Vital

Inspiration

Right now, everyone is focused on making AI agents more capable, more autonomous, and able to do increasingly impressive things. And that is exciting—but the more authority we give these systems, the more consequential their mistakes can become.Imagine companies using autonomous agents to make purchases, execute workflows, manage infrastructure, or make decisions based on information that later turns out to be wrong. We keep asking, “What else can agents do?” But I became interested in a different question:As agents gain more power, how do we know when they should still be allowed to use it?That question made me wonder on how fragile can some automated AI agents be . Some personnal SAT research also helped me view this problem in a different way , That's when I taught abt building VitalWhen I started thinking about how to design it, I wanted inspiration from something that had already solved an incredibly difficult version of this problem. So I looked at ourselves. I believe the human body still holds an almost infinite number of secrets and ideas that we can learn from. Our biological systems have spent millions of years evolving ways to survive uncertainty, contain damage, remember threats, recover selectively, and decide when different actions are safe. That became the inspiration behind VITAL's architecture. The core idea is that an agent can be healthy enough to research, but not healthy enough to act—just as the same human body can be healthy enough to walk while not being healthy enough to run a marathon. Same system. Different action. Different definition of “healthy enough.” VITAL takes that principle into the world of AI agents. It tracks when the information behind an agent's decisions becomes unreliable, how that uncertainty propagates, and whether the next action can tolerate the resulting trust debt.And there is something else that made this project possible for me. I am building at a moment when tools like Codex and GPT-5.6 give individual builders the ability to attempt things that previously might have required entire teams. For someone like me, that changes what it means to have an idea. The distance between “What if this existed?” and “I built it” is becoming smaller. Everyone is building agents that can do more. I wanted to build something that asks whether they should.

What it does

VITAL is a trust-control and authorization layer for AI agents operating with consequential tools.Most agent systems focus on capability: can the agent complete the task?VITAL focuses on a different question: Does the agent's current evidence actually justify giving it the authority to perform this specific action? VITAL treats trust as dynamic and action-dependent rather than as a permanent label attached to an agent. The same agent, working from the same evidence, can be trustworthy enough to perform one action while not being trustworthy enough to perform another. As an agent works, VITAL tracks contradictions and contaminated evidence, follows the uncertainty that depends on it, and preserves unresolved liabilities as trust debt. That accumulated state is then evaluated against the requirements and consequences of the specific action the agent wants to perform. But the mechanism that genuinely differentiates VITAL is that it does not merely measure how trustworthy an agent currently looks.It tracks where uncertainty came from, where that uncertainty propagated, and whether the next action can tolerate the accumulated trust debt. An uncertainty that is tolerated for one action does not simply disappear because that action was permitted. VITAL preserves the unresolved liability and carries it forward. As the agent moves toward more consequential actions, that history matters. This creates a form of selective, consequence-aware authority: an agent does not have to be completely shut down because one piece of evidence became unreliable, but it also cannot silently carry unresolved uncertainty into an action whose consequences require a higher level of trust. In VITAL's demonstration, an AI agent is evaluating a supplier when conflicting information appears about a critical certification.The agent can still perform lower-consequence actions such as continued research and disclosed drafting. But VITAL does not forget the unresolved problem. The uncertainty remains part of the agent's trust state and can accumulate as trust debt.Then the same agent attempts a $42,000 purchase.The agent has not changed. The underlying evidence has not suddenly become worse.The consequence of the action has changed. At that point, VITAL determines that the unresolved contamination and trust debt are no longer acceptable for the requested action. Authority is withheld, and the protected tool remains locked. VITAL then supports targeted recovery rather than treating the entire agent as permanently untrustworthy. A registered, server-controlled verifier can provide trusted evidence addressing the specific problem. Recovery is selective: trusted verification must resolve the actual affected evidence and liabilities before authority can be restored. If the verification genuinely resolves the problem, VITAL deterministically recalculates the affected state, reassesses the action, and can restore authority. If verification remains inconclusive, authority is not restored. The protected tool stays locked and the decision requires human review. The trust boundary is deliberate. GPT-5.6 can interpret messy, unstructured evidence, but it cannot grant itself authority. Caller-controlled evidence cannot promote itself into trusted recovery, and model interpretation alone cannot directly authorize a protected action.Final authorization remains governed by deterministic VITAL logic. The procurement workflow is a demonstration of the architecture, not its intended limit. Developers can place VITAL between existing agents and protected tools, with server-registered policies and trusted verifier adapters configured for different domains.So VITAL does not just ask:"Is this agent trustworthy?" It asks: "Given what this agent currently knows, where that information came from, what uncertainty it has accumulated, and what it is about to do — should it be allowed to act right now?" That is the core mechanism behind VITAL: Uncertainty has provenance. Uncertainty can propagate. Unresolved uncertainty creates trust debt. And the amount of trust debt an agent can safely carry depends on what it is about to do. As AI agents become capable of doing more, VITAL is infrastructure for deciding when they should actually be allowed to do it.

