Blocked
A private list stays private.
The assistant can read the club notes, but it cannot open the member roster. An instruction hidden in those notes does not grant extra access.
The timeline names the rule and shows that the read tool never ran.
An interactive AI security playground
A helpful AI.
A watchful gate.
What happens when a document tells an AI to do something it shouldn't? Watch a separate set of rules check the action before a tool runs.
Project showcase · The interactive app runs locally.
Simulated documents and email. No real messages are sent.
The model proposes.
The policy decides.
A small boundary with a big job
A suggestion is not permission.
A hidden instruction in meeting notes might ask for a private member list. That is a prompt-injection attempt. Our gate does not need to trust the instruction: it checks whether the requested action is permitted.
- 01
The AI proposes
Read a document, create an email draft, or send a draft.
- 02
The gate checks
Check document access, recipient permissions, and information sensitivity.
- 03
The result is visible
Allow it, block it, or wait for a person to approve the send.
Inside the playground
See the decision. Understand the rule.
These screenshots show prepared Replay examples using the app's real policy checks. Open an image to inspect it at full size.
Sensitivity matters
Same contact. Different information.
A sponsor can receive public club news, but not the confidential budget. Drafts inherit the highest sensitivity of the documents read during the session.
An approved address is not permission to receive everything.
Human approval
You make the final call.
When approval is required, the send pauses. A person reviews the recipient and message before deciding. The AI cannot press Approve for itself.
The result appears in a mock outbox, not a real email account.
Two ways to explore
Replay or live AI.
Replay uses prepared proposals. It is repeatable and needs no AI service connection.
Live uses a connected model, with direct Google Gemini support. It requires your own server-side API key; access, quotas, and billing depend on your account.
Both use the same gate. Gemini adapter tests use mock responses; they are not proof of live API access.
A teaching tool, not a production gateway.
The app has three simulated tools, synthetic documents, and temporary in-memory state. Its tests do not establish a universal defense against prompt injection.
This website is a static showcase. It does not run the Python backend or collect API keys.
Python · FastAPI · React · TypeScript · Gemini
Explore the project