Untrusted context crosses boundaries
Web pages, documents, email, and tool responses can carry adversarial instructions. Provenance checks stop that content from silently acquiring authority.
AI actions, governed
Let agents plan.
Never let them self-authorize.
A deterministic security boundary between model intent and real-world execution, with policy, risk, provenance, delegated authority, and human approval.
Core invariantThe model proposes. The gateway decides. The tool executes only after authorization.
Live control surface
Agent runner
Decision output
ReadySelect a scenario or submit an agent intent.
Problem statement
Intelligence is not authority.
AI agents can interpret goals and propose useful actions, but model output is probabilistic, influenceable, and unfit to serve as an authorization decision. Prompt injection, over-broad credentials, confused delegation, and invisible side effects turn a capable assistant into an uncontrolled execution path.
Credentials are not permission
Possessing an API key says nothing about user intent. Delegation narrows actions, resources, beneficiaries, amounts, and time.
Autonomy needs accountability
Deterministic decisions, explicit approvals, replay protection, and audit evidence make every action inspectable.
Decision pipeline
Control stays outside the model.
Providers remain interchangeable planners. Every proposal is normalized and evaluated by deterministic controls before a registered tool can run.
Intent
User goal plus source provenance
Planner
GPT, Claude, local, or mock model
Gateway
Policy, delegation, and risk
Approval
Human step-up for sensitive actions
Execution
Bound tool call and audit evidence
About the project
A reference boundary for agentic systems.
Agent Security Gateway demonstrates a vendor-neutral pattern for separating AI reasoning from authorization and execution. The banking environment is simulated; the security architecture is the product.
Built for extension
FastAPI, deterministic YAML policy, risk scoring, delegated authority, approval expiry and replay protection, SQLite audit evidence, and provider adapters.
Provider-neutral proposal contract
Intent-bound delegated authority
Auditable authorization decisions
Deployment boundary
This is not a certified banking control. Production use requires authenticated identities and approvers, durable tamper-evident storage, credential brokering, rate limits, tenant isolation, observability, and formal policy review.
Replace development SQLite storage
Use managed or delegated credentials
Harden every public surface