How we built it

VITAL was built around one rule: the AI model can help understand evidence, but it should never be able to give itself permission to act. GPT-5.6 handles the part where language models are most useful. It interprets messy, unstructured evidence and turns it into structured information about claims, contradictions, uncertainty, and relationships between evidence. From there, the trust and authorization layer is deterministic. GPT-5.6 can interpret the situation, but it cannot decide that an agent is suddenly safe enough to execute a protected action. The system tracks contaminated evidence, where uncertainty propagates, and the trust debt that remains when unresolved information is carried forward. When an agent requests a new action, VITAL evaluates its current trust state against the requirements of that specific action. If those requirements are not met, no valid authorization is issued and the protected tool remains locked. Recovery follows the same trust boundary. Evidence submitted by an agent cannot simply declare itself trustworthy and clear its own liabilities. Trusted recovery comes through registered, server-controlled verification. When verification genuinely resolves a problem, VITAL uses that trusted provenance to selectively resolve the affected liabilities and reassess the action. If the problem remains unresolved, authority stays withheld. But one of the most important parts of building VITAL was how I used Codex. At first, Codex was my engineering partner. It helped me turn the idea into an actual system, implement the architecture, build the integration layer, write tests, refine the interface, and eventually get VITAL running in Production. Then I realized something slightly ironic: I was building a system whose entire purpose was questioning whether something should be trusted, while mostly asking Codex to help me prove that my own project worked. So I changed the relationship completely. I asked Codex to become VITAL's biggest hater. Instead of asking, "Does this work?", I started asking it to find every reason it might not. We tried to break the trust boundaries. We tested whether an agent could fake trusted recovery, underestimate the consequence of an action, carry authorization into the wrong policy or state, or exploit assumptions I had not noticed. And it worked. Codex started finding problems in the same project it had helped me build. That may have been one of the best decisions I made during the entire project. There was something almost strange about watching Codex attack its own work. A failure would appear, we would trace exactly why it happened, fix the underlying problem, and then turn that failure into a permanent regression test. The system would get challenged again, fail somewhere new, learn from that failure through a new architectural constraint or test, and become harder to break the next time. At one point, everything passed locally, but the real GPT-5.6 path behaved differently in Production. Trusted recovery failed. We found the reason, fixed it, deployed again—and another deeper edge case appeared. Instead of hiding those failures or working around them, we kept following them. One bug revealed that trusted recovery was accidentally depending on GPT-5.6 reproducing a deterministic resolution. Another revealed that two semantically identical facts could be given different names by the model, preventing legitimate recovery. Both times, the answer was not to give the model more authority. We strengthened the boundary so trusted verifier output and provenance could enter deterministic recalculation without depending on the model to approve or reproduce them. Watching that process felt, in a strange way, like watching something grow up. Not because VITAL literally learns by itself, but because every mistake we discovered left something behind: a stronger boundary, a clearer rule, or a regression test that made sure the same mistake could not happen again. The failures became part of the architecture. By the end, Codex had played two completely opposite roles. It helped build VITAL, and then it tried as hard as it could to ruin it. And that second role may have been even more valuable than the first. The final version passes 43 regression tests, alongside rendered UI tests, production builds, and live validation of both the successful recovery and human-review paths. More importantly, many of those tests exist because something genuinely failed first. For me, that became one of the biggest lessons of this project: tools like Codex are incredibly powerful when you ask them to help build something, but they can be even more valuable when you give them permission to challenge everything they just helped you create. GPT-5.6 gave VITAL the ability to interpret messy evidence. Codex helped me build it, attack it, and strengthen it. And VITAL's deterministic architecture makes sure that, in the end, neither of them can simply decide for themselves when an agent deserves the authority to act.

Challenges we ran into

We ran into a lot of challenges. Honestly, some of the biggest improvements in VITAL exist specifically because something broke first. One of the hardest challenges was making sure the boundary between AI interpretation and actual authority was real. GPT-5.6 needed enough freedom to interpret messy evidence, but it could never be allowed to decide that its own interpretation was trustworthy enough to authorize an action. Finding that balance took multiple iterations. Trusted recovery was especially difficult. We had to make sure that an agent could not simply submit evidence claiming that everything was fine and regain authority. Recovery had to come from a genuinely trusted, server-controlled path, while ordinary caller-submitted evidence remained untrusted. Then came the adversarial testing. Once the core system worked, I asked Codex to stop helping me prove VITAL worked and start trying to prove that it didn't. That uncovered problems I probably would never have found by only testing the expected path. We tested whether an agent could fake recovery evidence, underestimate the consequence of a $1,000,000 action to receive weaker safety requirements, or reuse an authorization under a different policy or state. Every time we found a real weakness, we fixed the underlying problem and added a regression test for it. Production gave us another completely different set of problems. At one point, all the tests passed locally, the application deployed successfully, and everything looked ready. Then the successful demo failed in Production. We discovered that trusted recovery was still depending on GPT-5.6 to reproduce information that the trusted verifier had already established deterministically. The model could interpret the same evidence differently, so legitimate recovery could fail. We fixed that by making trusted verifier output cross directly into deterministic recalculation instead of requiring model confirmation. We deployed again. Trusted recovery worked, but the interactive demo still failed. This time, the problem was even more subtle. GPT-5.6 could describe the same fact using a different internal fact key from the deterministic recovery system. The meaning was the same, but the names were different, so VITAL could fail to connect the trusted resolution back to the original contamination. We solved that by making trusted recovery depend on server-controlled provenance and explicit resolution mappings instead of model-generated names. That debugging process was probably the most stressful part of the build, but also one of the most valuable. Each time we thought we had reached the final version, another edge case challenged an assumption in the architecture. Instead of patching the demo to make it look like it worked, we kept tracing the actual root causes. By the end, VITAL went from simply passing its intended scenarios to having 43 regression tests covering many of the ways we had discovered it could fail. The biggest challenge was not making VITAL work once. It was making sure that when something unexpected happened, the system failed safely instead of quietly granting authority it should not have. And in a strange way, the problems became part of the project. Every failure forced us to understand VITAL better, and almost every serious bug left the system with a stronger boundary than it had before.

