Provenance gate

A deterministic authorization gateway for AI agents, and the experiments that test it.

The gateway sits between an agent and its tools. It never reads tool outputs to decide whether they "look malicious". For every side-effect call it asks where each control value came from: the user, untrusted content (email, files, web pages), or the model itself. It allows the call, or stops it for a human with the reason attached ("recipient UK12... came from bill-december-2023.txt, not from you, and you have never paid it").

Results on AgentDojo v1.2.1

Model-free replay of all 97 user tasks and 609 hijacked attack pairs, assuming the model is always hijacked:

* measured for strict + graph + links; the derived-value rules do not change how provenance is traced. Classifier columns count injections caught among pairs whose clean output was not already flagged.

What else we measured:

• Poisoned graph: with the attacker's destinations already in the known-counterparty graph, the gateway stops 53–66%.
• Adaptive attacks on each relaxation (laundered IDs, amounts under the cap): no gain for the attacker.
• Real incidents: EchoLeak, GitHub MCP, Supabase MCP and ForcedLeak, analyzed structurally (poc/incidents_analysis.md). Control-value provenance alone stops none of them, because the data leaves through content or rendered output.
• End to end: poc/e2e.py runs a live model with the gateway in AgentDojo's tool loop. A dry run reproduces the replay exactly; a five-pair pilot with Nemotron-3-Ultra is in poc/e2e/.

Write-up: posts/01-provenance-vs-detection.en.md. Full lab notes: poc/README.md.

Run it

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
PYTHONPATH=poc .venv/bin/python poc/replay.py > poc/results.md      # all policies, ~5 min on CPU
PYTHONPATH=poc .venv/bin/python poc/poison.py                       # poisoned-graph / adaptive adversaries

PYTHONPATH=poc .venv/bin/python poc/compare.py                      # classifiers vs. gateway, 5 encodings

# end to end: --dry-run (no model), a local Ollama model, or any OpenAI-compatible / Anthropic endpoint
PYTHONPATH=poc .venv/bin/python poc/e2e.py --dry-run
PYTHONPATH=poc .venv/bin/python poc/e2e.py --base-url http://localhost:11434/v1 --model qwen3:14b

Layout

Limitations

Model-free replay is a perfect agent; real agents take extra steps and add friction. Stop rates are conditional on hijack. Provenance is traced by string matching; a product needs typed IDs or labels. AgentDojo is small and synthetic. See the write-up for the full list.

License and contact

Apache-2.0 (see LICENSE). Yehiel Amor, Amor5511@gmail.com.