ContractGuard

Zero-trust security gateway & runtime reference monitor protecting AI agents from prompt injection, powered by NVIDIA Nemotron on Nebius Token Factory.

Comment

ContractGuard-X — Making Autonomous AI Agents Secure by Design

The Problem

AI agents are becoming increasingly powerful. They can interact with APIs, execute code, access databases, process financial transactions, and automate critical business operations.

However, giving AI agents access to tools also introduces serious security risks.

One of the most dangerous threats is Indirect Prompt Injection. Malicious instructions can be hidden inside emails, documents, web pages, and external data sources. An AI agent may interpret these instructions as legitimate commands and perform unauthorized actions.

Traditional guardrails often focus on filtering harmful text rather than verifying whether an agent actually has the authority to perform a specific action.

We wanted to address this fundamental security gap.

Our Solution

ContractGuard-X is a dual-end Zero-Trust security gateway designed to protect autonomous AI agents throughout their lifecycle.

It introduces two interconnected security layers:

1. Developer End — Autonomous AI Policy Engineering

ContractGuard-X analyzes agent tool definitions and helps developers generate structured security contracts.

Powered by NVIDIA Nemotron models through Nebius Token Factory, the policy engineering workflow helps developers:

  • Analyze tool schemas and function signatures.
  • Conduct intelligent security interviews.
  • Generate typed security policies in YAML.
  • Validate policies using deterministic static checks.
  • Require explicit developer approval before policies become active.

2. Runtime End — Zero-Trust Security Enforcement

Once a policy is approved, ContractGuard-X protects agent actions through a runtime reference monitor.

Its security mechanisms include:

  • Provenance-Aware Detection: Tracks whether information originates from trusted or untrusted sources.
  • Parameter Evidence Binding: Prevents malicious external content from changing sensitive tool parameters.
  • Task-Conditioned Evidence & Authority Verification (TCEAV): Checks whether proposed actions are supported by sufficient evidence and authorized for the current task.
  • Cumulative Effect Ledger: Tracks committed, pending, and proposed effects to prevent multi-step budget exhaustion.
  • Output Guard: Detects and blocks unauthorized data-exfiltration channels in generated content.

Key Features

  • Autonomous AI-assisted security policy generation.
  • Zero-Trust runtime reference monitoring.
  • Indirect prompt injection defense.
  • Parameter-level evidence and authority verification.
  • Cumulative transaction and resource budget enforcement.
  • Tool permission boundaries and access control.
  • Security simulations and adversarial testing.
  • Python SDK with a simple @guarded_tool integration.
  • Interactive Web Studio for policy management, gateway testing, simulations, benchmarks, and SDK documentation.

Technology Stack

AI & Models

  • NVIDIA Llama-3.1-Nemotron-70B-Instruct
  • NVIDIA Nemotron-Mini-4B-Instruct
  • Nebius Token Factory

Frontend

  • Next.js 14
  • React 18
  • TypeScript
  • Tailwind CSS

Backend

  • Python
  • FastAPI
  • SQLAlchemy
  • Pydantic

Database & Security

  • PostgreSQL
  • SQLite fallback
  • YAML policy contracts
  • HMAC-SHA256 policy signing
  • Python SDK

How We Built It

We developed ContractGuard-X as a complete security architecture rather than relying on a single AI classifier.

The development process involved designing a two-end architecture, implementing the policy compiler, developing provenance-aware detection, building the TCEAV verification engine, and introducing a stateful effect ledger.

We integrated NVIDIA Nemotron models through Nebius Token Factory for AI-assisted policy engineering and selective semantic verification.

We also developed a Python SDK so developers can protect their existing agent tools without completely redesigning their applications.

The Next.js Web Studio provides an interactive interface for exploring policies, testing runtime protection, running attack simulations, and reviewing security results.

Challenges We Faced

One of our biggest challenges was distinguishing between reading untrusted information and acting on instructions contained within that information.

We needed a mechanism that would allow agents to process external content while preventing that content from gaining unauthorized control over sensitive actions.

Another challenge was detecting attacks that happen across multiple interactions rather than within a single request. We addressed this through a cumulative effect ledger that tracks resource consumption across a session.

We also worked on handling encoded and obfuscated payloads, authentication bypass attempts, concurrency issues, and unauthorized information disclosure.

Integrating AI reasoning with deterministic security enforcement was another important engineering challenge. We designed the system so that AI-generated policies are validated and require explicit developer approval, while critical runtime authorization decisions are enforced through deterministic checks.

What We Learned

Building ContractGuard-X strengthened our understanding of:

  • AI agent security and indirect prompt injection.
  • Zero-Trust architecture and reference monitoring.
  • Information-flow control and data provenance.
  • Policy engineering and least-privilege access.
  • Stateful authorization and cumulative effect tracking.
  • Integrating open-source NVIDIA models through Nebius Token Factory.
  • Building and testing full-stack AI security applications.

Testing & Validation

The project includes an extensive automated verification suite.

Our documented verification results include:

  • 366/366 automated Python tests passing.
  • 8/8 oracle benchmark suites passing.
  • 5/5 sample protected agent applications passing.
  • Successful frontend TypeScript checks and production build.

These results reflect the project's documented test environment and verification suite.

Our Vision

We believe AI agents should not simply be intelligent. They should also be accountable, constrained, and secure.

ContractGuard-X aims to make robust security enforcement accessible to developers building the next generation of autonomous AI systems.

Don't just trust your AI agents. Verify their authority.

ContractGuard-X — Security by Contract. Trust through Verification.

Built With

Share this project:

Updates

Submission history