Fortified Enterprise Agent Fleet: Zero-Trust Firewall

A zero-trust scope attenuation firewall, dynamic blast-radius evaluator, and cryptographic HMAC provenance control plane for autonomous multi-agent systems.

Comment

Inspiration

As enterprise organizations scale autonomous AI agents, multi-agent delegation becomes essential. But existing architectures suffer from three critical gaps: sub-agents often inherit broad ambient permissions instead of least-privilege access, compounding risk goes untracked as tasks flow through multiple hops, and standard logging can't stop a compromised agent from quietly editing its own history. We wanted to make that risk transparent, enforceable, and tamper-evident — not just documented.

What it does

The Fortified Enterprise Fleet acts as an active zero-trust control plane sitting between an orchestrator and its worker agents:

  • Scope Attenuation — permissions can only narrow down a delegation chain (child scope = requested ∩ caller's scope ∩ agent's declared ceiling), never widen.
  • Blast-Radius Firewall — computes a live risk score before any action executes and blocks over-scoped requests before they reach an agent.
  • Gemma Pre-Firewall Triage — a second, independent Google model screens every request's raw content for prompt-injection intent, before the scope check even runs.
  • Cryptographic HMAC Provenance — every delegation, allowed or blocked, is HMAC-SHA256 signed into an append-only audit trail (Cloud Firestore).
  • Autonomous Gemini 3.5 Planner — decomposes an open-ended enterprise goal into subtasks and negotiates least-privilege scopes for each one.
  • Interactive dashboard — live topology graph, an Attack Studio to trigger real privilege-escalation/tampering/injection attempts, and a cryptographic audit log explorer.

How we built it

  • Gemini 3.5 + Google ADK for planning, text-to-SQL, report synthesis, and security evaluation.
  • Gemma, reached through the same client, dedicated solely to prompt-injection triage — kept independent so a compromised planner prompt can't also disable the content classifier.
  • Google Cloud Run — the orchestrator and 4 worker agents each run as their own isolated microservice, invoked over authenticated HTTPS.
  • Google Cloud IAM — a dedicated least-privilege service account per agent (e.g. the database agent can only read Cloud SQL; the report agent can only write Firestore).
  • Cloud Firestore for the tamper-evident audit trail; Cloud Build for the container pipeline.
  • A vanilla HTML/CSS/JS dashboard with a live SVG topology visualizer — zero build step.

Challenges we ran into

  • Getting scope math right across arbitrary-depth delegation chains, so a hop can never gain more than its caller held.
  • Making the codebase run identically offline (zero GCP dependency, mock mode) and as a genuine 5-service Cloud Run deployment — several real deployment bugs surfaced only once we actually shipped it: a broken Python import path inside the container, a fire-and-forget bus that silently wasn't returning real agent results, and default IAM permissions a brand-new GCP project doesn't grant out of the box.
  • Designing a visual attack simulator that makes an abstract security guarantee ("scope can't widen") visible and clickable, not just asserted in a README.

Accomplishments that we're proud of

  • A production-shaped governance firewall with 20/20 passing automated tests.
  • An Attack Studio that live-demonstrates mitigation of privilege escalation, cross-hop scope widening, audit log tampering, and prompt injection — caught at two independent layers (Gemma content triage, then agent-level sanitization).
  • A tamper-evident audit log with instant cryptographic verification.
  • A real, working 5-service deployment on Google Cloud Run — not just a local demo.

What we learned

  • How to structure true defense-in-depth: firewall interceptor → worker runtime validation → Cloud IAM service account boundaries — each layer independent, so no single point of failure disables the others.
  • The value of pairing Gemini's autonomous planning with deterministic, mathematically checkable scope boundaries: autonomy and safety aren't in tension when the safety layer doesn't depend on the model behaving.

What's next

  • Dynamic IAM token minting via GCP Workload Identity for short-lived, per-subtask scoped credentials.
  • Asymmetric Ed25519 signing for decentralized, per-agent provenance verification.
  • Extending the scope firewall to govern multi-organization agent federation.

Built With

Share this project:

Updates

Submission history