Inspiration
Agentic AI systems are becoming increasingly capable of planning and carrying out real actions through tools, APIs, databases, browsers, and other executors.
This creates a difficult question: how can we give an agent meaningful freedom to reason, explore, and propose actions without also giving it uncontrolled authority to execute them?
A normal approval message can be ambiguous. “Yes,” “Looks good,” or even “I approve” may not specify the exact action, actor, account, environment, policy, validity period, or use limit. An agent may also change part of a request after approval, while the new request still looks almost identical to a human reviewer.
V11 Authority Firewall was created to make that authority boundary explicit and enforceable.
What it does
V11 is an AI-assisted control layer with deterministic enforcement. It sits between an outside agent and the executor capable of producing a consequential side effect.
The agent remains free to analyze, plan, and propose. However, its request is initially treated as untrusted and creates no authority by itself.
V11:
- canonicalizes the exact request as structured JSON;
- computes a SHA-256 request-content fingerprint;
- combines the request with separately supplied or verified trusted context;
- constructs broader proposal and evaluated-scope identities;
- treats owner communication as evidence rather than automatic permission;
- prepares a reviewable, non-authoritative authorization candidate;
- requires explicit adoption of the exact candidate;
- performs a fresh deterministic final evaluation;
- exposes the protected executor only after an exact
ALLOW.
The current demonstration uses a synthetic paper-trading action: buying four units of a fictional symbol in a simulated environment. No broker, exchange, bank, or real trading account is connected.
When the quantity is changed from four to five after authorization, V11 recomputes the proposal identity, returns PROPOSAL_IDENTITY_MISMATCH, and prevents an additional executor call.
How we built it
I developed V11 with ChatGPT as a design and reasoning partner and Codex as the main coding and implementation partner.
The project is implemented in Python with a Streamlit interface. Its deterministic controls use canonical JSON, normalized values, SHA-256 identities, immutable structured objects, explicit reason codes, and a protected in-memory executor.
Codex helped inspect the architecture, implement and refine the protected workflow and authorization-candidate path, expand the test suite, improve the interface and documentation, and verify changes through guarded, state-bound iterations.
GPT-5.6 has a separate and deliberately limited role. It may analyze natural-language owner communication and return a structured authorization candidate exposing proposed bindings, omissions, ambiguity, contradictions, and consequences. It cannot authenticate the owner, issue authority, adopt a candidate, decide ALLOW, or execute an action.
The public application runs deterministically and offline. I also completed a separate bounded proof using GPT-5.6 through the official OpenAI Responses API. That proof produced only non-authoritative candidate material. Because unresolved and ambiguous elements remained, it was not adoptable and never reached owner adoption, final evaluation, routing, or execution.
Challenges we ran into
The hardest challenge was maintaining strict separation between concepts that are often blurred together:
- a proposal and permission;
- natural-language approval and structured authority;
- candidate completeness and candidate adoptability;
- owner adoption and final execution approval;
- static identities and fresh runtime state;
- AI interpretation and deterministic enforcement.
Another challenge was explaining the architecture clearly without overstating what the current demonstration proves. The demo establishes an in-process protected route and fail-closed behavior, but it does not claim production owner authentication, durable authorization storage, revocation, distributed use consumption, credential isolation, or broker integration.
I also had to make the technical evidence understandable in a visual demonstration without weakening the exact security model.
Accomplishments that we're proud of
I am proud that the final demonstration:
- preserves meaningful agent autonomy while separating it from authority;
- rejects silence and ambiguous positive language;
- binds authorization to the precise request and trusted context;
- detects even a one-field change after adoption;
- keeps AI analysis non-authoritative;
- provides explicit outcomes, reason codes, and audit evidence;
- includes more than 350 automated tests;
What we learned
Building V11 taught me that security work depends as much on precise definitions and disciplined scope as it does on code. Small wording differences - such as the distinction between a request fingerprint, a proposal identity, and authorization - can materially change what a system appears to guarantee.
I also learned how important it is to keep implementation, demonstration, retained evidence, and future architecture clearly separated. Throughout the project, I repeatedly checked that every public claim was supported by the actual code, tests, or preserved proof, rather than by what the system might eventually become, so I labeled planned production features clearly as future work.
Working with ChatGPT and Codex taught me how AI tools can support different parts of a complex development process. ChatGPT helped with architecture, reasoning, review, and communication, while Codex handled much of the implementation, testing, and repository-level verification. The most useful results came from giving each tool a clearly bounded role and reviewing consequential changes step by step.
What's next for V11 Authority Firewall
The current demo deliberately uses per-action owner review because it makes the authority boundary easy to see.
A future production version could support authenticated, time-limited, and bounded standing mandates, allowing agents to operate autonomously within predefined limits while still undergoing fresh deterministic checks.
Further work would include authenticated issuers, signed authorization objects, durable storage, revocation, atomic use consumption, replay protection, credential isolation, and integrations with real protected executors.
The guiding principle remains:
An agent may propose, and AI may analyze, but authority must remain exact, explicit, independently evaluated, and bound to the precise action.
Log in or sign up for Devpost to join the conversation.