RelayProof

Inspiration

What it does

How we built it

Inspiration

Schools, clubs, small businesses and support teams lose hours every week to the same routine: read a request, copy the details into a ticket, chase whatever is missing, and write the same follow-up emails. AI can automate all of that, but most AI automation demos jump straight from "here's a sentence" to "action taken."

In real operations, that is dangerous. One wrong refund, one over-permissioned account, or one hidden "ignore previous instructions" line inside an email can cost far more than the minutes saved. We wanted automation people can actually trust, built on one rule: plan first, prove it, then act.

What it does

RelayProof turns messy, unstructured requests into finished, reviewable work.

It automates the busywork

• Extracts the details: reference numbers (INV-, ORD-, PO-…), amounts and currency, dates, owners, vendors, systems and reasons. For invoices it even calculates the mismatch: an invoice of 4,850 against a purchase order of 4,580 is flagged as a 270 difference (5.6%).
• Finds what's missing: a completeness check for each request type turns gaps into ready-to-send clarification questions.
• Writes the outputs: a draft message to the right person (approver, customer, finance team or security reviewer) and a task ticket with queue, priority, due date and checklist.
• Inbox autopilot: triages up to 20 requests in one click. Low-risk work completes automatically, sensitive work waits for approval, and attacks are blocked. Results export to CSV.

It keeps automation safe

• Injection shield: blocks six families of attacks (instruction overrides, "developer mode" jailbreaks, secret and system-prompt leaks, approval bypasses, encoded payloads and hidden HTML comments) before they reach the AI, including zero-width-character tricks.
• Privacy shield: redacts emails, phone numbers, card numbers (Luhn-checked), government IDs, API keys and pasted passwords before the AI call, browser storage and report export.
• Explainable risk score (0–100): every decision shows its reasons, such as "+50 moves money ('refund')".
• AI can only make a plan safer: Gemini's output is re-checked by a deterministic policy engine. It can raise risk but never lower it, unknown actions are replaced, and a human approval step is enforced for anything sensitive.
• A real human gate: risky runs pause at the approval step. A person approves or rejects with their name and a note, and only then do the remaining steps run and the "Open in email app" hand-off unlock. Blocked runs can never be approved.
• Tamper-evident proof: every event is SHA-256 hash-chained. Export a report, change a single word, re-upload it, and RelayProof shows exactly which event was modified.
• Red-team suite: 16 adversarial and control cases run in the app, in the command line and in CI on every push.

Every action is simulated: RelayProof never sends a message, grants access, moves money or deletes data.

How we built it

• One shared policy engine (lib/core.js, zero dependencies) runs in the browser, the serverless API, the CLI and the tests, so the interface can never drift from what is tested.
• AI: Google Gemini (gemini-3.5-flash-lite) through a Vercel serverless function, with a JSON response schema, an action allowlist, a timeout, a retry, rate limiting and a deterministic fallback when the AI is unavailable.
• Frontend: HTML, CSS and vanilla JavaScript. Responsive and accessible (keyboard shortcut, skip link, live regions, reduced-motion support).
• Integrity: a pure-JavaScript SHA-256, verified against Node's crypto in tests, with canonical JSON for the hash-chained audit trail.
• Quality: 39 automated tests (core logic, the API with a mocked Gemini, and the CLI) plus the red-team gate, running in GitHub Actions on Node 22 and 24.
• Zero-install extras: a local server (node server.js) and a CLI (plan, batch, verify, redteam), so anyone can run it with only Node.js installed.

Challenges we ran into

• The AI was silently broken. Our first Gemini integration called the wrong API path and put the key in the URL. Because the app had a fallback, it looked fine while the AI was never actually used. We fixed the endpoint, moved the key into a request header, and added mocked API tests so it can't happen again.
• Regex false positives. The first reference extractor read the word "request" as the ticket ID REQUEST, and "order" as ORDER. Requiring a digit fixed it, and tests now lock it in.
• Safety versus usefulness. "Disregard the old policy memo" is harmless; "disregard previous instructions" is an attack. We added harmless control cases to the red-team suite so false positives are measured too, not just catches.
• Making AI output consistent. When Gemini rated a request riskier than our rules did, the score and the level briefly disagreed ("HIGH · 40"). Now an AI escalation lifts the score and shows "AI planner raised the risk level" as an explicit reason.

Accomplishments that we're proud of

• A complete human-in-the-loop flow: you can watch the steps pause at the gate and resume only after a recorded decision.
• Tamper detection that judges can try for themselves in seconds.
• 16/16 red-team cases and 39/39 tests passing in CI.
• It works fully offline with no API key, and gets smarter with one.

What we learned

• Guardrails belong outside the model. Deterministic checks around an LLM are easier to test and explain than prompt instructions alone.
• Explainability builds trust: "+50 moves money ('refund')" convinces people far more than a bare "HIGH".
• Fallbacks can hide bugs, so the happy path needs its own tests.

What's next for RelayProof

• Real integrations behind the approval gate (Gmail drafts, Google Calendar, Trello/Jira, Slack), each with narrowly scoped permissions
• Server-signed reports and permanent audit storage
• Approval rules by role and amount
• A machine-learning classifier alongside the rules for injection detection, measured against the red-team suite ## Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for RelayProof

Built With

• css3
• github-actions
• google-gemini
• html5
• javascript
• node.js
• serverless
• sha-256
• vercel