Agent Airlock

Project Description Agent Airlock is a verifiable authority enforcement layer for autonomous AI agents built around one principle: information is not authority. AI agents increasingly ingest untrusted repositories, documents, tool responses, and instructions while holding powerful credentials. Airlock prevents information that influences an agent's reasoning from silently expanding what that agent is authorized to execute. Trusted intent is compiled into a frozen least-privilege capability contract. Agents may delegate authority, but delegation can only preserve or reduce existing authority, never expand it. Every privileged tool call crosses an independent reference monitor. Airlock adds proof-carrying authorization, exact-action leases that block replay and argument mutation, tamper-evident receipts, and dual provenance that separately tracks information state and authority state. In our evaluation, Agent Airlock passed 60/60 deterministic authority cases and 110,620 authority checks across 10,000 randomized authority graphs with zero invariant failures. Across 25 preserved Muse Red Team trials and 388 tool/delegation attempts, we observed zero unauthorized privileged executions. The implementation demonstrated here was built during the Meta Global AI Developer Hackathon.