ClaimGate

• 

  ClaimGate landing page — AI action authorization before irreversible execution.

• 

  Operational dashboard for workflows, approvals, audit activity, and integration health.

• 

  Real document verification with claims, evidence, deterministic policy, and human approval.

Inspiration

AI agents are increasingly capable of generating documents, making decisions, and calling external APIs. But there is a major difference between letting an agent draft something and letting it perform an irreversible action.

A contract can be generated correctly 99 times and still cause real damage on the 100th if a price, date, counterparty, or obligation is wrong and the agent is also allowed to send it for signature.

ClaimGate started from one simple principle:

AI can propose. It should not be able to authorize itself.

For the Foxit challenge, document signing became the first irreversible action we wanted to protect.

What it does

ClaimGate is an AI Action Authorization Platform.

A user can upload a real PDF and provide trusted evidence such as approved commercial terms, purchase orders, statements of work, or internal records.

ClaimGate then:

1. Extracts the actual document content using Foxit.
2. Uses structured AI analysis to identify material claims such as parties, money, quantities, dates, scope, and deliverables.
3. Compares those claims against trusted evidence.
4. Validates exact evidence quotations instead of trusting model-generated citations.
5. Runs a deterministic policy engine that makes the final authorization decision.
6. Either blocks the action or moves it to explicit human approval.
7. Only after human approval can the backend reach Foxit eSign.

The AI model never receives signing credentials and never decides whether an action is authorized.

Real verification flow

A matching agreement can reach:

READY FOR HUMAN APPROVAL

A conflicting agreement is stopped before execution.

For example:

• Document amount: USD 12,500
• Authoritative evidence: USD 15,000
• Semantic result: CONFLICTING
• Deterministic result: SIGNING BLOCKED

The conflict is shown directly to the reviewer, and no approval or signing capability becomes available.

How we built it

ClaimGate is built around a strict separation between AI reasoning and authorization.

The main flow is:

Uploaded PDF → Foxit extraction → structured semantic analysis → Evidence Graph → deterministic policy → human approval → backend-only Foxit eSign

The backend is built with FastAPI.

Foxit is used for the real document pipeline, including PDF processing and extraction of the exact artifact being reviewed.

OpenAI structured outputs are used for claim extraction and evidence comparison. The model has no tools and cannot modify workflow state, policy, approval, or execution capability.

The final PASS/BLOCK decision is made by deterministic application code rather than by the language model.

Evidence Graph

Instead of showing only a single AI answer, ClaimGate preserves the relationship between claims and their evidence.

A material claim can have:

• supporting sources
• conflicting sources
• uncertain sources
• source authority classifications
• exact validated quotations

This makes the decision explainable to a human reviewer.

Policy-as-Code

ClaimGate supports deterministic risk profiles.

Examples include:

• Standard Contract
• Financial High Risk
• Procurement Strict
• Public Evidence Strict

A profile may make authorization stricter, but it cannot override a block from the baseline safety policy.

The effective rule is:

Baseline Policy AND Selected Policy Profile = Final Authorization

Human approval

Approval is bound to the exact verified state.

ClaimGate binds approval to values including:

• PDF SHA-256
• evidence SHA-256
• baseline policy version
• policy profile ID and hash
• proposed action hash

If the PDF, evidence, policy, target, or other protected action parameters change after approval, that approval becomes invalid.

This prevents approving one thing and executing another.

Decision Receipts and Replay

Every completed verification can produce a canonical Decision Receipt.

The receipt records what was evaluated, which evidence was used, which policy was applied, the final decision, and the hashes protecting the run.

ClaimGate can later replay the historical verification without asking an AI model to reinterpret the original decision.

Replay can distinguish between:

• receipt tampering
• PDF drift
• evidence drift
• policy drift
• broken receipt chains

Security Validation Suite

We also built adversarial tests directly into ClaimGate.

Examples include:

• prompt injection inside evidence
• invented evidence quotations
• unknown evidence references
• authoritative conflicts
• PDF tampering after verification
• evidence tampering
• policy tampering
• replayed approvals
• duplicate send attempts
• receipt tampering
• action parameter changes
• execution capability escalation

The important security claim is not that ClaimGate magically detects every prompt injection.

Instead, untrusted content is architecturally prevented from directly controlling policy, approval, workflow state, or signing capability.

Public evidence

ClaimGate includes a controlled public-evidence provider abstraction, with support for integrating SerpApi for eligible public claims.

Public search results remain untrusted evidence and can never promote themselves to internal authoritative sources.

Historical replay uses the evidence snapshot that existed when the decision was made instead of silently performing a new web search.

Challenges we ran into

One of the hardest problems was defining where the AI should stop.

It would have been much easier to let the model output a final PASS or BLOCK, but that would make the system difficult to trust.

We instead separated:

• semantic interpretation
• evidence validation
• policy evaluation
• human authorization
• external execution

We also had to make sure that the exact PDF reviewed by ClaimGate was the same artifact being approved, which led to artifact hashing and approval binding.

Another challenge was integrating live document processing while keeping signing completely outside the agent boundary.

Accomplishments that we're proud of

• Real arbitrary PDF uploads work through the product UI.
• Foxit performs live extraction on the uploaded artifact.
• Live structured AI analysis handles arbitrary documents rather than only scripted presets.
• Matching documents reach human approval.
• Conflicting critical claims are deterministically blocked.
• Exact evidence quotations are programmatically validated.
• Approval is bound to the artifact, evidence, policy, and action.
• Decision Receipts and historical replay provide tamper-evident auditability.
• Security validation covers adversarial and tampering scenarios.
• The agent never receives eSign credentials or signing capability.

What we learned

The biggest lesson was that reliable agent systems need a boundary between reasoning and authority.

Language models are useful for understanding messy documents and evidence, but authorization should be governed by deterministic rules, trusted evidence, explicit capabilities, and humans when the action is consequential.

What's next

ClaimGate already proves the core authorization model end to end:

• real document upload
• Foxit extraction
• live semantic verification
• deterministic policy enforcement
• artifact-bound human approval
• Decision Receipts and replay
• backend-only execution boundaries

The next stage is productization and scale.

That includes persistent workflow storage, production identity, multi-tenant workspaces, RBAC, approval chains, background workers, additional trusted evidence connectors, and more irreversible-action adapters.

For the hackathon build, we kept the frontend intentionally lightweight and focused engineering effort on the authorization model, security boundaries, and live integrations. The backend/API boundaries are designed so the interface can evolve independently as the product scales, including a future React/Next.js frontend if that becomes useful.

The long-term goal is simple:

Put a verifiable authorization boundary between AI agents and irreversible actions.

Built With

• css
• fastapi
• foxit-esign-api
• foxit-pdf-api
• html
• javascript
• jinja
• openai-api
• pydantic
• pytest
• python
• serpapi