CausalGate

Trace where agent intent diverged, then gate fixes with evidence-backed replay.

Comment

OpenAI Build Week article

I wrote and published a public build story specifically for this OpenAI Build Week submission: The Missing Control Loop for AI Agents: Intent, Evidence, and Replay.

Article: https://kenhuangus.substack.com/p/the-missing-control-loop-for-ai-agents

The article documents the problem, architecture, SDK and SaaS paths, what changed during the Build Week submission period, how Codex and GPT-5.6 were used, the tested failure modes, replay evidence, and the public demo. It is part of CausalGate's hackathon submission materials.

Why I built it

AI agents can produce a reasonable answer while their tools do the wrong thing. A transcript may look successful even when the execution reads protected data, crosses an approved destination boundary, or completes the task through an unauthorized path.

I built CausalGate to make that gap visible and testable. It records the agent's declared intent, captures ordered execution evidence, shows the first causal divergence, applies intent-based authorization, and reruns the same scenario under protection before recommending promotion.

What it does

CausalGate provides one control loop for agent intent, authority, evidence, replay, and release decisions:

A typed intent contract defines purpose, allowed actions, protected resources, destinations, and expected effects. Deterministic detectors link every finding to the event evidence that supports it. The Intent Causal Record joins the contract, event chain, clause coverage, authorization decisions, limitations, and source revision. Intent-Based Access Control evaluates identity, agent authority, intent grant, organization policy, and runtime context. Unknown tool mappings fail closed. Protected replay runs the same scenario with the control enabled and compares the evidence delta. A scoped gate recommends promote, hold, or block without claiming universal safety.

The no-signup demo uses synthetic data and does not need an API key. Its vulnerable baseline produces eight evidence-linked findings. The protected replay produces zero findings and a scoped promote recommendation. Optional live GPT-5.6 investigation is explicit ephemeral BYOK; CausalGate does not store the key.

How it is built

The core is a Python 3.11+ package with FastAPI, Pydantic, SQLite, and OpenAI/Agents SDK integration boundaries. The interface is React and TypeScript. The same deterministic workflow drives the SDK, API, CLI, browser, reports, and tests.

The repository includes local Docker, Google Cloud Run, and AWS App Runner deployment profiles. The public judge profile intentionally uses one scale-to-zero Cloud Run instance because SQLite state and the permit ledger are local to the process. The README clearly separates this alpha judge profile from the durable, tenant-isolated infrastructure required for a production SaaS.

SDK and SaaS

Developers use the Python SDK to wrap agent execution, record normalized events, authorize tool calls, generate causal records, and enforce replay gates in CI.

A SaaS version would use the same engine as a shared control plane for tenant-authorized evidence ingestion, policy versions, review workflows, replay comparison, and release integrations. Sensitive raw payloads can remain in the customer's runtime while the hosted layer receives redacted evidence and digests.

How I used Codex and GPT-5.6

I used Codex throughout product design, architecture, implementation, debugging, documentation, browser QA, and release preparation. The working loop was inspect the PRD and architecture, trace the implementation, reproduce defects, patch the smallest responsible surface, run the full suite, and compare the product against the written contract.

GPT-5.6 was used where broader reasoning mattered, including the causal model, authorization ontology, product boundary, SDK/SaaS framing, and the review of differences between the PRD and implementation. Deterministic code still owns authorization and release decisions; optional GPT-5.6 analysis helps humans investigate the recorded evidence.

The current gate passes 80 backend tests with 90% coverage, 9 UI tests, a production TypeScript build, GitHub CI, GitGuardian, CodeRabbit status, a public Cloud Run health check, and a public YouTube demo copyright check.

Try it

Open the public demo. Select Run vulnerable scenario. Review the eight findings, event evidence, Intent Causal Record, and authorization decisions. Select Replay with protection. Confirm zero replay findings and the scoped promote recommendation.

No account or credential is required for the deterministic path.

Built With

Share this project:

Updates