Inspiration

AI agents are becoming increasingly capable of planning tasks, accessing information, and interacting with tools. But as they gain more autonomy, one question becomes increasingly important: Who decides what an AI agent is actually allowed to do?

We wanted to build something that addresses this problem without sacrificing the usefulness of AI agents.

That's how Ghost Protocol started: a personal AI system built around a simple principle AI proposes. Humans authorize. Every decision leaves evidence.

Instead of treating safety as an afterthought, we made it part of the agent's core workflow.

What it does

Ghost Protocol is a human-controlled personal AI agent that separates AI-generated plans from actual authorization and execution.

A user creates a task, and the agent generates a structured proposal. Before any protected action can proceed, a deterministic authorization layer evaluates the request. Actions requiring human consent are paused for explicit review.

Users can inspect the requested action, approve or reject it, revoke permissions, and review the resulting audit history.

The system also supports safe continuation, durable task records, operation history, and explicit stopped states. Approval alone never automatically executes a protected operation.

Our interactive public demo lets users experience this entire decision-making workflow using clearly labeled synthetic data.

Try it: https://ghost-protocol-demo.pages.dev

How we built it

We developed Ghost Protocol using a modular architecture that separates AI reasoning, authorization, application services, and the user interface.

AI and orchestration: We integrated NVIDIA Nemotron 3 Super through Nebius Token Factory and used LangGraph to structure agent planning. We verified genuine model responses through the Nebius API and implemented structured-output validation.

Backend: We used Python, FastAPI, Pydantic, SQLAlchemy, and database-backed application services for task management, authorization workflows, approval records, and audit history.

Security: A deterministic policy layer evaluates proposed operations independently of the language model. Human approvals, revocations, and continuation are handled through explicit application controls.

Frontend: We built a responsive TypeScript and React interface with a visual Decision Rail showing each stage of an agent's workflow, from task creation to authorization, human review, and recorded outcomes.

Isolation research: We also investigated NVIDIA OpenShell for sandboxed agent execution and validated gateway connectivity and TLS behavior. Full native sandbox enforcement remains future work rather than a verified production capability.

For public accessibility, we deployed a separate, isolated interactive demonstration using Cloudflare Pages. It reproduces the core user experience with synthetic data and does not expose private credentials or protected backend services.

Challenges we ran into

One of our biggest challenges was ensuring that AI planning could never be mistaken for authorization.

We had to carefully separate proposed actions, policy decisions, human consent, and execution. Handling approval expiration, revocation, interrupted workflows, and uncertain outcomes required particular attention.

Integrating and evaluating OpenShell on a Windows/WSL2 development environment also introduced compatibility, networking, and resource constraints.

Another challenge was making the application publicly accessible without exposing trusted backend services. We addressed this by building a standalone synthetic demo while preserving the real backend implementation and its security boundaries.

Accomplishments that we're proud of

Built a complete human-in-the-loop agent workflow with explicit approval and revocation controls.

Integrated LangGraph with NVIDIA Nemotron through Nebius Token Factory.

Verified four genuine Nemotron 3 Super inference responses.

Implemented durable task, authorization, operation-history, and audit interfaces.

Built and deployed a polished, responsive interactive public demo.

Open-sourced the project under the MIT License.

Verified the hosted demo across Chromium, Firefox, and WebKit, with 54 hosted tests passing.

Most importantly, we demonstrated that useful AI agent workflows can be designed around human control and inspectable decisions.

What we learned

This project taught us that building an AI agent is not just about connecting a language model to tools.

The difficult engineering problems involve authorization, state management, error recovery, auditability, and defining what should happen when the system is uncertain.

We also learned how to integrate NVIDIA models through Nebius Token Factory, build structured LangGraph workflows, implement secure application boundaries, and validate a complete frontend-to-backend experience.

What's next for Ghost Protocol

Our next goals are to expand the personal assistant's capabilities with persistent memory, reusable skills, and additional user-approved integrations.

We also plan to continue native OpenShell sandbox qualification, improve deployment reproducibility, and extend the agent's ability to assist with everyday tasks while maintaining strict human authorization.

Our long-term vision is a personal AI agent that becomes more useful over time without taking control away from its user.

AI proposes. Humans authorize. Every decision leaves evidence.

GitHub: https://github.com/SomanshuK-Founder/ghost-protocol

Interactive Demo: https://ghost-protocol-demo.pages.dev