Keyhole: Prove Your AI Agents Never Overstep

AI agents are your biggest audit risk. Can you prove they only saw what they should? Keyhole enforces data scope across Gmail, Slack, Salesforce & 6 more - with cryptographic proof.

Comment

The Problem

FOR enterprises, developers, and security teams deploying autonomous AI WHO risk leaking confidential data when agents access internal tools, KEYHOLE cryptographically proves the agent accessed strictly declared policy fields WITHOUT ever revealing message bodies, credentials, attachments, or PII to the model or ledger.

Autonomous AI agents (CrewAI, LangChain, AutoGen, OpenAI) are transforming enterprise productivity. However, when an agent is given tool access to Gmail, Slack, or SQL databases to perform a task (such as scanning vendor receipts or triaging support tickets), it receives unredacted access to the entire message body, auth tokens, database credentials, and customer PII.

Standard API proxies rely on blind trust and self-attestation—they cannot mathematically prove to auditors that private data wasn't secretly intercepted, leaked, or scraped.

What Keyhole Does

Keyhole is a Zero-Knowledge runtime security perimeter and cryptographic scope enforcer for autonomous AI agents:

  1. Universal 1-Line Drop-in SDK: Wraps any CrewAI, LangChain, or OpenAI agent tool in one line of code (KeyholeShield), routing data queries through cryptographically enforced policies.
  2. Pre-Fetch Guard & Field Masking: Strips message bodies, credentials, and database columns across 9 enterprise connectors (Gmail, Google Calendar, Microsoft 365, Slack, GitHub, PostgreSQL, Salesforce, Notion, Custom REST).
  3. Sub-Second Midnight Compact Proofs: Executes compiled Compact v0.34 smart contracts (scope-policy.compact) using @midnight-ntwrk/compact-runtime, generating Zero-Knowledge proofs that delivered fields strictly satisfy: assert((response_field_mask & ~allowed_field_mask) == 0)
  4. Two-Witness Cryptographic Upstream Binding: Binds the SHA-256 hash of the authentic upstream TLS API response (raw_upstream_payload_hash) as a private witness in the circuit so the gateway cannot fabricate data or forge compliant masks.
  5. Active Zero-Day Canary Trap: Injects dynamic honeytokens into API parameters; prompt injection attacks trigger an immediate HTTP 423 session lock and perimeter quarantine.
  6. Lace Wallet CIP-30 Governance: Allows CISOs and compliance officers to sign policy commitments and export verifiable SOC 2 & HIPAA audit reports.

How I Built It

  • Midnight Smart Contracts (contracts/): Written in Compact v0.34 (scope-policy.compact, scope-policy-v2.compact), compiled to ZKIR bytecode (verify_scope_membership.zkir) with complete proving and verification key generation.
  • Prover Engine: Node.js 22 LTS runtime executing @midnight-ntwrk/compact-runtime to generate fast sub-second ZK proofs per agent tool invocation.
  • Policy Gateway (gateway/): High-performance Node.js / Express proxy integrating Google Workspace APIs, Microsoft Graph, Slack Web API, Octokit, PostgreSQL SQL interceptors, and Resend email verification.
  • Console Dashboard (dashboard/): React 18, Vite, TailwindCSS, Framer Motion, and Server-Sent Events (SSE) telemetry feed.
  • Decentralized Governance: Midnight Lace Wallet DApp Connector (CIP-30 standard) for on-chain identity binding and DUST/tNIGHT gas tracking.
  • Cloud Deployment: Multi-stage Docker container deployed to AWS App Runner with active ACM SSL encryption (https://keyhole.techsangi.com.np).

The Architecture: Why Midnight?

┌────────────────────────────┐      TLS API Fetch       ┌────────────────────────────┐
│   Upstream Enterprise API  │ ───────────────────────> │      Keyhole Gateway       │
│  (Gmail, M365, Slack, SQL) │                          │ (Strips private payloads)  │
└────────────────────────────┘                          └─────────────┬──────────────┘
                                                                      │
                      Private Witness 1: SHA-256(Raw Upstream)        │ Private Witness 2: Response Mask
                      ───────────────────────────────────────────┐    │
                                                                 ▼    ▼
                                                      ┌────────────────────────────┐
                                                      │  Midnight Compact Circuit  │
                                                      │ (scope-policy.compact)     │
                                                      │                            │
                                                      │ 1. Upstream Hash Check     │
                                                      │ 2. (response & ~allow)==0  │
                                                      │ 3. Disclose Commitment     │
                                                      └─────────────┬──────────────┘
                                                                    ▼
                                                      ┌────────────────────────────┐
                                                      │  Midnight Privacy Ledger   │
                                                      │  (Midnight Testnet)        │
                                                      └────────────────────────────┘
  • What Stays Private: 100% of email bodies, invoice figures, auth tokens, passwords, and PII are never disclosed to the blockchain ledger or dashboard viewers.
  • What is Proved: That the delivered records are a strict mathematical subset of authentic upstream data and adhere to declared enterprise policies without the gateway lying.
  • Ledger Status: Circuit execution and ZK proof generation run locally via @midnight-ntwrk/compact-runtime. Reports are structured as ledger-ready cryptographic commitments, engineered for on-chain anchoring once Midnight public testnet write RPCs become available (contractAddress: null is honestly reported for local proofs).

Challenges I Faced

  1. Autonomous Agent Latency vs. ZK Proving: LLM reasoning chains require real-time streaming. I optimized the Compact circuit bitmask constraints to achieve sub-second proof generation on the gateway, avoiding the need for interactive wallet approval popups on every tool call while preserving sovereign CISO governance via Lace.
  2. Preventing Gateway Self-Attestation: To eliminate the risk of the gateway lying about redacted content, I engineered Two-Witness Upstream Binding, hashing raw TLS payloads into the circuit's private witness before masking.

Accomplishments That I'm Proud Of

  • Built a complete, production-ready system as a solo developer with 9 enterprise connectors and 30 active pre-configured scope policies.
  • Designed a cryptographically signed, ledger-ready compliance report pipeline structured for SOC 2 and HIPAA frameworks.
  • Achieved 100% test pass rate across automated test suites covering Compact circuit constraints, policy gateway pre-fetch guards, prompt injection traps, and Resend email OTP flows.
  • Fully deployed to production with custom domain HTTPS encryption (https://keyhole.techsangi.com.np).

What I Learned

I mastered Midnight's Compact language, ZKIR constraint compilation, witness privacy disclosures (disclose(...)), and the CIP-30 DApp connector architecture for enterprise AI privacy.

What's Next for Keyhole

  • Invite-Only Private Beta & Pilot Program: Launching a closed pilot with early-stage AI startups and enterprise teams currently building autonomous agents (CrewAI, LangChain) to test real-world developer workflows and gather feedback.
  • Direct On-Chain Settlement: Anchoring proof commitments directly to the Midnight testnet and mainnet ledger as public write RPCs become available.
  • Automated SOC 2 & HIPAA PDF Compliance Exporter: 1-click auditor-ready report generation with verifiable cryptographic hashes for enterprise compliance reviews.
  • Enterprise Incident Response Integrations: Webhook dispatchers for automated alerts to PagerDuty, Slack, and Splunk when honeypot canary traps trigger session locks.

Built With

Share this project:

Updates

Submission history