Phantom AI — Architecture Diagram

1. End-to-End Architecture & 4 Interception Channels

Mermaid Diagram

flowchart TD classDef client fill:#FFFFFF,stroke:#ACC5A6,stroke-width:1.5px; classDef ch fill:#EFF6FF,stroke:#1A73E8,stroke-width:1.5px,color:#1E40AF; classDef t1 fill:#F0FDF4,stroke:#10B981,stroke-width:1.5px,color:#065F46; classDef t2 fill:#FAF5FF,stroke:#9333EA,stroke-width:1.5px,color:#581C87; classDef block fill:#FEE2E2,stroke:#EF4444,stroke-width:1.5px,color:#991B1B; classDef core fill:#E8EFE7,stroke:#5C7057,stroke-width:1.5px,color:#3C4043; classDef db fill:#FEF3C7,stroke:#F59E0B,stroke-width:1.5px,color:#92400E; User["💻 Client / App
(Prompt + Files + Role)"]:::client Ch1["🛡️ Channel 1: App-to-Agent
Pre-Flight DLP & Budget Cap"]:::ch subgraph Defense ["Hybrid Defense Pipeline (src/defense/mod.rs)"] T1["⚡ Tier 1: Fast Deterministic
Regex Secrets + FastEmbed Vectors
(<15ms | $0 AI Spend)"]:::t1 T2["🧠 Tier 2: Semantic AI Guard
Internal Organization AI Model
(Contextual Evaluation)"]:::t2 end BlockT1["🛑 Fast-Path Short-Circuit
0 AI Tokens ($0 Cost) | <15ms"]:::block BlockT2["⛔ Blocked by Internal AI Guard
Aborts Downstream Agent Loop"]:::block AuditSink["🚨 SecOps Audit Trail
(tasks / tool_calls in SQLite)"]:::block Catalog["⚙️ SQLite Catalog (catalog.db)
Hot-Reloads Live Every Request"]:::db AgentCore["🤖 Agent Runtime & Loop Mitigator
Max 6 Rounds | Persistent State"]:::core Ch2["🔁 Channel 2: Agent-to-Agent
Sub-Agent Privilege Boundaries"]:::ch ToolGate["🛡️ Channel 3: Agent-to-MCP Tool Gate
Path Norm → Blacklist → DLP → Whitelist → HITL"]:::ch MCPServers["🗄️ MCP Tools (SQLite confidential.db)
+ Tool Output Redaction"]:::core ModelGW["🌐 Channel 4: Agent-to-Model Gateway
Internal vs External Isolation & Metering"]:::ch LLMs["☁️ Models (Internal Org Models / External Cloud)"]:::core User --> Ch1 Ch1 --> T1 T1 -- "Violation (<15ms)" --> BlockT1 BlockT1 --> AuditSink T1 -- "Pass (<15ms)" --> T2 T2 -- "Malicious" --> BlockT2 BlockT2 --> AuditSink T2 -- "Cleared" --> AgentCore Catalog -. "Hot-Reload Rules" .-> Ch1 Catalog -. "Patterns" .-> T1 Catalog -. "Prompts" .-> T2 Catalog -. "Tool Rules" .-> ToolGate AgentCore <--> Ch2 AgentCore --> ToolGate ToolGate --> MCPServers MCPServers --> AgentCore AgentCore --> ModelGW ModelGW --> LLMs

How it Works

The gateway acts as an inline proxy intercepting traffic across 4 distinct AI interaction channels:

Channel 1 (App-to-Agent): Evaluates user budget balance, scans attachment text for DLP leaks, and runs the hybrid defense pipeline before execution.
Channel 2 (Agent-to-Agent): Bounds agent-to-agent recursion with MAX_TOOL_ROUNDS = 6 to eliminate runaway execution loops.
Channel 3 (Agent-to-MCP): Inspects every tool call before running, blocking traversal and blacklisted tools, escalating gray-zone calls to human review.
Channel 4 (Agent-to-Model): Enforces strict data perimeter isolation (confidential data only sent to internal organization AI models, never to external cloud APIs).

