BadgeIn x Skybridge

HUMAN AUTHORITY FOR AI ACTIONS. AI can propose. Only you can approve.

Comment

Inspiration

AI agents are moving into calendars, files, inboxes, and business systems. The weak point is not only model accuracy—it is authority. Prompt injection succeeds when language can impersonate permission. We wanted a system that assumes a model may be fooled without allowing that mistake to become an action.

TFB BadgeIn × Skybridge moves authority outside language.

What it does

A model can read a request and untrusted content, then propose a useful action. That proposal begins powerless as NO_NAME / PENDING.

BadgeIn shows the human the exact app, action, resource, destination, payload digest, expiry, and invocation count. Deny closes the proposal permanently. Approve exactly once mints one narrow, expiring, single-use grant. Skybridge checks that exact grant again where the action reaches runtime.

A changed destination, widened resource, altered payload, borrowed app identity, expired or revoked badge, tampered credential, cross-origin approval, or replay is refused. Successful demo actions write one inspectable effect to a session sandbox; they do not contact a real calendar, inbox, or filesystem.

How we built it

Before Build Week, BadgeIn and Skybridge existed as separate TFB systems. During the event we built their end-to-end contest integration:

  • A Python authority service and static HTML/CSS/JavaScript interface
  • Deterministic app manifests and same-origin human approval
  • HMAC-authenticated exact grants with atomic one-use consumption
  • A session-sandbox executor and hash-chained authority history
  • A named Cloudflare Tunnel serving the judge-accessible HTTPS demo
  • A Qwen redundancy ladder with visible route and fallback receipts
  • Pytest and adversarial stress harnesses spanning proposal, approval, runtime, denial, replay, and evidence integrity

The current public receipt says Mac Engine was attempted first but was unreachable, then local qwen3:1.7b produced the structured proposal. Local qwen3.6:35b is ready as the next fallback. The interface names which route answered instead of silently pretending the preferred route succeeded.

What we tested

Our retained bounded run passed 71 tests and 42 stress case groups. The battery maps 20 named attack classes, retained 0 unauthorized executions, detected all 3 evidence-tamper cases, preserved 3 authorized positive controls, and allowed exactly 1 winner among 48 concurrent attempts to spend a single-use grant.

Those results describe this contest duplicate and its synthetic executor. They are not a production security certification and do not claim that prompt injection is universally solved.

Challenges we faced

The hardest work was not drawing a deny button. It was making denial terminal, visible, and impossible to reinterpret later. We also had to prove the system remained useful: a product that blocks everything has not solved the approval problem.

Another challenge was honest model redundancy. A configured Mac Engine route was not the same as a reachable route. We changed the product to expose the failure, identify the fallback that actually answered, and fail closed if every route is unavailable.

What we learned

The wounds became the product.

A denial that changed hidden state but gave no visible response taught us that security state must also be human-readable. A model-identity claim without a receipt taught us to bind claims to observed provider, model, timing, tokens, and response hashes. A failed preferred route taught us that redundancy must narrate why it activated.

OpenAI and Codex collaboration

Codex with GPT-5.6-sol was used during Build Week as a build collaborator for repository inspection, architecture, test-first implementation, adversarial review, evidence binding, and the public experience. The runtime demo is intentionally separate: it uses the disclosed Qwen redundancy ladder, not an OpenAI API call.

What's next

We would add durable multi-process grant storage, enroll each real downstream executor under its own authority contract and kill-test, and keep expanding the boundary from a contest-safe sandbox toward production integrations without weakening the exact human crossing.

AI can propose. Only exact human authority can cross.

Built With

Share this project:

Updates