Guardian

• 

  Overview

• 

  Spending policy (per tier)

• 

  Approval example 1

• 

  Approval example 2

• 

  Blocking example 1

• 

  Blocking example 2

• 

  Comparison across users

• 

  Session ledger — this run's history

Inspiration

AI agents are increasingly given real permissions — spend a card, book a flight, sign up for a service. Right now, the only thing stopping an agent from going rogue is a prompt telling it not to. That's not a guarantee, it's a suggestion. We wanted to see if Midnight could turn that suggestion into something unbreakable: a guardrail an AI agent physically cannot talk its way around.

What it does

Guardian takes a plain-English task ("book me a hotel for $150/night, travel category") and turns it into a structured action. Before that action can execute, it has to pass two guardrails enforced by a real Compact zero-knowledge smart contract:

• Spending policy (public) — is the amount within the limit for this category and tier?
• Reputation gate (private) — does the user's reputation clear the tier's threshold? Proven via ZK: the score itself is a private witness and is never disclosed — only the pass/fail of the comparison is.

If both pass, the action is approved. If either fails, the agent is blocked — live, in front of you. Reputation also grows from repeated approved actions, so a user who starts out untrusted can earn their way into higher spending tiers over time, without ever exposing their actual score.

How we built it

• An LLM (via Groq) parses the plain-English task into a structured action.
• A Node/Express backend routes that action to the guardrail check.
• The real guardrail is a Compact smart contract (checkGuardrails + recordApprovedAction), deployed and tested on a local Midnight devnet — 4/4 automated tests passing, including a test that grows a user's reputation from repeated approved actions until a previously-blocked spend clears the gate.
• The live demo UI calls a JS mock with logic verified identical to the real contract's policy tables, for fast, responsive interaction during judging. The real contract's correctness is independently proven by the automated test suite, not by the live demo path.

Challenges we ran into

• Compact doesn't run natively on Windows — needed WSL2 for the whole toolchain and local devnet.
• Every value derived from a private witness needs explicit disclose() at every point it's used publicly — including both a ledger write and a return statement, separately. Compact's compiler catches this, which caught real bugs before they shipped.
• Debugging a reputation-growth feature where each test run took 5-12 minutes against a real local devnet made iteration expensive — worth writing a smaller, isolated reproduction rather than re-running the full suite on every guess.

What's next

• Wire the live backend directly to the deployed contract instead of the verified-equivalent mock, for a fully on-chain live demo.
• Expand guardrail types beyond spending — e.g. rate limits, category-specific approval chains, multi-agent delegation.
• Let reputation be built from real, externally verifiable actions instead of a single witness value.

Built With

• compact
• css3
• docker
• express.js
• fraunces
• github
• groq
• html5
• ibm-plex-mono
• javascript
• llm
• midnight
• node.js
• typescript
• vitest
• wsl2
• zero-knowledge-proofs
• zk-snarks