ChangeGate Project

• 

  ChangeGate starting state — seven WebMCP tools, explicit human authority boundaries, and independent verification.

• 

  Native WebMCP tool surface: seven safe tools registered for inspection, policy review, proposal, audit, and verification support.

• 

  The agent proposes a synthetic $25 refund for Order #4821 within the $30 policy limit.

• 

  Human approval is recorded, but execution remains a separate action.

• 

  After separate human execution, ChangeGate independently verifies the observed $25 result before marking the workflow VERIFIED.

• 

  Boundary checks fail closed for over-policy requests, post-approval substitution, duplicate execution, and mismatched verification evidence.

Created by Frank Ebert, a Microsoft 365 / Copilot consultant building practical human-governed AI systems. ChangeGate grew out of real-world enterprise concerns: AI can help inspect, diagnose, and propose actions, but consequential authority should remain separated through approval, execution, and independent verification.

Inspiration

Most agent demos focus on how much an AI can do on its own. ChangeGate focuses on a different question: what should an AI not be allowed to do by itself?

In real business systems, the highest-risk moments are often not the initial analysis. They happen when a system changes money, access, records, customer status, or operational state. I built ChangeGate to explore how WebMCP can support useful AI assistance while keeping consequential authority divided across proposal, authorization, execution, and independent proof.

What ChangeGate Does

ChangeGate is a human-governed WebMCP control layer for consequential AI actions.

In the demo, an AI agent can inspect state, read policy, review the audit trail, create a proposal, and request human review. It cannot approve, execute, or verify its own consequential action.

The sample workflow is a synthetic refund case. The agent proposes a $25 refund for Order #4821. Policy allows refunds up to $30. A human must approve the exact proposal, but approval still does not execute the refund. A second human action is required to execute the approved $25 refund. After execution, ChangeGate independently reads the ledger and verifies that the observed result matches the authorized result before marking the workflow VERIFIED.

How We Built It

ChangeGate is built as a Next.js / React / TypeScript application with native WebMCP tool registration.

The application exposes exactly seven WebMCP tools. These tools allow the agent to inspect workflow state, read policy, review audit evidence, create a bounded proposal, request review, and observe verification-related state. The dangerous parts of the workflow remain outside the agent’s authority.

The system uses a structured state-machine approach so that approval, execution, and verification cannot collapse into one step. Each consequential transition is recorded in the audit trail, and the UI makes the separation visible to both the human operator and the reviewing judge.

Challenges We Faced

The main challenge was keeping the demo simple enough to understand while still showing the real boundary that matters.

It would have been easier to build a normal automation demo where the agent proposes and executes the action. Instead, ChangeGate deliberately forces friction at the points where friction is useful: approval is not execution, execution is not proof, and verification requires independent readback.

Another challenge was making the workflow judge-friendly. The final demo needed to show WebMCP clearly, keep the transaction synthetic, avoid overclaiming, and make the control boundaries understandable in a short video.

What We Learned

The most important lesson is that agent safety is not only about model behavior. It is also about product architecture.

A capable agent can be useful without being given unilateral authority over consequential changes. WebMCP makes this especially interesting because the interface between the agent, the application, and the human operator can be designed as a governed control surface rather than a simple automation bridge.

ChangeGate shows that agentic systems can be powerful while still preserving accountability, separation of duties, and independent verification.

What's Next

The next version of ChangeGate would expand the same pattern beyond the synthetic refund demo into other high-impact workflows: account changes, support operations, financial adjustments, access requests, compliance reviews, and enterprise approval processes.

The long-term direction is a reusable human-governed control plane for AI-assisted work: AI proposes, humans authorize and execute, and the system independently verifies the result.

Control the transaction — not the person.

Built With

• chatgpt
• codex
• css3
• github
• html5
• javascript
• next.js
• openai
• react
• typescript
• vercel
• webmcp