Gatekeeper

the guard before the world

Comment

GATEKEEPER — An autonomous subscription watchdog with bounded autonomy.

WHAT IT DOES Gatekeeper finds the money you're quietly losing — duplicate charges, price hikes, trials that silently convert to paid, memberships you stopped using — and handles them end to end. It runs in the background and only surfaces when there's a real decision to make.

WHO IT'S FOR Everyday people drowning in subscription waste (the Everyday Agents track), and anyone who wants an agent that touches money without needing to watch it constantly.

WHY IT MATTERS Agents that touch money fail on trust, not capability. The missing piece isn't smarter models — it's enforceable authorization. Every action Gatekeeper takes passes through a safety protocol: binding check, kill switch, scope whitelist, budget limit, approval gate. The agent can only act on whitelisted merchant domains via three action types, has a $50 budget cap, and disputes or outbound messages are held for human sign-off. There is no bypass path — the agent's tools ARE the protocol. Two cancellations execute autonomously; two actions wait for a human; every event is logged to a tamper-evident audit trail. Identified savings in the demo: $62.49/month.

HOW IT WORKS Built on the Strands Agents SDK. The scanner agent reads a bank feed and inbox, flags anomalies, and emits ActionRequests. Each request is evaluated by the open-source safety-protocol library before any execution. In-scope cancellations run automatically; disputes and outbound comms are held at an approval gate the human clears from a self-explaining dashboard. The same enforcement layer generalizes to any high-stakes agent domain — health, legal, procurement.

STACK Strands Agents SDK (@tool actions) · Amazon Bedrock (Nova Lite) decision model, with a deterministic rules-engine fallback that produces identical output · safety-protocol enforcement library · single-file HTML dashboard.

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Gatekeeper

Built With

Share this project:

Updates

posted an update —

Gatekeeper: What Happens When Your Agent Touches Money (Agents for Humans) Build story for the AWS Agents for Humans Hackathon — built with the Strands Agents SDK.

The uncomfortable question Every demo of an autonomous agent doing real-world tasks eventually hits the same wall: what happens when it needs to spend money? Cancel a subscription? Dispute a charge? Email someone on your behalf?

The usual answers are "human reviews everything" (which defeats autonomy) or "trust the model" (which is how you end up with an agent emailing your bank). We wanted neither. So we built Gatekeeper.

What we built Gatekeeper is an autonomous subscription watchdog. It reads your bank feed and inbox, finds the money you're quietly losing — duplicate charges, price hikes, trials that silently converted, memberships you stopped using — and handles them end to end.

The interesting part isn't the finding. It's the enforcement layer between the LLM and every action:

binding check → kill switch → scope whitelist → budget limit → approval gate → execute Every action the agent takes is an ActionRequest that must pass this pipeline. The agent can only act on whitelisted merchant domains, via three action types. It has a $50 budget cap. Disputes and outbound communications are held for human sign-off — the agent pings you only when there's a real decision to make. Everything lands in a tamper-evident audit trail.

There is no bypass path. The agent's tools ARE the protocol — un-gated actions literally don't exist in its toolset.

How Strands made this natural The Strands Agents SDK's @tool decorator turned out to be the perfect seam for policy injection. Because every capability is an explicit tool, wrapping each one in protocol enforcement was clean — no monkey-patching, no framework fights:

@tool def dispute_charge(merchant: str, domain: str, amount: float, reason: str) -> str: """Dispute a charge with the merchant's billing department.""" result = protocol.execute(ActionRequest( action_type="dispute_charge", target=domain, params={"merchant": merchant, "reason": reason}, estimated_cost=amount, )) return format_gate_result(result) The protocol decides: ALLOWED, BLOCKED_*, or PENDING_APPROVAL with a token. The agent sees the same interface either way — it just learns some actions come back "held," which is exactly the real-world behavior we want it to internalize.

What a run looks like Seeded demo feeds produce four findings:

Gym membership unused since March → auto-cancelled ($45/mo saved) Trial converting to paid → auto-cancelled ($7.99/mo saved) Netflix charged twice in 10 days → held at the approval gate Comcast rate hike $12→$21.50 → held, negotiation email drafted Two executed autonomously. Two waited for a human. Total identified savings: $62.49/month. After approval, one click on the dashboard, logged to the audit trail with who decided, what, and when.

Why this matters beyond subscriptions Agents that touch money fail on trust, not capability. The pattern here — explicit scope, hard budgets, approval gates, auditable decisions — generalizes to any domain where an agent's mistake costs something real: health admin, legal paperwork, procurement.

Bounded autonomy isn't a constraint on agents. It's the missing deployment requirement.

Try it Repo: https://github.com/TheDub-lab/gatekeeper · MIT licensed · built with the Strands Agents SDK and the open-source safety-protocol library.

Log in or sign up for Devpost to join the conversation.

Submission history