QUOIN

A professional-agent authority layer for consequential operations where policies can change while an agent is still reasoning.

Comment

Inspiration

Over the past year, enterprise AI engineering has celebrated the transition from read-only chatbots to autonomous action agents: systems empowered to issue commercial discounts, waive contractual SLA penalties, disburse refunds, and alter enterprise invoicing.

Yet in high-stakes enterprise operations, organizational policies change in real-time. When an executive committee or CFO updates a policy; for example, reducing the maximum allowable commercial discount from 20% to 10% distributed systems do not update instantaneously.

During empirical testing on AWS Bedrock AgentCore Memory, we discovered a physical consistency paradox:

  • Write Acceptance (IngestData): Acknowledges via HTTP 200 in an average of 37.69 ms.
  • Visibility Lag (T_visibility): Asynchronous consolidation and semantic indexing into retrievable long-term records requires 321.60 ms (p50) up to 399.78 ms (max).

In this propagation gap, an in-flight autonomous agent queries memory, retrieves the superseded 20% discount policy, reasons that a 15% discount is valid, and commits a transaction that destroys operating margin. The enterprise loses thousands of dollars while believing its systems are operating safely.

Existing safety approaches rely on LLMs checking other LLMs (expensive, non-deterministic, and prone to shared hallucinations) or static prompt guards. We were inspired to build a foundational infrastructure primitive: an external, model-free Causal Authority Fence that makes it mathematically impossible for an agent to commit an action under a superseded policy generation.

What it does

QUOIN is a deterministic policy-generation fence and two-phase authority commit engine for enterprise agentic architectures. It decouples generative reasoning from operational execution across four zero-trust architectural planes:

  1. Monotonic Generation Anchoring: Every policy update advances a strictly increasing integer generation counter (G_n to G_{n+1}). Policies are immutable; updates are atomic.
  2. Phase 1 (Precondition Proposal): The Strands reasoning agent (powered by AWS Bedrock Nova Lite) reasons over user intent and formulates a structured DecisionProposal bound to its visible policy generation snapshot G_visible. The deterministic kernel checks rule boundaries and mints an AuthorityReceipt containing a cryptographic digest: H_receipt = SHA256(Request || Proposal || Policy || G_visible).
  3. Phase 2 (Two-Phase Commit Gate): Immediately prior to side-effect execution, the commit gate executes a strongly consistent read-after-write CAS check against the authoritative DynamoDB ledger. If active generation G_active ≠ G_receipt, the transaction is instantly aborted with STALE_GENERATION_CUTOVER. The permit is invalidated and the agent is forced to re-evaluate under the new policy.
  4. Single-Use Execution Permits: Side effects require a signed permit consumed with atomic test-and-set semantics in DynamoDB / SQLite WAL. Duplicate replays and concurrent double-spends are prevented with 100% mathematical certainty.
  5. Tamper-Evident Decision Trace: Every event (genesis, evaluation, receipt, CAS verification, execution) is hashed into a chained SHA-256 Merkle timeline, enabling post-incident forensic audits.

How we built it

We engineered QUOIN from first principles without fake mocks or simulated numbers:

  • Plane A (Cognitive Reasoning): Built using the official Strands Agents Python SDK connected directly to Amazon Bedrock Nova Lite (us.amazon.nova-lite-v1:0). The agent reasons over natural language business requests and outputs strictly typed Pydantic proposals. The agent plane is unprivileged with zero direct execution permissions.
  • Plane B (Deterministic Kernel Fence): Written in pure Python with canonical SHA-256 serialization. Model-free, sub-millisecond evaluation that validates proposal parameters against generation-scoped policy rules.
  • Plane C (Cognitive Memory & Authoritative Ledger): Dual-tier architecture. Amazon Bedrock AgentCore Memory stores organizational policies across tenant scopes. Amazon DynamoDB (DynamoAuthorityLedger) provides linearizable, conditional-write policy epochs (attribute_not_exists / version = :prev) and atomic 2PC leases, with durable SQLite WAL fallback for local development.
  • Plane D (Operational Action Service): Idempotent execution engine managing single-use permits, nonce verification, and permanent consumption records.
  • Forensic Verification: DecisionTraceLedger maintains an append-only, chained Merkle timeline linking each decision state change to its cryptographic predecessor.
  • Frontend Experience: Next.js 14 App Router application engineered with the Replay design system—featuring custom Unbounded and Space Grotesk typography, interactive causal scrub timeline, real-time 27-attack Break It Lab, dark/light theme switching, and live evidence vault.
  • Automated Verification: 45 automated pytest tests (27 adversarial attack tests, property-based tests, mutation tests, unit tests), 100-scenario causal benchmark suite, and 5 multi-viewport Playwright E2E tests.

