The execution governor
for autonomous AI agents.
Agents hold real credentials. Antares stands between their decisions and your cloud: every mutating tool call is gated by deterministic code first, judged by a cross-vendor model quorum second, measured against live cloud state, and reversible by construction.
models propose, code decides.
n/a
verdicts issued, live
n/a
allowed
n/a
hard blocked
n/a
abstained to human
The problem, in numbers
owasp llm top 10 · llm011
prompt injection is risk #1
OWASP ranks it first in its Top 10 for LLM applications: untrusted text carrying hidden instructions hijacks the agent that reads it.
0
enforcement layers between agent and cloud
Text guardrails read strings. IaC scanners read code. Posture tools read configuration. Nothing governs the moment a decision becomes an API call.
1 call
is all it takes to lose the table
A single hallucinated or injected mutation destroys state that took months to build. Recovery without a pre-captured prior image is archaeology.
How a call is judged
the six stagesUntrusted content is canonicalized (homoglyph folding, invisible-character stripping, base64 channel decoding), then screened by a 16-rule signature library and a semantic classifier. Attack grammar riding in data fields is caught here, before anything trusts it.
Pure code with veto power. Strict schema validation, shell metacharacter tokenization, namespace allowlists, per-class severity weights. A code block is final: no model anywhere in the pipeline can overturn it.
Escalated calls are argued twice, in parallel, by model families with no shared training lineage: Amazon Nova Pro reasons blast radius and intent alignment while Meta Llama 3.3 70B assumes the call is an attack and hunts for one. Divergence above threshold forces a human decision, never an average.
Blast radius is measured from live cloud state through read-only probes: item existence, table counts, PITR status, S3 versioning. Score = resources × severity × (1 − reversibility). A failed probe marks the radius unknown and treats the call at maximum severity.
Pre-capture the exact prior state into a TTL vault, commit, capture the new state. Rollback replays the inverse operation and verifies restoration by hash. Destructive mutations always abstain for a human signature, even with clean votes.
Every record is hashed into a Merkle chain whose head advances by conditional write. Receipts are verifiable client-side: hash the canonical record, compare the leaf.
The adversary is chosen by data
300-case corpus · 4 candidatesSame-family models share blind spots, so the red-team seat goes to a family with zero shared lineage with Nova. Which family ships is decided by the benchmark table, not preference: every candidate ran the full 300-case corpus with identical prompts and thresholds.
| adversary | note | not-allowed recall | hard-block recall | benign fpr | wall (300) |
|---|---|---|---|---|---|
| Meta Llama 3.3 70B✓ shipped | shipped default | 1.000 | 0.700 | 0.193 | 133 s |
| Meta Llama 4 Maverick | noisy on benign | 0.980 | 0.680 | 0.313 | 123 s |
| OpenAI GPT-OSS 120B | conservative | 0.973 | 0.647 | 0.160 | 244 s |
| DeepSeek R1 | 5× slower | 0.967 | 0.647 | 0.180 | 670 s |
300-case corpus (150 benign incl. 44 adversarial-benign, 150 adversarial across six classes). Identical prompts and thresholds per candidate. Wilson 95 percent intervals and the McNemar comparison against the code-only baseline in BENCHMARK.md.
The benign FPR miss is published with its named regression and fix path. Full methodology:BENCHMARK.md.
Proof over promises
exercised live, datedkill switch drill · passed
One environment flag halted every gate through the public URL (503 kernel-halted). Revert restored service. Executed and recorded.
out-of-scope drill · passed
A foreign-table delete rejected at the gate by rule GATE-ARN-001. The kernel's IAM reach ends at three sandbox resources; the test is CI-gated.
rollback · byte-identity verified
A gated deletion executed against live state, then reversed from the TTL vault. The restored item hashed identical to the pre-capture image.
budget · usd 10 cap, $0.00 spent
A live cost budget alarms the account. The sandbox runs on ARM64, on-demand DynamoDB and free-tier CloudFront: no always-on compute.
The stack, as deployed
every service earns its placeBuilt in the open
Antares is the fourth link in a chain of systems built around one question: what happens when a model is wrong and money moves. TruthLayer verifies what AI claims. Gatehouse gates scam decisions with hash-chained evidence. Sentinel scores cross-merchant fraud deterministically. Antares is the layer that governs the agents themselves.
Built end to end by a coding agent connected to AWS, reviewed at every milestone gate by Prakhar Shukla. The agent's own CloudTrail calls are the build record; the what-broke ledger carries every failure with its prevention rule. Nineteen design documents, one failure ledger, zero undocumented decisions.
2 IEEE publications on deepfake detection
top 50 global finalist · aws aiideas
national winner · sbi youth ideathon, iit delhi
prakhar shukla · nagpur, india