ADH | Devpost

Inspiration

Sharing sensitive information often means giving someone access to far more than they actually need. For example, an on-call engineer might need to share a specific server rollback command with a teammate, but sending the entire document creates unnecessary security risks.

We wanted to explore a different approach: what if we could delegate an answer instead of sharing the secret itself?

This idea led us to build the Alexa+ Delegation Broker, a secure, time-limited, and auditable system that allows users to share only the information required to answer an approved question. Developed for the Alexa+ track and AWS Builder mini-challenge, the project combines conversational AI, MCP, cryptographic security, and AWS serverless services.

What it does

The Alexa+ Delegation Broker allows a user to delegate access to specific facts without exposing an entire note or document. The owner configures a topic, secret facts, a voice codeword, usage limits, and an expiration deadline. The recipient can then ask questions through our Alexa+ simulator and receive only the relevant, authorized information.

Key features include:

Semantic Slicing: Releases only the relevant authorized facts, with a maximum of two facts per response.
Two-Stage Security: A blind gatekeeper evaluates questions without seeing secret values, while a separate deterministic vault handles retrieval.
Secure Access Control: Uses HMAC-SHA256 codeword verification, usage limits, automatic lockouts, expiration, and instant revocation.
Auditable Activity: Records access events in tamper-evident, SHA-256 hash-chained audit logs.
Automated Escalation: Triggers webhooks and urgent briefings when a delegation deadline is missed.
AI Security: Detects out-of-scope questions and attempts to manipulate the gatekeeper, with security-sensitive failures defaulting to denial.
AWS Integration: Uses S3 for audit archives, Lambda for escalation, CloudWatch for security metrics, SNS for alerts, and Bedrock for LLM-based authorization fallback.

The project also includes a browser-based simulator with two user consoles, live audit logs, expiration timers, and a JSON-RPC inspector to demonstrate the underlying MCP communication.

How we built it

We built the backend in Python 3.11+, using the official MCP Python SDK to expose tools over Streamable HTTP at /mcp. The unified server also provides a REST bridge and the web simulator.

The system follows a two-stage architecture:

Blind Gatekeeper: We developed a lightweight FastSemanticRouter using TF-IDF features and cosine similarity to evaluate questions against topic descriptions and fact labels. When configured, Amazon Bedrock provides an LLM fallback using Amazon Nova Micro or Claude.
Deterministic Vault: After authorization and codeword verification, the vault retrieves only the permitted facts. Fernet encryption protects stored secret payloads, HMAC-SHA256 verifies codewords, and SQLite manages delegation state and usage limits.

We also integrated AWS services to support the cloud ecosystem. Amazon S3 stores encrypted audit archives, AWS Lambda handles asynchronous escalation, Amazon CloudWatch tracks security metrics, and Amazon SNS supports high-severity alerts. AWS SAM and CloudFormation define the infrastructure as code.

For the frontend, we built a browser-based simulator using HTML, CSS, JavaScript, and the Web Speech API to demonstrate voice input, spoken responses, delegation management, and live protocol traces.

Finally, we created an automated test suite with pytest covering encryption, authorization, lockouts, concurrent requests, audit integrity, MCP communication, and escalation behavior. The README documents 26 automated tests and a separate benchmark suite containing 21 gatekeeper cases.

Built with: Python, JavaScript, HTML, CSS, MCP, Streamable HTTP, FastAPI, Uvicorn, SQLite, Amazon Bedrock, Amazon S3, AWS Lambda, Amazon CloudWatch, Amazon SNS, AWS SAM, CloudFormation, Fernet, HMAC-SHA256, TF-IDF, cosine similarity, Web Speech API, and pytest.

Challenges we ran into

One of our biggest challenges was ensuring that the AI could evaluate a question without ever accessing the secret it was protecting. We addressed this through a strict separation between the blind gatekeeper and the deterministic vault.

Another challenge was balancing flexible natural-language understanding with strict authorization. Questions can be phrased in many ways, but permissive matching can expose sensitive information. We incorporated confidence thresholds, conservative denial behavior, and adversarial test cases to make the gatekeeper more robust.

We also had to handle security risks involving repeated attempts, concurrent requests, and expired delegations. Atomic usage consumption in SQLite helps prevent a single-use delegation from being consumed twice, while lockouts, revocation, and payload purging enforce the delegation lifecycle.

Finally, integrating MCP Streamable HTTP with AWS services introduced protocol and infrastructure challenges. We used automated tests, mocked external services, and a documented friction log to validate integrations and investigate issues without depending on live cloud credentials for every test.

Accomplishments that we're proud of

We are proud to have built a working delegation system that brings together conversational AI, deterministic security controls, and an AWS serverless architecture.

Some of our key accomplishments include:

Implementing an MCP server with five callable tools for delegation, retrieval, auditing, revocation, and scam-message analysis.
Designing a two-stage security pipeline that keeps secret values outside the AI gatekeeper's context.
Building a semantic router designed for sub-5 ms inference latency, with a Bedrock fallback when configured.
Implementing encrypted, time-limited delegations with codeword verification, lockouts, and automatic secret-payload purging.
Creating tamper-evident audit logs and automated escalation workflows.
Building a browser simulator that makes authorization decisions, security events, and MCP traffic observable.
Documenting 26 automated tests and 21 gatekeeper benchmark cases to evaluate the system's security behavior.

Most importantly, we brought these pieces together into a demonstrable end-to-end experience rather than treating security, AI, and cloud infrastructure as separate components.

What we learned

We learned that building a secure AI application requires much more than connecting an LLM to a backend. Security boundaries, deterministic authorization, failure handling, and observability need to be designed into the architecture from the beginning.

We gained practical experience with MCP tool development, Streamable HTTP, semantic routing, cryptographic verification, encrypted storage, SQLite concurrency, and time-based scheduling. Integrating AWS services also helped us understand serverless workflows, infrastructure as code, monitoring, and event-driven escalation.

Testing taught us to think beyond successful requests and consider adversarial inputs, race conditions, malformed responses, service failures, and unauthorized access attempts.

Our biggest takeaway was that AI should assist with understanding intent, while deterministic controls enforce what the system is actually allowed to reveal.

What's next for Lambdas of Amazon

We want to evolve the Alexa+ Delegation Broker into a more production-ready system for secure, voice-driven information sharing.

Our next steps include integrating authenticated Alexa identity instead of relying on self-asserted simulator identities, strengthening deployment controls, expanding adversarial security benchmarks, and improving audit verification. We also want to explore additional escalation channels and more flexible delegation policies for different time-sensitive workflows.

Ultimately, we want to make it easier for people and teams to share the information someone needs, exactly when they need it, without surrendering control over the underlying data.

Don't share the secret. Delegate the answer.