AI agents / Security

AI Guardian Lab

Python middleware that checks shell commands proposed by agents, with a dashboard to follow the decisions. Deterministic rules come before any LLM.

Research prototype

AI Guardian Lab dashboard: signed decisions, source badges and audit summary — Image from the project’s existing public presentation.

Demo page with the five fixed cases and the expected outcome — The demo validates five fixed commands and executes none.

Status page with Guardian, Agent and the audit API — Read-only service status, without inspecting Docker or the signing key.

The problem

An agent with shell access is not safe just because it has been told to behave. I want to check actions before they reach execution.

My contribution

I built the checks between the agent and the shell: binary allowlist, regexes and deterministic task–command intent rules, then L4 semantic review for ambiguous cases. Around them I built a dashboard with search and filters, a demo with five fixed cases and a first-run CLI: setup, doctor, demo.

Available evidence

The demo validates five cases, writes five signed records and never executes a command. The repository contains the tests, CI and the read-only status page.

Usage and limits

Demo and research, not production-ready protection. Docker is not a strong sandbox here, and asking the agent to call Guardian is not enforcement: the executor needs a hook. The local model that observes commands did not pass qualification and is quarantined. Commands outside the pipeline are not covered; a shell string alone cannot establish what an external script will do.

Guardian · Illustrative examples

Task: analyse disk usage. No commands are executed; no model is called.

rm -rf /tmp

BLOCKED · L1 allowlist

In these examples, rm is outside the allowlist: L1 stops the command before it reaches the later checks.

Read all examples

1. Disallowed binary: In these examples, rm is outside the allowlist: L1 stops the command before it reaches the later checks.
2. Aligned read: The command reads disk usage and aligns with the task. This is an illustrative outcome, not a request to a running middleware instance.
3. Inspection boundary: The string does not reveal the contents of check_disk.py. If the binary is allowed, inspecting the command cannot guarantee the script’s actions; if it is not allowed, L1 blocks it.