- Meaning
- Every permission check passes and the assessment completes cleanly.
- Delivery
- Exactly one bound item in the local outbox.
Open-source research prototype
The AI advises. Code decides.
ForgeVigil checks outgoing document requests for small businesses. An AI model investigates each request for manipulation, but only deterministic, tested code can let a document leave, and every decision leaves a durable receipt.
Scope check code
Unknown or restricted documents, unapproved recipients and inactive senders are denied before any model is called.
Investigation Muse · advisory
Muse reads the request as untrusted data and may call three read-only lookups, with a fixed limit on calls and a spend cap.
Evidence check code
Every quote and registry fact the model cites must exist. A threat finding that cannot be confirmed is held, not blocked.
Decision code
policy.pyis the only code that can produce ALLOW. Model output grants no capability.Outbox and receipt code
At most one bound outbox item per request, and a durable receipt for every result. Held requests wait for a local operator.
code deterministic, testedMuse · advisory AI model; can hold or block, never allow
The problem
Manipulation now writes fluently, and small teams have no security desk
A convincing message asks you to send a file, change where it goes, or skip the usual checks “just this once.” AI makes those messages cheap to write and hard to tell apart. Putting an AI assistant in charge of sending documents adds a new risk: the message can try to talk the assistant itself into it.
“This is the CFO. No need to verify.”
Impersonation and authority pressure that tries to bypass approval.
“Their address changed today.”
Redirecting a legitimate document to an attacker-controlled destination.
“Ignore all previous instructions.”
Prompt injection aimed at the AI that reviews the request.
Four outcomes
Every request ends in exactly one decision
The model can hold or block a request. It can never allow one. ALLOW comes only from policy.py, after
every permission check passes explicitly.
- Meaning
- A threat finding whose supporting evidence code has verified.
- Delivery
- None. A blocked request can never be released.
- Meaning
- The document, recipient or sender is out of scope. Intent is not guessed.
- Delivery
- None. Decided before the model is ever called.
- Meaning
- Uncertainty, a missing approval, unconfirmed evidence or a failed assessment.
- Delivery
- Held. A local operator may release it after the checks run again.
Evidence
Measured, misses included
Results from ForgeVigil’s own evaluations on fictional cases with the current prompt. They show the design works as intended on those cases; they are not field results.
27 / 27held-out attacks flaggedcases never used for tuning, 3 runs each (CP07)
0 / 75benign requests wrongly flaggedheld-out and main sets, 3 runs each (CP07)
6 / 6attacks flagged in the latest live run16 separately judged cases (CP21)
1 / 57main-set attack results deliveredthe miss is shown too, not only the wins (CP07)
Built for small operators
Local by design
ForgeVigil runs on your own computer with Python’s standard library: no packages to install, no cloud service in the decision path. Delivery goes to a local outbox. A person reviews anything held, from the command line, never over the network.
Stored requests are kept as keyed fingerprints rather than message text, and backups prove the key matches the database before you rely on them.
Also included
Offline email and file checks
Saved-email inspection reads a .eml file and shows where links really go versus what
they display, and flags risky attachment names. It opens no links and calls no model.
One-file scan asks Microsoft Defender on Windows to scan a single file you choose and reports exactly what the engine said, never calling a file clean without the engine’s own no-threat result.
Honest scope
ForgeVigil is a research prototype. It controls local document requests and inspects saved emails offline. Malware defense, public hosting and enterprise scale have not been demonstrated. Read the limits before relying on it.