Wrap one host-owned tool.
Run a simulated local callback, compare the exact route with a changed destination, then wire your own policy and approval in the host.
Build a guarded function tool ↗node pilots/action-boundary/guarded-tool-demo.mjsTHE MOMENT BEFORE AI REACHES SOMEONE
AI proposes.
The host decides.
What if every agent action and generated interface had to cross an explicit policy boundary? Change a proposal below. Watch the decision change. Then reproduce the underlying case in the open source project.
Change the decision ↓01 / PROPOSAL
Move the destination.
An agent wants to call send_message. The host allows only the exact team destination and still requires approval for the matching action.
Prototype input, not a measurement of a person.
Move this to 5 or higher to see ALLOW.
PROPOSEDsend_message → outsider@example.test
HOST POLICYteam@example.test only
DECISIONDENY
EXACT PROPOSAL / SHA-256
Calculating…Checking the published project vector…ACTION HELD BEFORE DISPATCH
The route does not match.
An exact host rule for the team destination cannot authorize the outside destination. The local preview invokes no tool.
LIVE BROWSER GATE
Connecting to the project browser gate…
Waiting for aml-decision…
02 / INSPECT THE DECISION
The agent result runs the project's browser-side action planner and checks one published project vector. The interface result observes an aml-decision event from the project browser gate. Neither is a signed receipt, authenticated approval, live tool execution, or independent validation.
Pick the next move.
You do not need to read the entire repository. Each path ends with an observable result, and each names its evidence boundary.
Reproduce a decision locally.
Run the reference pilot, examine its recorded output, and mutate an input. Keep the commit, command, and observed result.
Follow the 10-minute reproduction ↗npm run proof · report PASS / FAIL / MIXEDTry to break the boundary.
Run an outside adapter against public cases and seeded probes. Publish mismatches and reproduction details, including negative results.
Open the implementer challenge ↗Own implementation · share evidence outside this repo