GradientHarbor

A security-focused AI analytics platform combining guarded SQL execution, verifiable evidence, vulnerability scanning, and intelligent AI-agent defenses.

Comment

GradientHarbor — Secure AI Analytics and Agent Defense Platform

  1. Inspiration

As AI agents become increasingly integrated into business analytics and enterprise workflows, security challenges are becoming more important. AI-generated SQL queries, untrusted documents, prompt injection attacks, unauthorized tool execution and data integrity concerns can create significant risks.

I wanted to build a platform that brings business intelligence and AI security together instead of treating them as separate problems.

This led to GradientHarbor: a security-focused AI analytics platform designed to make data analysis more controlled, transparent and verifiable.

  1. What GradientHarbor Does

GradientHarbor combines business intelligence, AI agent workflows, evidence retrieval, cryptographic integrity and data security investigation in one application.

Business Intelligence Command Center

  • Interactive business analytics dashboard.
  • Revenue, profit, transaction and sales performance indicators.
  • Dynamic city, category and date filters.
  • Interactive Plotly visualizations and dataset exploration.
  • CSV export functionality.

AI Multi-Agent Analytics

  • A structured workflow involving planning, SQL analysis, answer synthesis and independent verification.
  • LangChain-based model integration.
  • Natural-language business questions translated into analytical SQL.
  • SQLGlot-based read-only query validation.
  • SQLite authorizer and isolated in-memory query execution.
  • Execution traces and workflow metrics.

Evidence Vault

  • Local knowledge-base ingestion and TF-IDF evidence retrieval.
  • SHA-256 document fingerprinting.
  • Ed25519 digital signatures.
  • Optional Fernet encryption for documents at rest.
  • Evidence verification and integrity checks.

AI Security and Agent Defense Center

  • Prompt injection and jailbreak screening.
  • Untrusted-content filtering.
  • Default-deny tool authorization.
  • Agent handoff inspection.
  • Read-only SQL execution boundaries.
  • Secret-shaped output screening.
  • AI safety and agent observability metrics.

Vulnerability Investigation and Data Source Security

  • CSV, XLSX and XLSM security analysis.
  • Data quality and suspicious-content indicators.
  • SQL script security inspection.
  • Read-only database inspection for supported MySQL, PostgreSQL, SQLite and MongoDB sources.
  • Vulnerability reports and signed integrity baselines.
  • Optional YARA artifact scanning.

Multimodal Security Studio

  • Encrypted image, audio and video storage.
  • Local SmolVLM image understanding when optional dependencies are installed.
  • Optional Whisper-based audio transcription.
  • Video-frame extraction and analysis.
  • Optional diffusion-based image generation.
  1. How We Built It

GradientHarbor was developed using Python and Streamlit, with a modular architecture separating analytics, AI workflows, evidence retrieval, security controls and observability.

The primary technologies include:

  • Python and Streamlit for the application interface.
  • LangChain and an OpenAI-compatible model adapter for AI workflow orchestration.
  • Pandas and SQLite for data analysis.
  • SQLGlot for SQL policy validation.
  • Scikit-learn for TF-IDF retrieval.
  • Plotly for interactive analytics.
  • Cryptography for SHA-256, Ed25519 and Fernet-based operations.
  • SQLAlchemy and database-specific drivers for read-only data-source inspection.

The application also includes automated tests for security policies, cryptographic operations, audit integrity, agent defenses, database inspection and vulnerability investigation.

  1. Engineering Challenges

One of the main challenges was ensuring that AI-generated SQL could not freely execute against the application environment.

We addressed this through multiple independent controls, including deterministic query validation, allowed-table restrictions, SQLite authorization and bounded query execution.

Another challenge involved protecting retrieved documents from malicious instructions. We implemented prompt screening, evidence integrity checks and explicit treatment of retrieved content as untrusted data.

We also designed the cryptographic audit and evidence mechanisms to make unauthorized modifications detectable relative to the trusted keys.

  1. What We Learned

Building GradientHarbor demonstrated that reliable AI applications require more than capable language models.

They need controlled tool access, deterministic policy enforcement, trustworthy data handling, observability and independent verification.

We learned how to combine traditional data engineering, AI orchestration and applied cybersecurity into a modular application.

  1. Development Improvements

During this development iteration, we expanded the project beyond its original analytics workflow by adding multi-source database inspection, vulnerability investigation, agent authorization controls, AI safety metrics, cryptographic evidence handling and automated security tests.

The core application currently supports a deterministic local demonstration mode. The live NVIDIA/Nebius model-inference integration is still undergoing API access and verification; the local workflow should not be mistaken for a successful live model call.

  1. Security Limitations

GradientHarbor uses defense-in-depth mechanisms, not a guarantee of complete security. Its prompt-injection checks are heuristic, model verification can be incorrect, and local audit files and keys require independent protection.

The project is designed as a demonstration and research platform. Production deployment would require managed key storage, centralized immutable audit logging, authentication, tenant isolation and independent security evaluation.

Built With

Share this project:

Updates

Submission history