• 

  Unsafe action blocked.

• 

  Verified repair allowed

• 

  CRAFT enterprise evidence

• 

  Audit trail

• 

  Readiness report

ProofGate: Blast Radius Enforcement for AI Agents

What inspired us

The idea started before this hackathon. I read Hernan Asorey's "Cognitive Data Stack" whitepaper and got stuck on one question: as agents get real write access to real systems, what actually stops a fully authorized agent from doing something catastrophic with one wrong argument?

Access control answers whether an agent may call a tool. It says nothing about whether this specific call, with these specific arguments, is safe. An agent can be completely authorized to delete inactive test accounts and still wipe out production customers because it dropped one filter. That gap is what we set out to close.

What we built

ProofGate is a runtime enforcement layer that sits between an AI agent and its tools. Before a consequential action executes, it:

1. Measures the exact blast radius against the real system that will be mutated
2. Uses Nebius to extract structured semantic risk features from the user's intent and the proposed action, never a verdict
3. Runs deterministic Python policy rules against that measured data to decide ALLOW or BLOCK
4. Requires a real, server-validated snapshot proof before any irreversible action can proceed
5. Verifies the actual outcome after execution and writes a complete audit trail

The demo we built shows the exact failure this is designed for. A user asks an agent to clean up inactive test accounts. The agent's tool call drops the environment filter and would delete 9,981 production users instead of 92 test users. ProofGate catches it, blocks it, tells the agent exactly what's missing, and only lets the corrected action through once it has real proof it's scoped and recoverable.

The most important design decision: an LLM never makes the security decision. Nebius interprets language and extracts features. Deterministic code, working off authoritative counts from the real database, makes the call. We proved this holds even when we deliberately fed the system a Nebius response that lied about the impact being safe. It still blocked the action, because the verdict never trusted the model's opinion.

We integrated both sponsor platforms for real, not as a checkbox. Nebius Token Factory powers live intent and risk extraction. Emergence CRAFT provides real enterprise schema context and a live generated SQL query against actual e-commerce data, clearly separated from the authoritative mutation counts that come from the system being changed.

How we built it

We worked in tightly scoped vertical slices, one capability at a time, with tests written before moving to the next slice. By the time we started the UI, the entire backend was already proven correct: deterministic policy, real snapshot based rollback proof, postcondition verification, cumulative workflow budgets, and a full audit trail, all covered by a large passing test suite. That discipline is the only reason we had time left to wire up two live sponsor integrations and still ship a working demo.

Disha and I split the work as co-builders. We divided the system into a runtime and enforcement side and an integrations and presentation side, syncing on the shared data contracts between them so both halves could move independently without breaking each other.

Challenges we faced

The honest one is CRAFT integration. The actual live tool schemas didn't match our early assumptions, and we spent real time debugging an unhelpful wrapped exception before we could see the real error underneath it. We had to work backward through OAuth, discovery, and schema resolution one real error at a time until we found the actual required request shape. We got it working live before the deadline, but it took longer than we expected and forced us to cut UI scope down to the essentials.

The other real challenge was making sure a security boundary that uses an LLM anywhere in the loop couldn't quietly become a checkbox. We had to deliberately test the system trying to fool itself, a falsely reassuring model response against a genuinely dangerous action, to be confident the enforcement was real and not just theater.

We didn't get to everything on our roadmap. Snapshot restoration, human approval workflows, and a fully transparent MCP proxy are still ahead of us. What we do have is a real, tested enforcement loop that we're confident actually works the way we say it does.

Built With

• craft
• emergence
• nebius