Inspiration

AI agents are starting to send emails, share files, issue refunds and talk to customers on their own. Most "undo for agents" tools focus on what an organization owns: they roll back a database row or restore a file from a snapshot. But the mistakes that really hurt are the ones that leave the building. When an agent emails a patient's discharge summary to the wrong clinic, or pastes a production API key into a support reply, a rollback does nothing. The data is already out.

The stakes are already high before agents enter the picture:

Healthcare is the costliest industry for data breaches, at an average of \$7.42 million per breach, and those breaches take 279 days on average to identify and contain (IBM Cost of a Data Breach 2025).
60% of breaches involve a human element (Verizon DBIR 2025), and AI agents are now taking on many of those same human tasks.
In 2024, records exposed through unauthorized access and disclosure incidents (the category that includes data sent to the wrong recipient) nearly doubled, from 8.4 million to 16.1 million (HIPAA Journal).

When a disclosure happens, HIPAA requires a breach risk assessment, and one of its four factors is simply: was the information actually acquired or viewed? Today most organizations answer that by hand, days later, from scattered logs. We wanted a system that answers it in seconds, and that takes the data back wherever that is still possible.

What it does

Tether sits between an AI agent and its outbound tools, and responds to every mistake in three tiers:

Reverse. Many "final" actions have a kill switch: revoke a public share, rotate a leaked key, cancel an order, purge an internal email.
Contain by design. The gateway never lets sensitive data leave as a payload. It rewrites the email to carry an expiring, per-recipient link instead, so "unsend" becomes "revoke the link".
Prove. When nothing can be undone, Tether reads the access logs and decides whether anyone actually saw the data.

Every incident ends in exactly one of four verdicts: REVERSED, CONTAINED, EXPOSED or ESCALATED. Tether then drafts the incident report, a pre-filled HIPAA four-factor risk assessment and a deletion request to the recipient. All of them wait for a human to approve them.

In the live demo, the audience is the outside world: they scan a QR code, open the link the agent sent, and watch it flip to "revoked" on their own phones, within 2 seconds of the presenter pressing Recall.

By the numbers

Result	Value
Correct verdicts on seeded scenarios	14 / 14
Correct verdicts on held-out scenarios (never used during development)	10 / 10
False "safe" verdicts (CONTAINED or REVERSED) under fuzzing	0 in 600 incidents, 302 of them with injected log outages, truncation, clock skew or failed reversals
Falsified AI drafts that got past the fact guardrail	0 of 8,885
Time for open phones to show "revoked" in the live demo	under 2 seconds
Third-party dependencies	0 (pure Python standard library, including the QR encoder)

How we built it

Tether is written in pure Python (standard library only), with a single-page dashboard.

Gateway: classifies each action (revocable, compensable, purgeable or irreversible), rewrites payloads into links, and holds irreversible actions for approval.
Ledger: append-only and hash-chained, so tampering is detectable: ⁠ h_i = SHA256(entry_i ‖ h_(i−1)) ⁠
Recovery engine: fully deterministic. The playbooks never trust their own return values; after acting, they re-read the target system's state to confirm the result.
Evidence collector: a log counts as proof only if it is available, covers the whole window from the action to the revocation, and agrees with the reference clock: $$|t_{\text{log}} - t_{\text{ref}}| \le 2\,\text{s}$$
Fact guardrail: the language model only writes; it never decides. A draft $d$ is accepted only if every fact extracted from it (verdicts, timestamps, counts, email addresses, identifiers) comes from the engine's output $E$: $$\text{accept}(d) \iff F(d) \subseteq F(E)$$
Replay: reruns the exact same events in a world with no gateway and no recovery, and animates both side by side.
Live demo: serves real links to phones on the venue Wi-Fi, using a QR encoder we wrote from scratch (including Reed–Solomon error correction over $\mathrm{GF}(2^8)$), so it works with no internet connection.

All external systems (mail, file share, key vault, order API) are mocks with realistic access logs, and all patient data is synthetic.

Challenges we ran into

"No log" is not "no access." The hardest design rule was refusing to say "probably fine". We made missing, truncated or clock-skewed logs always produce ESCALATED, and built a fuzzer to try to break that rule. Across 600 random incidents (302 with injected faults), Tether produced zero false CONTAINED or REVERSED verdicts.
Keeping the LLM honest. It was easy to make a model write a fluent report; it was hard to guarantee the report didn't invent a time or a count. We mutated 8,885 drafts (a wrong verdict, a shifted timestamp, an extra record) and the guardrail rejected every one.
The live demo behaved differently from the tests. Drafting with a model made the "Recall" button block the phones' status checks, and a room of 40 phones made the replay drag on for over a minute. We moved drafting to the background and batched similar accesses, so a replay takes the same handful of steps whatever the size of the room.
Exposing a laptop on public Wi-Fi safely. Phones may only reach the link pages, never the dashboard. That includes traffic arriving through a tunnel, which looks local to the server, so we had to check the request's host and forwarding headers too.

What we learned

Most of "undo" for outbound actions has to be designed in before the action happens. Sending pointers instead of payloads turns an irreversible email into a reversible link.
ESCALATED is a feature, not a failure. A safety system earns trust by saying "I can't prove it" instead of guessing.
Splitting the work between a deterministic engine that decides and a language model that only writes, with a checker in between, is a pattern that can apply well beyond incident response.

What's next

Real connectors for Gmail, Microsoft 365, Google Drive, secrets managers and Stripe; GDPR workflows alongside HIPAA; a detector that raises incidents automatically from anomalous outbound actions; and per-recipient link policies such as single view and watermarking.