CleanRoom-Passport

Inspiration

When enterprise employees deploy AI agents to collaborate with external corporate partners (e.g., during M&A due diligence, B2B procurement, or external financial audits), they face a fundamental security dilemma. Traditional API keys grant broad access to corporate drives and databases, exposing organizations to context leakage, NDA breaches, and indirect prompt injection attacks.

We were inspired by Egoist Machines' AI Passport philosophy—the principle that personal and corporate data, memory, and credentials should remain user-owned, private by default, and portable across AI models without being harvested by third-party systems. We set out to build a "clean room" delegation protocol that allows agents to collaborate safely across company boundaries.

What it does

CleanRoom-Passport acts as a privacy-preserving security gateway for cross-organizational AI agent workflows.

• Local File Isolation: Raw enterprise files remain stored locally on-device in an embedded vector database (Egoist Machines' LodeDB).
• Task-Scoped Context Extraction: When an external agent requests data, CleanRoom-Passport extracts only the specific vector sub-embeddings needed for that task and packages them into a cryptographically signed CleanRoomPassportToken.
• Monotonic Authority Narrowing: Sub-agent permissions are bounded by $P_{\text{subagent}} = P_{\text{user}} \cap P_{\text{task}}$, automatically stripping out unauthorized privilege escalation requests.
• Prompt Injection Defense: An integrated Security Sanitizer inspects query arguments and context snippets to detect and redact system overrides or exfiltration commands before execution.
• Approval Inbox & Kill Switch: Users approve pending passport requests via an Approval Inbox and can trigger a One-Click Revocation Kill Switch at any time to instantly block downstream sub-agent access across external Model Context Protocol (MCP) gateways.

How we built it

We implemented a modular Python architecture consisting of six core modules:

• crypto_engine.py: Implements RFC 8785 JSON Canonicalization Scheme (JCS) and HMAC-SHA256 signature verification to issue tamper-proof tokens and audit receipts.
• lodedb_emulator.py: Emulates LodeDB in-process vector storage and cosine similarity search for local-first sub-context retrieval.
• authority.py: Calculates the mathematical intersection between user privileges and requested task scopes to enforce monotonic narrowing.
• passport_vault.py: Manages the user Approval Inbox, session registries, signed ActionReceipt audit logs, and real-time revocation handling.
• security_sanitizer.py: Inspects input text using pattern matching to identify and sanitize indirect prompt injection threats.
• mcp_gateway.py: Serves as the tool proxy, validating passport headers and scopes before executing tool requests.

Challenges we ran into

• Canonicalization Consistency: Implementing RFC 8785 JSON Canonicalization Scheme (JCS) in pure Python to ensure signature verification remains consistent across different system environments.
• Balancing Minimization with Context Sufficiency: Tuning sub-context extraction to retrieve sufficient detail for queries while strictly excluding out-of-scope enterprise documents.
• Delegation Chain Validation: Designing logic to evaluate multi-level delegation chains (User $\rightarrow$ Agent A $\rightarrow$ Sub-Agent B) so that authority narrows monotonically at every tier.

Accomplishments that we're proud of

• Built a functional backend prototype that integrates local vector RAG, cryptographic signing, and MCP tool gating.
• Developed an automated test suite verifying five security invariants (signature tamper defense, scope narrowing, context isolation, revocation blocking, and prompt injection sanitization).
• Designed the system with zero external package dependencies, using standard Python libraries to maximize portability.

What we learned

• Practical application of the Agent Passport System (APS) protocol for structuring cryptographic identities and signed receipts for AI agents.
• Local-first context retrieval concepts using embedded vector indexing inspired by LodeDB.
• Strategies for mitigating indirect prompt injection hazards by sanitizing tool inputs before they enter LLM context windows.

What's next for CleanRoom-Passport

• Graphical User Interface: Building a desktop dashboard (e.g., via Electron or Tauri) for visual Approval Inbox management and live session tracking.
• Asymmetric Cryptography: Upgrading token signatures to native Ed25519 key pairs for public-key verification.
• Framework Integrations: Expanding transport wrappers to support agent frameworks like LangChain, CrewAI, and AutoGen over standard MCP transports.

Built With

• agent-security
• agentic-ai
• ai-passport
• b2b-automation
• decentralized-identity
• lodedb
• mcp
• model-context-protocol
• privacy-first