Causentry

Inspiration

AI agents can be manipulated by malicious instructions hidden in merge requests and repository files. We built Causentry to prevent untrusted content from triggering unauthorized actions.

What it does

Causentry validates AI-generated tool proposals against trusted user intent, authorized scope, and security policies. It allows legitimate actions, blocks unauthorized operations, and records auditable evidence.

How we built it

We integrated GitLab Duo Agent Platform with a Python-based policy gate through MCP. GitLab CI/CD automates security validation and testing.

Challenges we ran into

The main challenge was blocking malicious actions while preserving legitimate workflows. We learned that detecting suspicious text is not enough-AI agent actions need independent authorization.

Accomplishments that we're proud of

• Real GitLab Duo MCP integration with ALLOW/BLOCK decisions.
• Stored prompt-injection attack blocked in a controlled simulation.
• Native GitInject baseline: 5/5 successful attacks without defense.
• Defended smoke test prevented unsafe review publication; official security verdict remains UNKNOWN.
• 12/12 synthetic policy tests passed.
• All four GitLab CI/CD jobs passed.

What we learned

We learned that securing AI agents requires more than detecting malicious prompts. Even with valid credentials, an agent can propose unauthorized actions. Independent policy enforcement is essential to prevent unsafe execution while preserving legitimate workflows. We also learned the importance of distinguishing model resistance, policy enforcement, and verified benchmark results.

What's next for Causentry

Expand enforcement to additional AI agent tools and evaluate more real-world attacks.

Built With

• ci/cd
• gitlab
• gitlabduo
• ollama
• python