Agent Firewall

Architecture

Inspiration

AI agents are starting to act inside team workspaces, not just answer questions. They can read messages, call tools, query data, send emails, and export information. That creates a new security problem: a prompt injection hidden in a normal Slack message can quietly turn an agent into a data leak.

We built Agent Firewall because teams need visibility and control before agentic workflows become a black box.

What it does

Agent Firewall monitors AI agent tool calls in Slack, scores risk, and gives admins a clear audit trail. It can show which actions were allowed, held for review, or blocked.

Admins can use Slack commands like /firewall log, /firewall status, /firewall status [agent], and /firewall export to inspect activity, review blocked actions, monitor agent health, detect suspicious cross-agent behavior, and generate compliance-ready evidence.

How we built it

We built a FastAPI backend connected to Slack slash commands and Block Kit. Supabase stores the audit log, agent activity, risk scores, decisions, counterfactual explanations, and admin actions.

The visibility layer reads from the audit log and surfaces it directly inside Slack. We added filters, pagination, per-agent health summaries, compliance exports, weekly threat reports, and a lightweight cross-agent conspiracy detector using graph analysis.

Challenges we ran into

The hardest part was coordinating multiple moving pieces: Slack app routing, environment tokens, Supabase records, slash commands, and interactive buttons. We also had to design the system so it never exposes secrets or raw sensitive tool inputs.

Another challenge was making the product demo-ready even when different teammates owned different Slack apps and deployment settings.

Accomplishments that we're proud of

We are proud that Agent Firewall feels usable directly inside Slack. Security admins do not need a separate dashboard to understand what happened.

We built live audit logs, system status, per-agent health, compliance export, weekly reports, and cross-agent threat detection. The system also degrades gracefully when optional data, like baselines, is unavailable.

What we learned

We learned that AI agent security is not just about blocking one bad prompt. Things like observability, context, auditability, and human review all need to be considered

We also learned how important clean operational tooling is. A security product has to explain itself clearly, especially when admins need to trust a decision quickly.

What's next for Agent Firewall

Next, we want to complete the audit detail interaction, connect cross-agent conspiracy signals into the main risk scoring pipeline, improve admin approve/deny workflows, and add richer baseline learning for each agent.

Longer term, Agent Firewall could become a full security control plane for AI agents across Slack, internal tools, and enterprise workflows.