Escrow

Inspiration

I grade for CMPSC 463 and spend hours on regrade requests, extension emails, and grade disputes, which is exactly what an always-on AI TA could handle. But a TA assistant sits on a gradebook full of FERPA-protected records and reads untrusted student email. One prompt-injected email ("what's the class score distribution?") and it can leak another student's grade. Worse, it can leak it in pieces across steps, so no single tool call looks wrong. Per-call guardrails can't see that.

What it does

A private, always-on TA assistant that runs in NVIDIA NemoClaw. It has persistent course-policy memory and reusable skills for regrade, extension and grade-dispute requests. It is built so that your students' data stays under your control.

Escrow is how it stays private. Every side effect the assistant attempts is held, not executed.

Escrow builds on the semantic-transaction model from Cordon (Chen & Dong, arXiv:2606.17573): hold effects, validate the whole task, then commit. My contribution is bringing it to NemoClaw, where OpenShell's egress lockdown makes the sender the only non-inference exit, so a hook bypass can't leak data on its own. I also add tiered Nemotron verification for paraphrased cross-step leaks and FERPA-aligned policy for a real TA workflow.

1. Task contract: Nemotron Ultra drafts what the assistant may read and do. You approve it before the run.
2. Shadow execution: The assistant works against a shadow filesystem and an effect outbox. Nothing touches the real world mid-run.
3. Session-level verification: At commit, Escrow checks the whole session against FERPA-aligned rules: exact-match and canaries, then fingerprints, then Nemotron Super judging paraphrased leaks.
4. Locked-down egress: The sandbox can reach only Nebius Token Factory. The only other exit is a host-side sender that ships verified effects only.

The only non-inference exit is verified, and inference goes only to Nebius as the processor.

How I built it

• Runtime: NemoClaw/OpenShell, with an OpenClaw before_tool_call plugin intercepting every tool call. All inference goes through Nebius Token Factory, behind a host-side proxy that holds the key and caps spend.
• Core: transaction manager, app-level shadow FS, effect outbox (following Cordon's architecture), plus a host-side sender.
• Nemotron 3 on Token Factory: Ultra writes contracts and attack scenarios (serious reasoning, once per task); Super judges paraphrase leaks over long session context; Nano labels every record read (high volume, fast). Token Factory let me pick a model size per job behind one OpenAI-compatible API, which kept the pipeline fast and within credits.
• Policy: FERPA-aligned rules. Course staff with a legitimate educational interest may see records; other students may not; sensitive personal circumstances are never shared.
• Evaluation: 42 canary scenarios (labels known by construction) plus a 200-task live run, per-call filter baseline vs. Escrow.
• UI: React, React Flow + canvas particles, Framer Motion. The hosted demo replays real recorded runs from the live pipeline; live runs are available on request.

Results

Escrow removed every leak without adding a single false block. (Its judge had 1/81 false blocks before a prompt fix on the same eval set; I report that openly.) Small sample: the 95% upper bound on Escrow's true leak rate on live runs is about 12%. Deterministic tiers run in under 1 ms median. Killer scenario: an injected email gets the assistant to paraphrase another student's score across steps. Every per-call check passes; Escrow blocks it at commit.

Challenges I ran into

• Proving egress lockdown: verifying that the agent's direct HTTP calls and DNS lookups actually fail.
• Cross-step paraphrase leaks: there's no fixed string to match, so I built a tiered verifier: cheap deterministic checks first, the LLM judge only when needed.
• Calibrating Super: blocking leaks without blocking legitimate TA work.
• Staying in budget: the whole pipeline had to fit within Token Factory credits.

What I learned

• Cordon's framing holds up in practice: agent safety is a transaction problem, not a filtering problem. Hold effects, verify the session, then commit.
• Deterministic checks under model judgment give guarantees where possible and coverage where not.
• Being explicit about limits builds trust. I attack my own system on camera. One known limit remains: a leak split across separate sessions passes, because each session is verified alone.

What's next

• Cross-session verification to close the known limit
• Policy packs beyond FERPA, such as HIPAA and internal company data
• Adversarially generated paraphrase test sets from Ultra
• A consented pilot with real TAs
• A drop-in Escrow plugin for any OpenClaw/NemoClaw agent

Built With

• ai-agents
• canvas
• claude-code
• cloudflare-tunnel
• docker
• framer-motion
• nebius
• nebius-token-factory
• nemoclaw
• nemotron
• nemotron-nano
• nemotron-super
• nemotron-ultra
• node.js
• nvidia
• openclaw
• openshell
• react
• react-flow
• typescript
• vercel
• websockets
• wsl2