failure is much simpler: an AI agent is given access to real tools, receives a vague policy, and does something harmful because the policy was never a real technical boundary.
That problem is becoming more important as AI moves beyond chat. Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, compared with less than 1% in 2024. These agents will be able to send messages, access records, update systems, and make decisions on behalf of people and organizations.
Most agent policies today are still written as instructions inside a prompt. They might tell an agent to protect private information or ask for approval before taking a risky action, but the agent is also responsible for interpreting those instructions. If the wording is unclear, incomplete, or contradictory, the policy can fail at the exact moment it matters.
That led us to one question:
What if an AI policy could be written like a constitution, tested like software, and enforced like access control?
Article Zero is our attempt to build that.
What it does
Article Zero turns plain-language AI policies into structured rules that can be inspected, tested, and enforced before an agent uses a sensitive tool.
The user starts by writing policy clauses in ordinary language. Article Zero uses Groq to translate those clauses into a typed policy format with specific conditions, priorities, approval requirements, and field restrictions. The user can review the result before accepting it.
The important part is that the language model does not make the final access decision. Once the policy is compiled, a deterministic policy engine decides whether an action should be:
- Allowed
- Denied
- Allowed with only certain fields
- Sent to a human for approval
Our demo uses a fictional hospital scenario. An unverified responder claims that a patient is in danger and requests the patient's full medical record. The original emergency policy is intentionally vague, so the request succeeds.
Article Zero then explains why the failure happened. The responder's identity was never verified, the emergency was never proven credible, and the policy did not limit which medical fields could be shared.
The user rewrites the clause to require verified credentials, credible emergency evidence, and minimum-necessary disclosure. The new policy must pass regression tests before it can be activated. When the same attack is replayed, the fake responder is denied. A legitimate responder can still receive the few fields needed for the emergency.
How we built it
We built Article Zero with Next.js, React, TypeScript, Tailwind CSS, Zustand, Zod, Groq, React Flow, Vitest, and Playwright.
The application has two separate decision layers.
The first layer uses Groq to interpret natural-language policy and convert it into structured JSON. Every response must match a strict Zod schema before the application accepts it. The model can suggest a policy, but the user still has to review and approve it.
The second layer is a deterministic policy engine written in TypeScript. It evaluates trusted facts, policy conditions, rule priorities, conflicts, field allowlists, and approval requirements. This engine is the actual enforcement boundary.
We also built a simulated hospital tool gateway. Every protected action has to pass through the policy engine before the tool runs. If the policy denies the action, the tool is never called. If the policy allows limited disclosure, the gateway removes every field that was not explicitly approved.
The rest of the product follows the full policy lifecycle:
- Write a constitution
- Inspect the compiled rules
- Run an attack
- Review the incident
- Amend the policy
- Run regression tests
- Activate the corrected version
- Replay the original attack
The attack action is saved in a structured format, which lets us replay the exact same request against both policy versions. That makes the before-and-after comparison much more meaningful.
Challenges we ran into
The hardest technical decision was deciding how much authority to give the language model.
Letting the model interpret the policy and make the final decision would have been much easier to build. It also would have recreated the same problem we were trying to solve. We had to keep the flexible language understanding of an LLM while moving the actual authorization decision into predictable code.
Designing the policy engine was also harder than it first appeared. Real policies contain unknown information, exceptions, conflicting rules, priorities, and cases where a human should make the decision. We had to define clear behavior for each situation without creating a policy language that was too complicated for the demo.
The testing experience created a different problem. Blocking an unsafe policy is correct, but a screen that only says "test failed" leaves the user to diagnose the policy engine on their own. We had to redesign that flow so a failed test explains the issue in normal language, identifies the affected rule, and guides the user back to the right place to fix it.
We also had to fit a fairly large idea into a short demo. Article Zero includes policy writing, AI compilation, deterministic enforcement, adversarial testing, versioning, activation, and replay. Making those pieces feel like one understandable workflow took almost as much work as building the engine itself.
Accomplishments that we're proud of
We are most proud that Article Zero does not ask users to trust another AI model to supervise their AI agent.
Groq helps translate human intent into a structured format, but protected actions still pass through deterministic enforcement. The model can be wrong, the user can reject its interpretation, and the agent cannot bypass the final policy gate.
We also built more than a policy editor. Article Zero shows the full path from a vague sentence to a real failure, then lets the user repair the rule and prove that the repair worked.
A few parts we are especially happy with are:
- Replaying the exact same attack against two policy versions
- Preventing an unsafe policy from being activated
- Restricting disclosure to approved fields
- Explaining why a request was allowed or denied
- Sending uncertain cases to human approval
- Showing how one policy change affects the rest of the system
The most satisfying moment in the demo is watching the original attack succeed, changing one clause, and then watching that same attack fail for the right reason.
What we learned
We learned that natural language is useful for writing policy, but it is a poor enforcement mechanism on its own.
We also learned that LLMs are more useful here as translators than as judges. Groq is good at turning a human sentence into structured rules or helping explain a confusing failure. Deterministic code is better at deciding whether a protected action should actually happen.
Another lesson was that explainability cannot be an afterthought. A policy engine may be technically correct, but users will not trust it if they cannot understand what it decided or how to repair a failed policy.
Finally, we learned that AI governance should happen before deployment. Waiting for an agent to make a serious mistake and then reviewing the logs is too late. Policies should be attacked and tested before the agent receives access to real systems.
What's next for Article Zero
The current prototype focuses on one fictional healthcare scenario because it gives us a clear way to demonstrate privacy, emergency access, identity verification, and minimum-necessary disclosure.
The same system could support financial approvals, cybersecurity tools, customer-service agents, education platforms, and internal company workflows.
Our next steps are to add user accounts and cloud workspaces, allow users to define their own tools and policy templates, and generate a wider range of adversarial tests. We also want to support team approvals, reusable policy libraries, signed policy versions, and CI checks that test agent policies whenever they change.
The larger goal is to make Article Zero a control layer between AI agents and the systems they can affect.
Write the policy. Test it. Enforce it.
Built With
- firebase
- groq
- next.js
- react
- tailwind
- typescript
- zod
- zustand
Log in or sign up for Devpost to join the conversation.