Policy editor — active policy and reviewer restrictions.
Worker execution — staging dispatch and successful completion.
Production denied, staging allowed — the authorization decisions.

Signalbox — governed actions for AI agents

Signalbox checks an agent’s proposed action against current policy before a worker can act on connected systems. A refusal becomes structured feedback the agent can use to choose a permitted alternative. Operators can inspect the decision, policy version, transaction, and worker result in one activity view.

Inspiration

Giving an agent access to a tool should not mean giving it unrestricted authority. I built Signalbox to let operators define and change the rules governing agent actions, while giving agents useful feedback when a request is refused.

Demonstrated behavior

A real NVIDIA Nemotron Ultra planner and Super operator edited a disposable website in Nebius Sandbox and passed its Python check. Signalbox denied the production request. Nano initially recommended human review; that recommendation did not create an approval request.

I continued the saved run with an explicitly configured staging alternative. Nano selected staging, Signalbox independently authorized the request, and a worker published the saved patch to a local filesystem destination. The published file matched the recorded SHA-256 digest.

Governance Studio also demonstrated that changing only the active policy changes the same principal’s same-input production decision from allowed to denied, then back after rollback. A reviewer cannot publish policy. Administrative policy publication is separate from approval of an individual action.

How I built it

Signalbox exposes a constrained MCP action catalog, stores content-addressed governance bundles, and uses PostgreSQL for authorization and transactional records. ModelLang declares the baseline rules and generates the authorization boundary. Active tenant restrictions supplement mandatory isolation and baseline safety rules.

Running agents see current policy on their next invocation. Workers reject stale queued authorization and use database locks to coordinate execution with policy publication.

Agents hold scoped Signalbox tokens. Downstream connector credentials remain with the host. NVIDIA Nemotron models provide planning and action selection through Nebius Token Factory, while Nebius Sandbox provides the disposable coding environment.

Challenges and what I learned

The key challenge was keeping policy decisions connected to what actually happens. A model’s recommendation is not an approval, an authorized request is not a completed action, and a queued action may become invalid when policy changes.

I made those stages explicit and recorded evidence for each. Recovering and continuing the demonstration also reinforced the value of saved artifacts and verifiable results: I could reuse the checked patch and confirm the published file without repeating the coding work.

Evidence and limits

All 77 tests passed. The demonstrated continuation verified authorization, dispatch, worker success, and the published file. A subsequent hosted verification confirmed production denial, staging authorization, worker execution, and the published artifact over HTTPS using the same checked artifact.

The narrated walkthrough presents saved local evidence, including a continued run, rather than an uninterrupted live execution. Transaction idempotency and connector recovery reduce duplicate effects; Signalbox does not claim universal exactly-once execution across arbitrary external APIs.

Watch the narrated demo and explore the source code. Supporting records are available in the hosted verification results and original run evidence.