Guardian Swarm: Controlled AI Agent Execution

Audit ledger
Escalations and review
Gate Trace
Group Info
Main Dashboard
Settings
Model Engine

Inspiration

AI agents are becoming increasingly capable of interacting with tools, accessing data, and performing complex tasks. However, greater autonomy also introduces risks such as prompt injection, unauthorized tool usage, sensitive data exposure, and uncontrolled API costs.

We wanted to address a fundamental question: How can organizations benefit from autonomous AI agents without losing control over their actions?

This inspired us to build Guardian Swarm, a framework that makes security and governance part of the AI execution process rather than treating them as an afterthought.

What it does

Guardian Swarm is an AI governance and security framework that evaluates AI-agent requests before allowing them to proceed through controlled execution pathways.

Its core functionality is built around five governance gates:

Access Control: Evaluates user roles, permissions, and identity.
Tool Confinement: Restricts access to permitted tools and validates tool usage.
Data & Compliance: Supports PII detection, file classification, and data-residency checks.
Budget Guardrails: Estimates token consumption, applies budget controls, and supports usage reconciliation.
Safety Verification: Checks for suspicious prompt patterns, potential prompt injection, and policy violations.

Based on the governance decision, requests can be approved, denied, or escalated for review. The framework also includes FileMind for file inspection and classification, authentication mechanisms, encrypted credential storage, and a SHA-256 hash-chained audit ledger for traceability and integrity verification.

Our goal is to make AI-agent execution more controlled, transparent, and accountable.

How we built it

We built Guardian Swarm using a modular Python backend, separating request handling, policy enforcement, data inspection, cost management, safety verification, and audit logging.

The documented technology stack includes:

Python and Flask: Backend application and API services.
REST API and SSE: Request handling and server-sent event communication.
SQLAlchemy and SQLite: Application metadata and audit-record storage.
JWT: Authentication and access management.
Fernet encryption: Protection of stored credentials.
tiktoken: Token estimation for budget management.
SHA-256: Hash chaining and audit-ledger verification.

We also developed FileMind as a subsystem for PII detection, content fingerprinting, file classification, and cache management. The five-gate pipeline brings these components together to evaluate requests using multiple governance checks.

Challenges we ran into

One of our main challenges was bringing several security responsibilities into a single workflow without making legitimate AI usage unnecessarily difficult.

We faced challenges in detecting sensitive information, recognizing suspicious prompt patterns, estimating costs across different model providers, and maintaining trustworthy audit records. Rule-based detection is useful, but it cannot identify every possible attack or contextual privacy risk.

We also recognized that a hash-chained ledger can help detect certain modifications but is not automatically immutable if an attacker can rewrite the entire underlying database. Similarly, token estimates may differ from actual provider charges.

These challenges taught us to distinguish between implementing a security mechanism and proving that it works reliably under realistic attack conditions.

Accomplishments that we're proud of

We are proud to have brought access control, tool restrictions, privacy-oriented inspection, budget guardrails, safety verification, and auditability into one modular AI governance framework.

Our key accomplishments include:

Implementing a five-gate governance pipeline.
Integrating FileMind for file classification and privacy-oriented inspection.
Building budget-estimation and guardrail functionality.
Adding authentication and encrypted credential storage.
Developing a SHA-256 hash-chained audit ledger with verification functionality.
Providing API endpoints for task submission, escalation decisions, and audit verification.

Our project documentation reports 51 passing integration tests across three modules. This gives us a documented testing baseline to build upon, while broader adversarial evaluation and production-hardening remain important next steps.

What we learned

We learned that responsible AI execution requires more than a capable model. It requires clear permissions, controlled tool access, data protection, cost awareness, and reliable records of important actions.

We also learned that security claims need measurable evidence. Detection accuracy, false-positive rates, latency, resistance to policy bypasses, and audit integrity should be evaluated through repeatable tests rather than assumptions.

Most importantly, we learned that governance should be integrated into the execution pathway itself, with explicit decisions and clear failure-handling behavior.

What's next for Guardian Swarm: Controlled AI Agent Execution

Our next goal is to strengthen Guardian Swarm from a functional governance framework into a more robust, production-oriented security platform.

Security hardening: Verify that every governed model and tool operation passes through the enforcement layer, strengthen failure handling, and expand adversarial testing for prompt injection, data exposure, and unauthorized actions.

Smarter data protection: Bind file classifications to content fingerprints and policy versions, improve sensitive-data detection, and reduce the risk of stale classification results.

Reliable budget and approval workflows: Improve budget reservation and reconciliation, complete human-review workflows, and ensure approvals are tied to the specific action being authorized.

Stronger auditability: Expand tamper-detection tests, add independently stored integrity checkpoints, and improve audit evidence and incident reporting.

Scalability and integrations: Evaluate PostgreSQL, concurrent workloads, tenant isolation, secure deployment practices, additional model providers, and enterprise monitoring integrations.

Evidence-driven evaluation: Measure detection precision and recall, false positives, response latency, and unauthorized-execution prevention using reproducible benign and adversarial test cases.

Our long-term vision is to provide organizations with a practical governance layer that enables AI agents to operate with stronger boundaries, better visibility, and greater accountability.