TRUST GATE

Trust Gate : Verify every AI agent action before it becomes a real-world consequence.

Comment

Inspiration

AI agents are becoming capable of issuing refunds, changing accounts, accessing customer information, and performing other real-world actions. Traditional permissions only determine what an agent can do. They do not determine whether the action is safe, properly authorized, or appropriate in the current context.

This inspired us to build TrustGate—a pre-execution safety layer that checks every proposed AI-agent action before it is executed.

TrustGate separates an agent’s ability to propose an action from its authority to execute it.

What it does

TrustGate receives an action proposed by an AI agent and evaluates four important risk factors:

  1. Blast radius — How many users, systems, or records could be affected?
  2. Ambiguity — Is the user’s intention and business context clear?
  3. Track record — How reliable has this agent been previously?
  4. Permission risk — Does the requested action exceed the agent’s authority?

Based on these factors, TrustGate calculates an explainable risk score and selects one of four routes:

  • AUTO-EXECUTE — The action is clear, authorized, reversible, and low-risk.
  • CLARIFY — Important information or user intent is missing.
  • ESCALATE — The action must be reviewed before execution.
  • BLOCK — A strict permission or safety policy has been violated.

For example, a verified password reset may be allowed automatically. A large refund with unclear authorization is escalated. Unauthorized deletion of customer records is blocked immediately.

Human approval workflow

When TrustGate returns ESCALATE, it automatically creates a pending approval request and pauses the proposed action.

The reviewer can examine:

  • The original action and business context
  • Financial impact
  • Number of affected users
  • Data sensitivity
  • Reversibility
  • Risk-factor scores
  • Triggered policy rules
  • TrustGate’s suggested response

For the hackathon MVP, the same authenticated user can run an assessment and complete its approval. This keeps the demonstration accessible through one account. A production deployment would support stricter separation between requesters, reviewers, administrators, and auditors.

Trust Budget

TrustGate maintains an adaptive Trust Budget for each agent.

Correct and reliable behaviour increases trust gradually, while human corrections reduce trust more strongly. The updated score influences how future actions are routed without allowing trust to override deterministic safety policies.

This creates a continuous feedback loop:

Agent proposes action
        ↓
TrustGate evaluates risk
        ↓
Decision route is selected
        ↓
Human feedback is recorded
        ↓
Agent Trust Budget is updated

How we built it

TrustGate was developed as a full-stack TypeScript application.

The frontend provides:

  • A professional animated landing page
  • Registration and login
  • Operational dashboard
  • Interactive assessments
  • Pending approvals
  • Assessment history
  • Audit logs
  • Trust Budget feedback controls

The backend provides:

  • Server-side authentication
  • Database-backed sessions
  • Risk assessment APIs
  • Deterministic policy enforcement
  • Human approval handling
  • Audit-event storage
  • Rate limiting and input validation
  • Optional Claude-based ambiguity analysis
  • Safe fallback behaviour when AI analysis is unavailable

We also created a standalone Model Context Protocol (MCP) tool named assess_action. This allows an external AI agent to ask TrustGate for authorization before executing an action.

const decision = await trustgate.assess_action({
  agentId: "support-agent-mid",
  actionType: "issue_refund",
  action: "Issue customer refund",
  context: "The complaint does not contain clear refund approval",
  amount: 50000
});

TrustGate returns the route, risk score, explanation, triggered rules, clarification question, and reviewer recommendation.

Security design

TrustGate follows a policy-first approach:

  • Deterministic policies remain authoritative.
  • AI-generated suggestions cannot override permission rules.
  • Agent input is treated as untrusted data.
  • Prompt-injection attempts cannot change system policies.
  • Sensitive evaluation logic runs on the server.
  • Every important action creates an audit record.
  • Invalid or incomplete inputs are rejected.
  • Concurrent reviewers cannot complete the same approval twice.
  • If AI analysis fails, the system safely escalates instead of failing open.

Our core principle is:

Models advise. Policies decide.

Challenges we faced

One major challenge was creating a risk engine that produced meaningful and different outcomes instead of returning the same decision for every scenario.

We solved this by combining deterministic rules with contextual scoring across blast radius, ambiguity, track record, and permission risk.

Other challenges included:

  • Creating persistent authentication and sessions
  • Automatically creating approval requests
  • Preventing an approval from being reviewed twice
  • Making local database migrations work correctly on Windows
  • Handling browser authentication cookies
  • Preserving explainability while using AI-assisted analysis
  • Creating a safe fallback when the AI service is unavailable
  • Designing an interface that presents complex security information clearly

Accomplishments

We are proud that TrustGate is more than a visual prototype. The MVP includes:

  • Working registration and login
  • Persistent assessments
  • Four real decision routes
  • Automatic escalation
  • Human approval controls
  • Deterministic blocking
  • Explainable factor scores
  • Adaptive Trust Budgets
  • Complete audit logs
  • A standalone MCP server
  • Safe AI-failure handling
  • Responsive and accessible design
  • Automated build and behaviour tests

What we learned

Building TrustGate taught us that AI-agent safety cannot depend only on model confidence. High-impact systems need deterministic rules, contextual risk analysis, human accountability, and reliable audit evidence.

We also learned how to build MCP tools, manage persistent application state, design risk-scoring logic, implement secure authentication, and create fail-safe agent workflows.

What’s next

Our next steps include:

  • Role-based requester and reviewer accounts
  • Policy-as-code with version history
  • Approval assignment by department
  • Simulation mode for testing policies on historical actions
  • More enterprise-agent integrations
  • Notifications for pending approvals
  • Advanced trust recalibration
  • Production-ready MCP transport
  • Organization-level analytics
  • Cryptographically verifiable audit records

TrustGate’s long-term goal is to become a universal safety gateway for autonomous AI agents.

Verify every AI-agent action before it becomes a real-world consequence.

Built With

Share this project:

Updates

Submission history