Security & AI Agents
GreenGate: On-Device Human Approval for AI Agents
Asynchronous CIBA architecture that pauses sensitive agent executions until receiving biometric confirmation on the user's phone.
Award
Global DEV Challenge Winner
Token Issuance
< 2s latency
Injection Resilience
100% in-band attacks neutralized
Case Readers
+4,000 engineers
01 · The Engineering Challenge
The delegation dilemma in autonomous agents
When an AI agent interacts with banking APIs, cloud infrastructure, or private records, users usually interact through a chat prompt. If the agent is tricked by prompt injection or hallucinates, it can trigger irreversible operations. In-chat confirmations are vulnerable to in-band manipulation, and synchronous polling blocks backend threads.
Key risks addressed:
- Prompt injection attacks that deceive the model into authorizing unwanted operations directly inside the chat stream.
- Lack of cryptographic auditability showing which human confirmed which tool invocation and at what exact timestamp.
- Backend thread starvation while waiting for human responses if synchronous polling is used.
02 · Architecture & System Design
Decoupled Workflow with OpenID CIBA and Google Gemini
The agent uses Strict Tool Calling with Zod schemas. Upon detecting a sensitive tool, it suspends execution and initiates a CIBA (Client-Initiated Backchannel Authentication) flow with Auth0. The user gets an out-of-band push notification on their phone, approves biometrically, and a webhook reactivates the agent.
Core modules & responsibilities:
Gemini Agent Engine
Reasoning and tool orchestration with strict Zod validation and session state.
Auth0 CIBA Provider
Backchannel authorization server coordinating verification between agent and smartphone.
Push Notification Module
Out-of-band channel displaying structured operational parameters on a secure screen.
Scoped Protected API
Business endpoints that reject agent calls unless accompanied by the freshly issued CIBA token.
PostgreSQL Audit Trail
Immutable ledger tracking every prompt, tool invocation, request hash, and approval outcome.
03 · Engineering Decisions & Trade-offs
Every technical choice prioritizes reducing operational risk and maintaining system clarity.
Out-of-band CIBA authorization instead of in-chat confirmation
Rationale: Chat messages can be spoofed or bypassed via prompt injection. Push notifications on the physical device guarantee genuine human presence.
Explicit trade-off: Introduces an intentional 5 to 30 second human delay while the user confirms on mobile.
Two-layer Zod schema enforcement (input and output of tools)
Rationale: Prevents the agent from passing mutated values or unexpected types to sensitive backend endpoints.
Explicit trade-off: Requires rigorous schema definitions and rejects calls if optional properties required by security policy are omitted.
Single-use tokens with a short 60-second validity window
Rationale: Guarantees that a previously authorized token cannot be recycled by an attacker or repeated agent run.
Explicit trade-off: If downstream services take longer than 60 seconds to initiate, the operation must request a new authorization.
Production Validation and Global Recognition
GreenGate proved that agentic AI can be safely deployed in enterprise and regulated environments when sound architecture and out-of-band human governance are built into the design.
Professional discussion
Looking to deploy governed AI agents in your software?
Let’s design a robust architecture featuring safe tool calling, out-of-band human approvals, and full auditability for your production systems.