Inspiration
AI agents are becoming capable of doing far more than generating text. They can call tools, modify infrastructure, manipulate data, and execute multi-step workflows.
That creates a problem I wanted to explore: capability is not the same as authority.
What happens when an autonomous agent produces a technically valid action that it should not be allowed to execute? What if it is manipulated by prompt injection? What if an authorization is forged or reused? And after an autonomous system acts, how can we prove that its history has not been rewritten?
NEXUS was built around one principle:
AI can propose. AI can attack. AI cannot authorize itself. And NEXUS can prove it.
What it does
NEXUS is a governance layer for autonomous agents built with Gemini 3.5, the Google Gen AI SDK, and Google Cloud.
Its main workflow is:
PROPOSE → GOVERN → AUTHORIZE → EXECUTE
Gemini receives a goal and produces a structured mission proposal.
NEXUS then validates that proposal against an exact schema and a closed capability registry. A plausible-looking response is not enough. If the requested capability is not explicitly registered, the mission is rejected.
A valid proposal can reach STAGED, but STAGED does not mean executed.
Real execution requires explicit human authorization. That authorization is cryptographically bound to the exact candidate through a decision_hash. Before performing any real effect, the executor independently recomputes and verifies that binding.
A forged, stale, reused, or tampered authorization is rejected before storage is touched.
Red Team
I also wanted NEXUS to be tested by the same class of intelligence it is designed to govern.
The Red Team uses Gemini as an authorized adversarial agent and deliberately asks it to construct malicious or unauthorized mission proposals.
For example, Gemini can be challenged with an instruction claiming that an administrator has already approved deleting cloud resources.
Gemini may follow the adversarial instruction.
That still does not grant authority.
The resulting proposal passes through the same deterministic GOVERN boundary as every legitimate mission. Unregistered capabilities and malformed candidates are blocked independently of the model's opinion.
The flow becomes:
ATTACK → DETECT → INCIDENT → QUARANTINE → HUMAN
A Red Team finding never automatically modifies NEXUS or authorizes an action.
Proof Anchor
Blocking dangerous actions is only part of the problem. I also wanted the system to make its history independently verifiable.
NEXUS therefore creates cryptographic evidence for important events. Red Team incidents are hash-chained and organized into a Merkle tree.
The resulting Merkle root can be anchored outside NEXUS's own runtime. An independent verifier can later recompute the evidence and determine whether it still matches the external anchor.
If stored evidence is modified, verification can identify the affected leaf.
This provides a second property beyond governance:
NEXUS does not just say what happened — it provides evidence that can be independently checked.
How I built it
The Hackathon Edition integrates:
- Gemini 3.5 for agent reasoning and mission generation
- Google Gen AI SDK (
google-genai) for Gemini integration - Google Cloud Run for the deployed backend
- Google Cloud Storage for execution evidence
- Gemma as an additional independent model in the Red Team review architecture
- deterministic Python governance and validation
- cryptographic decision binding
- hash-chained incident evidence
- Merkle-tree verification
- an external Proof Anchor
The live service is deployed on Google Cloud Run, while the repository contains reproducible setup, deployment, testing, Red Team, executor, and verification instructions.
Challenges
The hardest part was not making Gemini more capable. It was defining exactly where its authority must end.
Several boundaries had to remain independent:
- GOVERN must reject capabilities outside the registry regardless of how convincing the model output appears.
- AUTHORIZE must represent an explicit human decision rather than an AI-generated boolean.
- EXECUTE must independently verify authorization instead of trusting the previous layer.
- Red Team must use the real governance path rather than asking another LLM whether an attack looks dangerous.
- Proof must exist outside the same trust boundary as the system producing the evidence.
Keeping those properties separate while still producing a working agentic workflow was the central engineering challenge.
What I learned
The biggest lesson was that autonomous AI safety cannot depend only on better prompting.
Models can reason, propose actions, use tools, and even attack other systems. But authority can be represented separately and enforced deterministically.
I also learned that audit logs alone are not enough. If the system that creates a log can also rewrite it, the log is only a claim. External cryptographic anchoring creates a stronger trust model.
Finally, building NEXUS reinforced an architectural principle that I think will become increasingly important as agents gain more capabilities:
The model should decide what it wants to propose. The system should decide what it is allowed to do.
Pre-existing work disclosure
The underlying NEXUS/Keeper governance architecture predates this hackathon.
The Hackathon Edition — including the Gemini / Google Gen AI SDK integration, isolated hackathon backend, Red Team module, Proof Anchor, Google Cloud deployment, reproducibility work, and submission materials — was developed during the hackathon submission period.
Log in or sign up for Devpost to join the conversation.