Challenges we ran into

  1. The Physical Reality of Cloud Memory Consolidation: Measuring the exact millisecond boundary between write acknowledgment and read visibility required building a custom empirical telemetry harness (campaign.py) that fired high-frequency concurrent queries during live policy cutovers. Proving that stale reads occur in 100% of un-fenced architectures was our biggest empirical breakthrough.
  2. Preventing Race Conditions at the Execution Boundary: In high-concurrency environments, an agent might evaluate under G_17, receive a receipt, and race against an executive cutover to G_18 occurring during the commit request itself. We solved this by implementing DynamoDB conditional writes (version = :expected_version) directly in the commit path, guaranteeing atomic linearizability.
  3. Zero-Mock Policy Rigor: We refused to use hardcoded mock numbers in our frontend. Wiring the Next.js frontend to dynamically fetch live verifier statuses, active policy generations, and real-time attack evaluations required designing robust, resilient API error boundaries (BackendUnavailableBanner) and unified TypeScript client interfaces.
  4. Theme Harmonization Across Complex Visuals: Adapting an editorial, high-contrast dark aesthetic while maintaining fluid responsiveness for light mode required restructuring all Tailwind utilities into dynamic CSS variables (var(--bg), var(--line), var(--t1)), ensuring diagrams and buttons remained razor-sharp in both modes.

Accomplishments that we're proud of

  • 100% Elimination of Stale Policy Executions: Across 100 standardized causal benchmark scenarios, QUOIN blocked all 80 in-flight cutover races and memory visibility lag events (0 stale executions, down from 28 in the un-fenced baseline).
  • 27/27 Adversarial Attacks Neutralized: Subjected QUOIN to 27 adversarial vectors across Planes A through D (prompt injection, authority confabulation, receipt tampering, monotonic counter rollback, memory poisoning, duplicate replay, and cross-tenant collision)—achieving a 100% neutralization rate with 0 escapes.
  • Sub-Millisecond Fence Overhead: The deterministic kernel evaluation takes only 0.60 ms (p50) and the two-phase commit gate adds 1.12 ms—less than 0.2% of typical LLM generation latency, introducing virtually zero friction into production workflows.
  • Master Verifier Automation: Created scripts/verify_all.py which executes 10 comprehensive invariant proofs across the entire stack in under 15 seconds, outputting machine-readable compliance receipts.
  • Production-Grade Design: Built an editorial, publication-ready user interface with interactive scrub timeline, live forensic trace inspection, and multi-viewport responsive layouts verified by Playwright Chromium across 9 viewports.

What we learned

  1. Eventual Consistency is Incompatible with Autonomous Authority: Distributed caches and vector stores are exceptional for context retrieval, but they must never be treated as authoritative state machines for consequential actions. Authority requires linearizable ledgers with conditional write semantics.
  2. Deterministic Boundaries Outperform Model-Based Self-Correction: Asking an LLM "Are you sure this discount follows the latest policy?" adds latency and fails when the context window is poisoned. Placing a pure mathematical hash fence outside the model eliminates the entire class of cutover vulnerabilities deterministically.
  3. Receipts Must Cryptographically Bind All Dimensionalities: A receipt cannot merely reference a policy version number; it must cryptographically bind the request digest, proposal digest, policy digest, and tenant generation simultaneously. Any decoupled parameter leaves an open door for payload tampering.

What's next for QUOIN

  1. Hardware-Anchored KMS Signing: Upgrade the deterministic SHA-256 HMAC permit digest to native asymmetric digital signatures using AWS KMS asymmetric signing keys (ECDSA NIST P-256), allowing external counterparty verification without exposing private keys.
  2. Multi-Region Cross-Active Consensus: Expand the authoritative policy ledger to Amazon Aurora Global Database and DynamoDB Global Tables with multi-region quorum fencing for globally distributed agent fleets.
  3. Decentralized Audit Oracle: Publish Merkle state roots of the DecisionTraceLedger to public tamper-evident ledgers periodically, creating externally verifiable proof-of-policy compliance for regulatory compliance (EU AI Act Article 14 human oversight & logging requirements).
  4. SDK Adapters for LangChain & CrewAI: Package QUOIN's two-phase commit gate into plug-and-play middleware decorators for LangChain, LlamaIndex, CrewAI, and AutoGen, bringing deterministic policy fencing to every enterprise agent framework.

Built With

  • amazon-bedrock-agentcore-memory
  • amazon-dynamodb
  • amazon-nova-lite
  • aws-bedrock
  • fastapi
  • next.js-14
  • playwright
  • pydantic
  • pytest
  • python
  • react
  • render
  • sha-256
  • sqlite-wal
  • strands-agents-sdk
  • tailwind-css
  • typescript
  • uvicorn
  • vercel
Share this project:

Updates

Submission history