Ridge Gleaton: portfolio

AI agents can now produce requests indistinguishable from human traffic, from attackers and legitimate users alike. Without reliable client attestation, validation and rate limits only slow an attacker down, and a hijacked but authorized agent sends perfectly valid requests. Lazaret takes a different approach: stop trying to identify who sent a write, and judge what it does before it takes effect.

Lazaret is an edge gateway on Cloudflare Workers and Durable Objects. Each write bound for your origin is held in an append-only ledger. A deterministic gate scores it, then a Claude reviewer with no tools and no network returns a verdict. A separate committer replays approved writes to your origin, HMAC-signed and idempotent. Rejected writes are dropped along with any pending writes that depend on them. Writes the reviewer can’t settle are held for a human with its reasoning, and high-risk calls get a second opinion from a larger model.

On AgentDojo’s banking suite (144 injection attack pairs, replayed open-loop through the real gateway), attack success fell from 100% to about 40% as shipped, and to 0% when origin supplies the user’s task. Honest task completion dropped to 11–15 of 16. This is a pilot: one suite, static attacks, and the reviewer prompt was tuned on this suite, so the numbers are not held-out. When tool results were shown to the reviewer, a planted fake bill got 1 of 144 attacks through. It doesn’t stop the first writes of a split-fraud pattern, doesn’t guard reads, and the 0% depends on origin supplying the task correctly.