Warrant — Trust Gateway for Alexa+ Voice Agents

Warrant: A Trust Gateway for Voice Agents That Spend Money

Voice assistants like Alexa+ are starting to book and buy for us, with no screen to check first. A wrong guess, a network retry, or one malicious prompt injection in a hotel description can turn into a real unauthorized charge.

What it does

You set limits on your phone: a total spend budget, the threshold above which the assistant must ask you, which actions are allowed, and when access expires. The assistant can read these limits but cannot elevate or modify them through any tool it possesses.

When the agent plans a multi-step purchase (e.g. travel), anything above your threshold requires approval on your companion phone. That approval is cryptographically bound to a SHA-256 hash of the exact parameters (RFC 8785 Canonical JSON). If the date, price, or vendor drifts afterwards, execution is deterministically refused.

If step two fails mid-flight (e.g., train sold out), step one (hotel) is undone automatically in reverse dependency order via a compensating saga. Ambiguous network timeouts are actively reconciled against provider truth rather than blindly retried. Every confirmed action produces a detached Ed25519 signed receipt verifiable offline, with an 8-second reversible undo window before settlement.

How we built it

• Core MCP Gateway: Built in TypeScript over the official Model Context Protocol (MCP 2025-11-25 Streamable HTTP transport) with SQLite in WAL mode and integer minor units (cents). • Cryptographic Approvals: Approvals bound to SHA-256 hashes of canonical arguments (RFC 8785) via an out-of-band admin channel. • Compensating Saga Engine: Automated reverse rollback and active timeout reconciler. • Detached Receipts & Audit Ledger: Ed25519 digital signatures and an immutable SHA-256 event chain continuous from genesis. • Amazon Bedrock Converse Loop: Powered by Amazon Bedrock (us.amazon.nova-pro-v1:0) driving the voice assistant loop, with deterministic offline stub fallback for test runs. • Companion Alexa+ Console: Next.js 14 client with dark-mode telemetry, live MCP tool trace inspector, and phone approval portal.

How we know it works

• 11 Adversarial Attack Scenarios: Tested against concurrency storms, mid-plan failures, budget exhaustion, parameter tampering, prompt injection, expired tokens, missing approvals, ambiguous timeouts, forged receipts, undo cancellations, and cross-tenant leakage. • 3 Mutation Tests: Proves that disabling idempotency, approval checks, or tenant isolation turns scenarios S1, S4, and S11 RED on the scorecard (100% mutation kill rate, 0 false greens). • Comparative Benchmark: An intentionally unprotected example server fails 3 of 3 attack scenarios; Warrant passes 3 of 3. • Sub-4ms Gateway Latency: Gateway p95 processing latency is under 4ms on localhost (Search: 3.35ms, Propose: 1.71ms, Execute: 1.20ms).

Alexa+ Architectural Fit

Conforms strictly to the official Alexa+ MCP Streamable HTTP specifications:

• Unauthenticated requests receive deterministic 401 challenges.
• Serves protected resource metadata.
• Identity derived strictly from HTTP Bearer tokens (never trusting tool arguments).
• Dual output: Structured JSON data + natural voice spoken summary ($\le 300$ chars).

Honest Scope & Transparency Disclosure

The genuine Alexa+ developer environment is restricted to select preview partners. In alignment with hackathon guidelines:

• The companion web console and providers are high-fidelity simulators; no real bank rails are charged.
• The model can still propose suboptimal plans; Warrant guarantees no action executes outside policy bounds, spend caps, or unapproved parameters.
• Warrant is a 100% new codebase built from scratch during this hackathon (first commit Oct 16, 2026). No code was reused from prior projects.

What's next

• Hardware-backed passkey (WebAuthn) biometric approval signing. • Public transparency log (RFC 6962 / Sigstore) for detached receipts. • Attenuated capability delegation tokens (Macaroons / Biscuits) for multi-agent swarms.

Built With

• amazon-bedrock
• aws-sdk
• ed25519
• mcp
• model-context-protocol
• nextjs
• node.js
• react
• sha256
• sqlite
• streamable-http
• typescript
• vitest