FLINT Gate: Transaction-Time Authorization for AI Agents

FLINT Gate is a semantic tripwire for FLINT Cross-Domain Agent Passports. It uses GPT-5.6 to enforce AI agent mandates before fraudulent actions, blocking illicit payments and secret exposure.

Comment

Inspiration

About FLINT Gate

AI agents are gaining the ability to browse the web, call tools, access APIs, and move money. The security problem is no longer limited to whether an agent has a valid identity. A valid agent can still be manipulated into taking an unauthorized action.

FLINT Gate is action-time authorization middleware for consequential AI-agent actions. It combines a cross-domain FLINT Agent Passport, deterministic authority controls, GPT-5.6 semantic-drift scoring, and signed production evidence.

Inspiration

In May 2026, adversarial instructions encoded in Morse code reportedly caused Grok to relay a financial instruction that drained 3 billion DRB from its Bankr-linked wallet. The incident demonstrated a critical failure mode: hostile content manipulated an AI system, and that manipulated system was able to convert the content into a financial action.

The threat extends beyond visible user messages.

An agent can encounter hostile instructions through:

  • malicious or compromised tool descriptions;
  • poisoned tool output;
  • another agent in a chained workflow;
  • off-screen or white-on-white webpage text;
  • HTML metadata invisible to human readers;
  • emails, PDFs, shared documents, and retrieved knowledge.

JFrog found 3 confirmed malicious MCP servers with 1,600 downloads. AgentSeal found toxic data flows in 555 of 5,125 scanned MCP servers. Google has also documented indirect prompt injections already present on the live web, including invisible instructions, attempted data theft, and destructive commands.

These incidents inspired the central idea behind FLINT Gate:

Do not rely on the manipulated model to determine whether its own action is authorized.

FLINT does not claim to prevent prompt injection. FLINT Gate prevents a manipulated agent from converting hostile instructions into an authorized consequential action when that action is routed through the Gate.

What it does

A developer starts with a plain-language mission:

Research 3 vendors. Spend no more than $50 total and $25 per purchase. Buy only from Acme. Never disclose credentials.

GPT-5.6 Sol converts that mission into a strict structured mandate containing:

  • a per-transaction spending cap;
  • a cumulative spending cap;
  • a seller allowlist;
  • an expiration time;
  • a currency;
  • prohibited actions.

Before every consequential action, FLINT Gate performs 3 stages of evaluation.

1. Deterministic authorization

FLINT Gate checks:

  • Passport validity and status;
  • mandate expiration;
  • per-transaction spending cap;
  • cumulative spending cap;
  • seller allowlist;
  • currency;
  • prohibited actions.

These controls are authoritative and can independently return BLOCK.

2. Semantic continuity

GPT-5.6 Sol compares the proposed action and the last 10 actions against the principal's original mission.

It returns a strict structured result:

{
  "drift_score": 0.97,
  "rationale": "The action introduces an unapproved seller, exceeds the spending mandate, and requests credential disclosure."
}
## What it does
Why the Agent Passport matters
A generic prompt-injection filter only asks whether content looks suspicious.
The cross-domain FLINT Agent Passport establishes:
which agent is acting;
who controls the agent;
what authority the agent currently carries;
whether that authority is active or quarantined;
the stable FLINT identity that follows the agent across integrated merchants, tools, APIs, and payment surfaces.
FLINT Gate adds the missing action-time question:
Even if this is a valid agent, is this specific action still faithful to the principal's authority right now?

The result is a layered control:
Passport: identity, controller, authority, and current status.
Gate: action-time deterministic and semantic authorization.
Signed record: evidence of what FLINT evaluated and decided before execution.
Gate does not replace or redesign the Passport. It makes the Passport enforceable at the consequential-action boundary.
## How we built it
FLINT Gate is a standalone TypeScript npm package with a CLI and scripted production demo.
The public package interface is:
import { FlintGate } from "flint-gate";

const gate = await FlintGate.fromMission(
  "Research 3 vendors. Spend no more than $50 total. Buy only from Acme.",
  {
    openaiKey: process.env.OPENAI_API_KEY,
    flintOptions: {
      agentId: "vendor-research-agent",
      principalHint: "acme-procurement"
    }
  }
);

const decision = await gate.check({
  tool: "purchase",
  seller: "acme",
  amount: 18,
  currency: "USD"
});
The CLI supports:
flint-gate mission "..."
flint-gate demo
The package uses:
GPT-5.6 Sol through the OpenAI Responses API;
strict JSON Schema Structured Outputs;
production FLINT Passport APIs;
production FLINT verification records;
Node.js built-ins;
the OpenAI JavaScript SDK;
TypeScript.