Accomplishments that we're proud of

What we learned

I think the accomplishment I am most proud of is that VITAL became much more than the idea I started with. What began as a question about whether AI agents should always keep their authority became a working system with an actual trust model, deterministic authorization boundaries, targeted recovery, an integration path for external agents, and a live Production deployment. I am especially proud of the mechanism behind VITAL. It does not just calculate a risk score and decide "safe" or "unsafe." It remembers where uncertainty came from, tracks where it propagated, preserves unresolved liabilities as trust debt, and evaluates whether that history is acceptable for the specific action an agent wants to take. Building something that could express the idea that an agent can be trustworthy enough to research but not trustworthy enough to act was one of the moments when VITAL started feeling real to me.

I am also proud that I did not stop when the happy path worked. I actively tried to destroy the system I had just built. Some of the most important parts of VITAL today exist because Codex found a way to challenge an assumption, Production exposed something my tests had missed, or an adversarial scenario forced me to rethink a trust boundary. Those failures eventually became 43 regression tests and a much stronger architecture. Getting both core outcomes working live in Production was another huge moment for me: trusted verification can restore autonomy when the actual problem is resolved, while inconclusive verification keeps the protected tool locked and requires human review. Seeing those two paths finally behave correctly after everything it took to get there was incredibly satisfying. I am proud that GPT-5.6 is genuinely part of the architecture without being given authority it should not have. It can do what language models are good at—understanding messy information—while deterministic logic remains responsible for whether a consequential action is actually authorized. I am also proud that VITAL is not limited to the procurement scenario shown in the demo. The project includes an integration path designed around placing VITAL between an existing agent and a protected tool, with policies and trusted verification adapted to the domain. The $42,000 purchase is the example that makes the mechanism visible; it is not the idea's boundary. And, on a more personal level, I am 16 years old and built this project from Morocco (with my parents' knowledge and consent). I did not start this project with a team of security engineers or years of professional experience. I started with a question I could not stop thinking about and tools that gave me the ability to try building the answer when i only had very limited access to these things just a year ago. But what I am probably most proud of is simply that I kept going. There were moments when everything passed locally and then failed in Production. Moments when fixing one problem revealed another one underneath it. Moments when I genuinely thought I had reached the final version, only to discover one more edge case hours before the deadline. And I kept pushing through every single one of them. Every failure forced me to understand my own project better. Every bug exposed an assumption I had not questioned yet. Every time VITAL broke, I had the choice to hide the problem, work around it, or actually understand why it happened and make the system stronger because of it. I chose the last one. So the accomplishment I am proudest of is not a test count or a feature. It is the fact that I kept pushing through the entire project, even when it kept fighting back, and somehow every failure that could have killed the project ended up becoming part of what made it stronger.

What's next for Untitled

The current version of VITAL is an MVP, but I do not want it to stay one. My next goal is to turn VITAL from a working demonstration into infrastructure that developers can realistically integrate into different kinds of AI agents and systems. The procurement scenario proves the core mechanism, but VITAL should not be tied to one workflow, one industry, or one type of action. I want developers to be able to define the policies, protected tools, consequences, and trusted verification mechanisms that make sense for their own domain. I also want to make VITAL as accessible as possible. My goal is for the core technology to be free to use, so that adding a layer of trust and control to an AI agent is not something reserved only for companies with huge security budgets. If autonomous agents are going to become part of everyday businesses and eventually much more of our lives, the infrastructure that helps prevent them from acting on unreliable information should be available to the people building them. Technically, there is still a lot I want to improve. I want to make integration much simpler, expand the policy system, support more trusted verifier adapters, strengthen protections for distributed and production-scale deployments, and test VITAL against far more complex agents and real-world failure scenarios. Eventually, I want VITAL to become something developers can place between almost any capable agent and the consequential tools it controls without having to rebuild the entire agent around it. The MVP askss whether the idea can work. What comes next is making it work at the scale where it actually matters. AI agents are only going to become more capable and more autonomous. I want VITAL to grow alongside them, not to limit what they can become, but to make sure that as their capabilities grow, their authority remains justified. The future of AI should not only be about giving agents more power. I want to help build the infrastructure that makes that power safer to use.

Built With

• codex
• gpt-5.6
• next.js
• node.js
• openai
• react
• typescript