Challenge Criteria Covered

Section 1 & 2 (Interception Architecture): Lightweight proxy covering App-to-Agent, Agent-to-Agent, Agent-to-MCP, Agent-to-Model.
Section 4.1 (Centralized Policy Engine): Single source of truth in SQLite (catalog.db) with dynamic hot-reloading (0s restart).
Code References: src/policy.rs, src/executor.rs, src/defense/tool_gate.rs.

2. Hybrid Defense Pipeline & Token-Saving Short-Circuit

Deterministic (<15ms) → Semantic

flowchart TD classDef input fill:#FFFFFF,stroke:#ACC5A6,stroke-width:1.5px; classDef det fill:#F0FDF4,stroke:#10B981,stroke-width:1.5px,color:#065F46; classDef sem fill:#FAF5FF,stroke:#9333EA,stroke-width:1.5px,color:#581C87; classDef block1 fill:#FEE2E2,stroke:#EF4444,stroke-width:1.5px,color:#991B1B; classDef block2 fill:#FEF2F2,stroke:#DC2626,stroke-width:1.5px,color:#7F1D1D; classDef pass fill:#E8EFE7,stroke:#5C7057,stroke-width:1.5px,color:#3C4043; In["📥 User Prompt + Attachment"]:::input subgraph T1 ["Tier 1: Fast Deterministic Controls (<15ms, $0 cost)"] S1["1. Secret Pattern Matcher
(sk-, ghp_, AKIA prefix/len)"]:::det S2["2. Payment Card Luhn Verifier
(16-digit structural card check)"]:::det S3["3. VectorShield Cosine Sim ≥ 0.78
(FastEmbed BGE-Small over 50+ attacks)"]:::det end HaltT1["🛑 TIER 1 SHORT-CIRCUIT HALT
• 0 AI Tokens Consumed ($0 Cost)
• No AI Model Invoked • Latency: <15ms"]:::block1 subgraph T2 ["Tier 2: Semantic AI Reasoning (Internal Organization AI Model)"] S4["4. Semantic Guard
(Internal Organization AI Model)"]:::sem S5["5. Catalog Model Guard
(Versioned prompts defense_prompts)"]:::sem end HaltT2["⛔ TIER 2 AI GUARD REJECTION
• Flagged by Internal Organization AI Model
• Downstream Agent Loop & Target Model Aborted"]:::block2 PassNode["✅ Cleared for Agent Execution
Proceed to Agent Runtime & Tools"]:::pass In --> S1 S1 -- "Match" --> HaltT1 S1 -- "Clean" --> S2 S2 -- "Match" --> HaltT1 S2 -- "Clean" --> S3 S3 -- "Similarity ≥ 0.78" --> HaltT1 S3 -- "Clean (<15ms)" --> S4 S4 -- "Malicious" --> HaltT2 S4 -- "Safe" --> S5 S5 -- "Flagged" --> HaltT2 S5 -- "Safe" --> PassNode

How it Works

$0 Cost Exclusively at Tier 1: 0 AI tokens and $0 cost only occur when Tier 1 fast deterministic controls intercept an attack. No AI model runs, cutting attack latency to <15ms.
Tier 2 Internal AI Model Evaluation: If Tier 1 passes cleanly, the prompt is evaluated by the Internal Organization AI Model. If flagged, downstream agent tool execution and target model inference are aborted, preventing exploits.
VectorShield (In-Process Vectors): Runs bge-small-en-v1.5 embeddings (~10ms) against 50+ known historical attacks in attacks.json, with Jaccard token fallback.

Challenge Criteria Covered

Section 4.2.1 (Deterministic Controls): High-speed pattern matching for PII, secrets, and known historical exploits.
Section 4.2.2 (Semantic Controls): Internal organization AI model evaluation ensuring zero sensitive data leaves the enterprise boundary.
Section 4.4 (Historical Exploits): Embeddings vector store over known prompt injections.
Code References: src/defense/deterministic.rs, src/defense/vector_shield.rs, src/defense/semantic_guard.rs.