Codex accelerated the implementation by reading the live API contract, porting and hardening the proven authorization logic, building the npm surface and CLI, writing the tests, exercising GPT-5.6 against production, and documenting the entire decision trail in one Build Week session.

## Challenges we ran into

1. Keeping the model out of the authorization seat: Semantic analysis is useful, but probabilistic model output should not independently authorize financial activity. We designed the verdict composition so GPT-5.6 can only increase severity.

2. Failing closed without breaking legitimate actions: OpenAI failures, refusals, malformed output, Passport-resolution failures, evidence failures, and quarantine failures must never silently return ALLOW. We built explicit fail-closed handling and tests for these cases.

3. Working with the live production contract: The live FLINT API currently has no native Passport-freeze endpoint. We implemented quarantine using the documented mandate-update API by setting allowed actions to an empty list, the transaction maximum to 0, and a machine-readable frozen marker. Replay resolves that state from production.

4. Protecting sensitive content: Credential-like strings are redacted before crossing the semantic-analysis boundary. The model receives only the information required to evaluate action continuity.

5. Making a complex security model understandable in under 3 minutes: The final demo connects a real-world attack, concrete ingress paths, the cross-domain Passport, deterministic authorization, GPT-5.6, signed evidence, quarantine, and replay in one short terminal workflow.

## Accomplishments that we're proud of

We built the majority of FLINT Gate's core functionality in a single Codex session and delivered a working end-to-end developer tool, not a simulated concept.

We are especially proud that:

- FLINT Gate is a standalone TypeScript npm package with a documented import surface, CLI, built distribution, and judge-runnable demo.
- GPT-5.6 Sol is used meaningfully in 2 bounded roles: deriving structured mandates and detecting semantic drift across a sliding window of the last 10 actions.
- The model never independently authorizes an action. Deterministic limits remain authoritative, and GPT-5.6 can only increase verdict severity.
- Every returned decision calls FLINT's production verification API and produces signed evidence.
- The demo runs against production FLINT services, mints a real Agent Passport, and returns live verification-record URLs.
- An approved `$18` purchase returns `ALLOW`.
- A Grok-Bankr-style prompt-injection scenario returns `BLOCK` because of independent spending-cap, cumulative-cap, seller-allowlist, and semantic-drift findings.
- A blocked action automatically quarantines the cross-domain Agent Passport.
- Replaying the attack resolves the Passport's production state and remains deterministically blocked.
- The package enforces the exact public verdict vocabulary: `ALLOW`, `STEP-UP`, `REVIEW`, and `BLOCK`.
- Credential-like content is redacted before crossing the model boundary.
- OpenAI failures, malformed structured output, Passport failures, evidence failures, and quarantine failures all fail closed.
- The test suite passes 8 of 8 security and authorization checks.
- The package builds successfully, passes its npm package dry run, and can be executed without a manual rebuild.
- We preserved FLINT's launch-week stability by building in a separate repository and making no changes to the production FLINT application.
- We documented the architecture, claim boundaries, production limitations, test evidence, and decisions so that other engineers and agents can audit and continue the work.

Most importantly, we turned a real-world agent-wallet failure into a reusable developer control: identity establishes who the agent is, deterministic code controls its authority, GPT-5.6 detects behavioral drift, and FLINT provides signed evidence before value moves.

## What we learned
Agent Identity alone is not authorization.
Prompt-injection detection alone is not sufficient because hostile instructions can be obfuscated, hidden, or delivered by trusted-looking tools.
The safest architecture separates responsibilities:
the Passport establishes identity and authority;
deterministic code enforces hard limits;
GPT-5.6 detects semantic drift;
signed records create evidence;
persistent quarantine prevents replay.
The model contributes judgment. Code controls authority. FLINT records the decision.

## What's next for FLINT Gate: Action-Time Authorization for AI Agents
What is next
The next extensions are:
a documented native Passport-freeze API;
durable cumulative-spend accounting across processes;
adapters for MCP tools, agent frameworks, payment APIs, and x402;
policy templates for procurement, paid APIs, stablecoin payments, and delegated commerce;
a review console for STEP-UP and REVIEW decisions;
behavioral continuity across merchants and agent runtimes.

Built With

  • agent-identity
  • agent-security
  • ai-agents
  • authorization
  • cli
  • codex
  • cryptography
  • developer-tools
  • fintech
  • flint-cross-domain-agent-passport
  • gpt-5.6
  • javascript
  • json-schema
  • jws
  • mcp-security
  • node.js
  • npm
  • openai
  • prompt-injection
  • reponses-api
  • rest-api
  • signed-verification-records
  • stablecoins
  • structured-outputs
  • typescript
Share this project:

Updates