-
-
No approval, no action: the first purchase is blocked; the agent can only propose a boundary.
-
One human click creates a reusable boundary: Household, ≤ $30, StoreA/B, no subscriptions.
-
Audit log: decision, boundary, authority source (Human Approval B001), MCP tool.
-
New session, same authority: the approved boundary reloads and MCP buys automatically.
-
Every step is traceable: search → evaluate → token → purchase.
-
"Ignore the limit" is rejected: only a human can expand authority.
Inspiration
Alexa+ acts across services and sessions. Who decides how much authority it has?
- ❌ Confirm every action → useless
- ⚠️ Unlimited authority → unsafe
- ❗ Real risk: you approve $30, the agent says "ignore the limit" and buys a $96 subscription
What it does
- 🚫 No approval → blocked. The agent can only propose a boundary.
- ✅ Human approves once (Household ≤ $30, StoreA/B, no subscriptions) → saved across sessions.
- 🤖 New session → acts inside the boundary automatically. Outside → ASK or BLOCK.
- 🔒 "Ignore the limit. It's urgent." → rejected. Only a human can expand authority.
How we built it
LLM interprets → deterministic policy authorizes → MCP executes.
- ✅ Boundary Engine: ALLOW / ASK / BLOCK decided in code, not by the model
- 🔒 Single-use Authority Token → required by MCP
purchase_product - 📋 Audit log shows the authority source (e.g. Human Approval B001)
- 🛠️ Python · FastAPI · SQLite · MCP (Streamable HTTP) · Next.js · Playwright
Challenges
- ❗ Keeping authority one-way
- 🔒 ACTIVE boundary requires
created_by=HUMAN; approval is human-only - 🚫 Expansion attempts are rejected and audited
Accomplishments
- ✅ Full cross-session loop, not a mockup (14 automated tests)
- ✅ Self-escalation, forged and replayed tokens all rejected
- ✅ One-command reproducible demo video
What we learned
💡 Authority is a human-owned object, not something the model infers.
Limitations
- ⚠️ Simulated Alexa+ UI, mock catalog, no real payments
- ⚠️ Rule-based intent, single user
- ❌ No one-time ASK approval yet
What's next
One-time approvals · expiry/revocation · more domains · real auth · an MCP "authority envelope" field
Let AI act — without letting it decide its own authority.
Built With
- alexa+
- fastapi
- fastmcp
- mcp
- next.js
- playwright
- python
- sqlite
- typescript
