TaskFence Ai

Useful power. Hard boundaries. Verifiable proof.
Clara, the OpenAi assistant-agent
TaskFence hero-1
TaskFence hero-2
TaskFence ad
TaskFence hero-3
TaskFence hero-4

Inspiration

Ai assistants are rapidly moving from answering questions to acting on human intent. They can shop, book travel, transfer assets, and call powerful tools, but instructions alone are not enforceable authority.

TaskFence Ai began with a simple question: how can we let an Ai agent be genuinely useful without giving it unlimited power?

We wanted a system where the user defines exactly what the agent may do, including its spending limit, scope, deadline, provider, and number of actions. The agent can reason and recommend freely, but consequential actions must remain inside those boundaries. Our guiding principle became: Help, Always Within Bounds.

Our thesis is finite manual bounds now, perhaps a user profile later, where your intents are known and enforced on a protocol level.

What it does

TaskFence Ai is an enforcement gateway for user-controlled agentic autonomy. The user chooses an intent and creates a machine-checkable "Fence" containing the permitted money, time, scope, merchant, and action limits. An Ai agent may propose an action, but it cannot authorize itself or directly access provider credentials.

TaskFence independently evaluates every proposal. If the action is permitted, TaskFence atomically reserves the required authority before calling the provider. If the action exceeds the Fence, it is stopped before provider execution.

Our working "Buy an Item" demonstration connects: -A real OpenAI agent for structured action proposals -Deterministic TaskFence policy enforcement -An atomic SQLite authority ledger -Stripe test mode for provider execution -Output filtering before results return to the agent -Ed25519 signed receipts -Cloudflare Turnstile, rate limits, daily limits, and a persistent circuit breaker -Signed operator alerts delivered through n8n and email

The "adversarial scenario" demonstrates an over-ambitious agent recommending a helpful-looking protection plan. TaskFence denies the unauthorized add-on before Stripe is called, while still allowing the original purchase to complete. No real money moves in this demonstration.

How we built it

TaskFence Ai is a modular TypeScript monorepo built with Bun. The user interface is built with Next.js and deployed through Vercel. Cloudflare provides DNS, TLS, proxy protection, Managed Turnstile, and a private Tunnel to the enforcement broker.

The broker runs inside a hardened Docker container on a Hostinger VPS. It has a read-only application filesystem, no unnecessary Linux capabilities, server-only credentials, persistent safety state, and no directly exposed public application port.

The OpenAI agent receives proposal-only tools. Its structured output is schema-validated and treated as untrusted input. TaskFence then evaluates the request using deterministic rules, reserves capacity through SQLite, and calls Stripe’s test API only after authorization succeeds. Successful actions produce filtered output and a signed receipt. Security and audience events enter a persistent outbox, receive an HMAC signature, and are verified by n8n before an operator email is sent.

John shaped the product, safeguards, visual experience, and interaction model while working closely with Codex. Codex accelerated the protocol design, implementation, adversarial testing, deployment, documentation, and production verification.

Challenges we ran into

The hardest challenge was separating intelligent reasoning from actual authority. The Ai needed enough freedom to help, but it could never be trusted to decide whether its own request was authorized.

We also had to account for concurrency, replay attempts, provider failures, output leakage, expired authority, cumulative spending, and partial execution. A simple spending-limit check was not enough. TaskFence needed atomic reservations, lifecycle controls, output policies, and fail-closed behavior.

Another challenge was presenting complex enforcement in a way that normal users could understand. We built an Authority Card, animated meters, plain-English explanations, Ai narration, a dramatic denial sequence, and signed proof artifacts without pretending that presentation graphics were protocol evidence.

Deployment introduced additional work across Vercel, Cloudflare, Docker, Hostinger, Turnstile, n8n, DNS, CORS, secret isolation, and Windows plus WSL development.

Finally, we maintained strict truth labels so judges can distinguish real OpenAI reasoning, real TaskFence enforcement, Stripe test mode, scripted provider previews, and visual presentation.

Accomplishments that we're proud of

We are proud that TaskFence Ai became a complete, working vertical slice rather than a visual prototype.

The public "Buy an Item flow" uses a real OpenAI agent, real deterministic enforcement, a persistent authority ledger, and Stripe’s real test API. The controlled breach proves that an unauthorized action is denied before reaching the provider.

The project currently passes 135 automated tests with 658 assertions across 24 test files. These tests cover enforcement, privacy, concurrency, replay protection, lifecycle controls, provider boundaries, signed receipts, output filtering, public-demo security, alerting, and ledger reconstruction.

We also deployed: -A public interface at TaskFence.me -A hardened private broker -Cloudflare bot protection and traffic controls -Persistent daily usage limits and a circuit breaker -Privacy-preserving audience milestone alerts -HMAC-verified n8n email notifications -Cryptographically signed receipts with tamper detection -A clear adversarial demonstration that remains understandable to nontechnical users

Most importantly, TaskFence does not merely ask the Ai to behave. It controls whether the consequential provider call can happen.

What we learned

We learned that prompts are not authority controls. A system prompt can guide an agent, but only an independent enforcement boundary can prevent an unauthorized external action.

We learned to treat every agent proposal as untrusted input, even when the model is capable, helpful, and aligned with the user’s general goal.

We also learned that authority should be reserved before execution. Without atomic reservation, multiple valid-looking requests could collectively exceed the user’s limit.

Provider provenance must be recorded per run rather than inferred from a global application mode. A single system may contain deterministic previews, sandbox providers, and future production adapters at the same time.

Finally, we learned that denial evidence can be as compelling as successful execution. Showing that the provider was never called makes TaskFence’s value immediately understandable.

What's next for TaskFence Ai

Next, we plan to turn the working shopping vertical slice into a reusable protocol and developer platform.

Planned work includes: -Flight, money-transfer, and stock-trading provider adapters -A public SDK and expanded MCP tool surface -Durable signing identities and public receipt verification -Nested and delegated Fences that can narrow, but never broaden, parent authority -True in-flight pause, revocation, and human approval -Streaming execution events backed by authoritative server state -Organization policies, shared budgets, and operator dashboards -AgenticDID integration for optional agent and human identity verification -Additional payment, commerce, workflow, and agent-framework integrations -Independent security review and production hardening

Any future real-money deployment would require additional compliance, provider authorization, durable key management, reconciliation, and operational auditing.

Our long-term goal is for TaskFence to become the standard authority layer between human intent, Ai reasoning, and consequential action.