$82,314
A stolen API key ran up eighty-two thousand dollars in forty-eight hours. There is no hard spending cap to stop it.
Agents don't need less power.
They need a fuse.
A fuse is a deliberately weak link. It costs pennies, it breaks first, and it is the only reason you can run real current through the wire at all.
Interlock is that link for autonomous agents. Every action one attempts is identity-bound, scored for what it could destroy, and checked against policy before the tool runs. When it blows, the function never executes — the agent isn't asked, and it can't argue.
Demo video
Drop demo.mp4 and poster.jpg into frontend/, or swap this block for an embed.
4 minutes · a real incident, start to finish
03:47
A real outage, a real agent, and the moment it reaches for something it should never have been able to reach. Scroll, then press the button.
reading the thread…
fuse intact · current flowing
The agent has not been started.
The problem
Not because agents can't do the work — because when one is wrong, it is wrong with your credentials, at three in the morning, at machine speed.
$82,314
A stolen API key ran up eighty-two thousand dollars in forty-eight hours. There is no hard spending cap to stop it.
dropped
An agent deleted a production database during what it believed was a routine cleanup.
$6,500
An agent given credentials and a goal provisioned oversized infrastructure and left its operator with the bill.
So teams do the rational thing: they keep agents read-only, or they keep a human watching. The automation never pays for itself.
How it works
Enforcement is an ADK plugin installed on the runner, so it applies to every agent in the fleet — including ones added later. Returning a value from the tool hook replaces the call, which is why a refusal breaks the circuit rather than filing a complaint.
Live cockpit
This calls the deployed control plane when it is reachable, and replays recorded output from real runs when it is not. Either way the verdicts are the engine's, not a mock-up.
Try the last one — its arguments tell the scorer to rate it harmless.
Nothing has been asked yet.
Pick an action and the gate will score it — identity, blast radius, content, then policy — and tell you exactly why.
The data itself attacks
ERROR upstream connect timeout after 30000ms
ERROR payment client connection pool exhausted (max_connections=8)
pi_and_jailbreak · 3 of 40 records withheld, 37 passed through
Withholding all forty would let anyone halt an investigation by writing to a log. Only the hostile records are removed; the agent is told what was withheld and why.
It checks itself
The auditor runs in its own session, holds only read-only tools, and never sees the remediation agent's reasoning. It is asked what is true of the live system, not whether an argument was persuasive.
It confirmed the rollback and still refused to treat an absence of errors as evidence of recovery. That is the behaviour it was built for.
Evidence
Seventeen labelled actions — six routine, eleven dangerous, three with an attack embedded in an argument. Four strategies, repeated. Unsafe counts a dangerous action permitted; it must be zero.
Only the most predictable one. They missed three of nine attacks — rating an unrestricted 0.0.0.0/0 firewall rule as needing approval rather than refusal.
A rollback scored NEGLIGIBLE four times and MODERATE twice across six identical requests. A response schema removed the variance rather than averaging over it.
Self-consistency sampling — three assessments and a median — is the standard remedy. It scored worse than one constrained call, at three times the cost.
Running on Google Cloud
BasePlugin on the runner — the gate itself