3. Agent-to-MCP Hybrid Tool Gate & Human-in-the-Loop

Fail-Closed Tool Governance

flowchart TD classDef check fill:#EFF6FF,stroke:#1A73E8,stroke-width:1.5px; classDef deny fill:#FEE2E2,stroke:#EF4444,stroke-width:1.5px,color:#991B1B; classDef allow fill:#F0FDF4,stroke:#10B981,stroke-width:1.5px,color:#065F46; classDef hitl fill:#FEF3C7,stroke:#F59E0B,stroke-width:1.5px,color:#92400E; Req["🤖 Model generates tool_call
name(arguments)"]:::check Step1{"1. Path Normalization
Traverses outside root?"}:::check DenyTraverse["⛔ DENY: Path Traversal (../)"]:::deny Step2{"2. Blacklist Check
tool_rules action='DENY'?"}:::check DenyBlacklist["⛔ DENY: Blacklist Rule
(Final, even for admin)"]:::deny Step3{"3. Argument DLP Scan
Secrets or injection in args?"}:::check DenyDLP["⛔ DENY: Leaked Credential in Args"]:::deny Step4{"4. Whitelist Check
tool_rules action='ALLOW'?"}:::check AllowWhite["✅ ALLOW (0 AI Tokens)"]:::allow Step5{"5. Gray Zone: AI Tool Guard
Classify Risk Category"}:::check IsSafe{"Guard says Safe?"}:::check HasPriv{"User has
tool.agent_auto_approve?"}:::check AllowAuto["✅ Auto-Execute Tool"]:::allow HITL["⏸️ AWAITING_APPROVAL
Human-in-the-Loop Queue
(agent_runs state saved)"]:::hitl DenyUnsafe["⛔ DENY Unsafe Tool Call"]:::deny Redact["🧼 Output Redaction
Masks SSNs, emails, cards in tool result"]:::allow Req --> Step1 Step1 -- Yes --> DenyTraverse Step1 -- No --> Step2 Step2 -- Match --> DenyBlacklist Step2 -- No --> Step3 Step3 -- Secret Detected --> DenyDLP Step3 -- Clean --> Step4 Step4 -- Match --> AllowWhite Step4 -- No (Gray Zone) --> Step5 Step5 --> IsSafe IsSafe -- Safe --> HasPriv HasPriv -- Yes --> AllowAuto HasPriv -- No --> HITL IsSafe -- Unsafe --> DenyUnsafe IsSafe -- Offline (Fail-Closed) --> HITL AllowWhite --> Redact AllowAuto --> Redact HITL -. "Decision: Approve" .-> Redact

How it Works

Fail-Closed Gate: Every tool call the model emits is intercepted before execution. If the tool guard is offline or unreachable, the system fails closed and requires human sign-off.
5-Stage Verification: Path traversal check → Blacklist → Argument DLP → Whitelist → Gray zone AI Tool Guard.
Human-in-the-Loop (HITL): When human approval is required, execution pauses, saving the entire conversation to agent_runs in SQLite. Reviewers can approve or reject in the Security Dashboard, resuming cleanly without losing context.
Result Redaction: Returned tool data (e.g. database rows) is sanitized to [REDACTED:ssn] and [REDACTED:email].

Challenge Criteria Covered

Section 1 & 3 (Agent-to-MCP Interception): Granular permissions, tool inspection, and human approval queues.
Section 4.4 (Exploit Mitigation): Defense against path traversal (../) and unsafe tool execution.
Section 4.5 (Security Reporting): Audits every tool call verdict and decision in tool_calls.
Code References: src/defense/tool_gate.rs, src/defense/redaction.rs, src/tools/mcp.rs.

AI Control Layer Architecture

1. End-to-End Architecture & 4 Interception Channels

2. Hybrid Defense Pipeline & Token-Saving Short-Circuit

3. Agent-to-MCP Hybrid Tool Gate & Human-in-the-Loop