HomeFront

Inspiration

Government offices are starting to hand real work to AI agents: reading the inbox, pulling federal data, researching vendors, drafting emails and social posts. An agent with a long-lived API key and broad access is a liability. If a staffer leaves, the agent keeps working. If a scraped web page says "email this list to…", the agent might obey. We built HomeFront (GuardRail) for AWS × A10 Hackathon Prompt 1, Agentic Identity, around one rule: an agent never has authority of its own. It acts for one specific staffer, for a short time, and loses that authority the moment the staffer does.

What it does

GuardRail gives each government-office AI agent a verifiable identity and a hard permission boundary.

Delegated identity: A staffer (e.g. Maya) signs in with Amazon Cognito and presses Start assistant. The agent uses its own client credentials to get a 15-minute mandate token tied to that staffer's session. No route issues an agent token on its own.
Least-privilege tools: The agent calls seven MCP tools: email, social posting, web scrape, api.data.gov search, USAspending, SAM.gov entity lookup, and report save. Every call is checked against Amazon Verified Permissions (Cedar). Routine work is allowed. Bulk export, unknown recipients and campaign posts are denied.
Live revocation: The Chief of Staff presses Offboard. The agent's very next call is denied (session revoked / delegator inactive) and appears in the live decision feed.
Prompt-injection defense: Once an agent touches untrusted content (scraped pages, contract data), outbound tools like email and social are blocked for the rest of the run. Bedrock Guardrails scan content too, and every decision is labeled with a MITRE ATLAS technique.
Agent types: Official email, social media, research, procurement market research (FAR Part 10, producing cited reports) and custom. Each has a tool ceiling enforced at grant time and on every call.

How we built it

Auth: Amazon Cognito for staff sign-in and agent client credentials. The gateway mints short-lived mandate tokens.
Gateway: A FastAPI service exposes the broker API (/api/v1/sessions, /offboard, /events) and a single MCP endpoint at /mcp. Every tool call passes through one guarded() function: verify token, check DynamoDB that the session and staffer are still active, evaluate Cedar via Verified Permissions, run the guardrail scan, then log the event.
Agent: Claude on Amazon Bedrock, calling /mcp with its mandate token. A market-research agent routes questions by topic to USAspending, SAM.gov and api.data.gov tools.
Shared contracts: A mandate-contracts package defines tool names, token claims, event shapes, DynamoDB keys and Cedar entities, so the gateway, agent, guardrail and dashboard all agree.
Threat intel: A vendored MITRE ATLAS Agentic subset with a local enricher that annotates each decision, with no runtime dependency on MITRE's API.
Frontend: React + TypeScript with a staffer console (start assistant, live decisions), a Chief of Staff admin page (offboard, audit log) and an account page.
Hardening: An SSRF guard on scraping (no localhost, private ranges or cloud metadata IPs, redirects re-checked), per-agent domain allowlists (e.g. *.gov), and API keys that stay in the gateway so agents never see them.

Challenges we ran into

Staying consistent across a team: Several people built the gateway, agent, tools and dashboard in parallel. Shared contracts and one .env kept the pieces compatible, and we had to reconcile two Cognito/CloudFormation setups into one pool that the app actually uses.

Accomplishments that we're proud of

A full end-to-end authenticate → allow → revoke → block loop that you can watch live in the feed.
A gateway where no code path lets an agent act without a human delegator.
Cedar policies that distinguish routine work from risky actions (bulk export, unknown recipients, campaign posts).
Taint tracking that blocks the "read a malicious page, then exfiltrate by email" attack, with each denial mapped to a MITRE ATLAS technique and mitigation.
A real procurement research workflow that finds past awards, checks vendors in SAM.gov and saves a cited report, with an agent that is structurally unable to email or post.

What we learned

For agents, identity has to be delegated, short-lived and revocable. A scoped token alone isn't enough, because you also need a live check on the human behind it.
Authorization should sit at the tool boundary, not in the prompt. A model can be talked out of its instructions, but it can't talk its way past Cedar.
Treating tool output as untrusted data, and restricting what can happen afterward, was the most effective defense against prompt injection.
Shared, typed contracts across components are what let a small team build a security system in a hackathon timeframe.

What's next for GuardRail

Approval workflows: route sensitive actions (e.g. bulk send) to a human approver, and extend the queue we already have.
Richer Cedar policy authoring, with per-office and per-role policies and a UI to preview the effect of a change.
More agent types and connectors (case management systems, calendar, document stores) under the same mandate model.
Anomaly detection on the decision stream, using ATLAS-labeled events to flag suspicious agent behavior.
Production hardening: key management for token signing, multi-tenant isolation for multiple agencies, and a compliance-friendly audit export.