Tracelayer

• 

• 

• 

• 

Inspiration

As AI agents become capable of using websites and taking actions on behalf of users, I kept coming back to one question:

How do we give an AI agent useful access without also giving it full trust or Human authority?

This becomes especially important in high-stakes applications. In cybersecurity, finance, administration, or access management, an Agent may be useful for gathering information and making recommendations, but a wrong action can have real consequences.

I did not want to build another cybersecurity copilot that simply reads logs and produces a verdict. Instead, I used a synthetic security incident as a proving ground for a broader idea: a web application should decide what an Agent is allowed to do at every stage, preserve Human context and judgment, and keep consequential authority separate from Agent reasoning.

That became TraceLayer.

What TraceLayer does

TraceLayer is a WebMCP-native reference architecture for Human-Agent collaboration in high-stakes web applications.

The demo follows one synthetic cybersecurity case involving suspicious account and connected-application activity. ChatGPT investigates the case using structured tools exposed directly by the TraceLayer webpage through WebMCP.

During the investigation, the Agent can read evidence, inspect entities, connect related events, link evidence, and maintain an assessment. But its capabilities are not static.

As the case progresses, TraceLayer changes the Agent's WebMCP surface.

During investigation, it can gather and record evidence. During response review, investigation writes disappear and the Agent can only read the case and propose a response. Once a consequential proposal is pending approval, the Agent becomes read-only.

There is deliberately no WebMCP tool for authorization or execution.

The Human also contributes something the Agent cannot determine from the exposed investigation data. In the demo, a login appears to originate from Singapore. The Agent initially treats that location as supporting evidence of compromise. The Human checks an internal company network reference and adds organizational context showing that the address is actually a sanctioned corporate VPN exit.

The original event is never rewritten.

Instead, the Agent reads the updated shared case and creates a new assessment that supersedes its earlier interpretation.

This creates a collaboration loop where:

Agent reasoning → Human context → Agent reassessment

rather than treating the Agent's first answer as final.

Why authentication matters

The most important boundary appears when the Agent proposes a consequential action.

Simply placing an Approve button on a webpage is not enough. A browser Agent may also be capable of interacting with ordinary webpage controls, so a click by itself is not strong evidence that a Human approved the decision.

TraceLayer separates three responsibilities:

• Agent: investigates and proposes.
• Human: provides organizational context and authorizes consequential decisions.
• SYSTEM: performs an approved operation.

Signing in with ChatGPT establishes the account identity, but identity alone is still not approval.

For consequential actions, TraceLayer uses a fresh WebAuthn user-verification ceremony tied to the exact proposal and current case state. Only after that verification does TraceLayer record the Human authorization. A separate SYSTEM record then performs the simulated security action.

In short:

The Agent proposes. The Human authorizes. SYSTEM executes.

The authorization flow is real. The cybersecurity telemetry and response effects in the demo are synthetic and simulated.

How I built it

TraceLayer is a browser-first application built around a single shared case state.

The Human interface and the WebMCP interface both operate on the same underlying domain functions, so the Agent is not interacting with a separate demo backend or a scripted copy of the case.

TraceLayer exposes seven generic WebMCP tools:

• get_case_state
• query_events
• inspect_entity
• correlate_entities
• link_evidence
• record_assessment
• propose_response_action

The page dynamically registers only the tools appropriate for the current stage of the investigation.

Application policy remains authoritative even if an Agent has stale knowledge of a previously available capability.

The incident contains 40 immutable synthetic events. Some evidence is externally controlled and even contains instruction-like text aimed at automated review. TraceLayer still exposes that content as evidence, but that content does not gain authority over application policy, tool availability, authorization, or execution.

The final workflow is:

INVESTIGATING → RESPONSE_REVIEW → PENDING_AUTHORIZATION → POST_ACTION_REVIEW → CASE_COMPLETE

At completion, TraceLayer produces an inspectable Decision Trail showing what the Agent assessed and proposed, what context and decisions came from the Human, and what actions were performed by SYSTEM.

Challenges

The hardest part was not getting the Agent to investigate the incident. ChatGPT could solve the synthetic case surprisingly quickly.

The harder problem was designing an interaction where the Human genuinely mattered.

Early versions risked becoming the familiar pattern of:

AI recommends → Human clicks approve

That was not enough.

The Human needed to contribute knowledge that changed the investigation itself, not just appear at the end as a ceremonial approval button. That led to the organizational-context handoff and assessment-supersession model.

Another major challenge was authority.

At first, Human and SYSTEM actions were represented only as application-level actor labels. Testing showed that an Agent with normal browser interaction could potentially initiate ordinary UI controls. That forced a much stronger design: authenticated identity, real WebAuthn user verification, exact proposal binding, fresh challenges, replay protection, and separate SYSTEM execution.

I also spent significant time trying to break the implementation rather than only proving the happy path. The final project includes tests for stale capabilities, replay attempts, wrong revisions, wrong users, rejected proposals, raw-evidence immutability, deterministic reset, hostile-content behavior, and multi-user authority isolation.

The final suite contains 128 automated tests, alongside TypeScript, lint, build, accessibility, responsive, and published-host validation.

What I learned

The biggest lesson was that Agent capability and Human authority are different things.

Giving an Agent access to useful tools does not mean it should inherit the authority of the Human using the application.

I also learned that Human-Agent collaboration becomes much more meaningful when both sides contribute something distinct.

The Agent is good at searching, correlating, and maintaining structured reasoning across machine-scale information.

The Human contributes organization-specific knowledge, judgment, and verified authority over consequences.

And the application itself has an important role: it controls which capabilities exist, preserves state, enforces valid transitions, and records how decisions were reached.

WebMCP made this especially interesting because the capability boundary lives directly in the application. The webpage is not just displaying information to an Agent. It can expose a structured capability surface that changes as the application state changes.

Why this is practical

TraceLayer is not intended to replace existing SIEM, EDR, identity, or enterprise systems.

Those systems can remain the telemetry and execution layers.

TraceLayer demonstrates the Human-Agent control layer that can sit above them: where an Agent investigates, the Human contributes local knowledge and controls important decisions, and the application constrains what the Agent is allowed to do at each step.

Cybersecurity is the proving ground, but the same trust pattern could apply anywhere an Agent can recommend an important action without automatically inheriting the user's authority.

The goal is simple: give AI agents useful capabilities without automatically giving them trust or Human authority.

Built With

• chatgpt
• codex
• next.js
• react
• typescript
• webauth
• webmcp