Skip to main content

Shadow Executor

Pre-execution simulation and policy enforcement for AI agent actions.

Shadow Executor prevents accidental and IPI-induced destructive operations before they reach real infrastructure.

What is Shadow Executor?​

Shadow Executor is a middleware layer that sits between AI agents and cloud infrastructure. It:

  1. Intercepts every agent action before execution
  2. Simulates the action in a safe local environment
  3. Evaluates the action against your defined policies
  4. Detects Indirect Prompt Injection (IPI) attempts
  5. Enforces policy decisions (BLOCK, WARN, REQUIRE_APPROVAL, LOG_ONLY)
  6. Logs every decision with cryptographic audit trails

Key Features​

🛡️ Policy Engine​

Define declarative YAML policies to control what AI agents can and cannot do:

- id: SE-001
  name: Block production database deletion
  severity: CRITICAL
  action: BLOCK
  match:
    service: rds
    operation: DeleteDBInstance
    resource_tags:
      Environment: production

🔍 IPI Detection​

Detect Indirect Prompt Injection attempts using heuristic and pattern-based scoring:

  • Base64-encoded payloads
  • Unicode zero-width characters
  • Destructive operations on untagged resources

🧪 Local Simulation​

Simulate AWS operations locally without touching real infrastructure:

  • S3: All bucket and object operations
  • RDS: Database lifecycle operations
  • DynamoDB: Full CRUD operations
  • Lambda: Function invocations in isolated environment

📝 Audit Logging​

Every policy decision is logged with HMAC-SHA-256 signatures for tamper detection:

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "decision": {
    "action": "BLOCK",
    "matched_rule_id": "SE-001",
    "reason": "Matched: service=rds, operation=DeleteDBInstance",
    "timestamp": "2026-05-06T12:00:00.000Z"
  },
  "hmac": "a3f5...",
  "log_version": "1.0"
}

🔌 Framework Integrations​

Shadow Executor integrates with leading AI agent frameworks:

Architecture​

┌─────────────────┐
│   AI Agent      │
│  (Claude Code,  │
│  LangGraph, etc)│
└────────┬────────┘
         │
         ↓
┌─────────────────────────┐
│  Shadow Executor        │
│  ┌─────────────────────┐│
│  │ Policy Engine       ││
│  ├─────────────────────┤│
│  │ IPI Detector        ││
│  ├─────────────────────┤│
│  │ LocalStack Sim      ││
│  ├─────────────────────┤│
│  │ Audit Logger        ││
│  └─────────────────────┘│
└────────┬────────────────┘
         │
         ↓
   ┌─────┴─────┐
   │           │
   ↓           ↓
BLOCKED    ALLOWED
(logged)   (executed)

Use Cases​

Prevent Accidental Deletions​

Block AI agents from deleting production databases or S3 buckets unless explicitly approved.

IPI Protection​

Detect when user-provided content tricks an agent into executing destructive operations.

Compliance Auditing​

Maintain cryptographically signed audit trails of every AI agent decision for compliance requirements.

Approval Workflows​

Require human approval for high-risk operations like IAM policy changes or production deployments.

Getting Started​

Ready to protect your infrastructure? Start with the Quickstart Guide.

Current Status​

Milestone 1: Local MVP (Active)

✅ Policy engine with all 5 action types ✅ IPI detector with heuristic scoring ✅ LocalStack simulation for S3, RDS, DynamoDB, Lambda ✅ HMAC audit logging with verification CLI ✅ MCP integration middleware ✅ Claude Code integration ✅ LangGraph integration (TypeScript + Python)

Milestone 2: Cloud Simulation Tier (Upcoming)

🔲 AWS SAM/CDK ephemeral stack simulation 🔲 Real AWS SDK calls with automatic tear-down 🔲 99% fidelity for all AWS services

Milestone 3: Production Features (Future)

🔲 Slack/Teams approval integrations 🔲 Elasticsearch log backend 🔲 Multi-cloud support (Azure, GCP)

License​

MIT License - Copyright © 2026 Shadow Executor

Contributing​

Contributions welcome! See GitHub repository for details.