Filed: live demo · proof before the model
Agentic demo: prove access, then answer.
AffixIO proves tool access before Ollama is called. Only proof_id and decision reach the model, never the raw credential. A denied request returns 403 tool_access_denied and the model is never called.
- 01 credential stays on this host, never sent to the model
- 02 sdk.prove() returns valid + proof_id before anything else runs
- 03 decision approved or denied, from the claim
- 04 answer or 403 denied: tool_access_denied, model not called
- Proof order
- Attestation first, model second
- Model egress
- proof_id, decision, prompt only
- Deny path
- 403, no inference billed
- Register
- Local proof log + Merkle root
01Run the agentic flow
Enter any name to start (no password, no account). Then compare allowed vs denied in the step log below.
Conditions of entry
No account. No password. The name is a label, not a secret.
- Passwordnone required
- Sign-upnone needed
- Tokenheld in page memory only
- Registerruns labelled with your name
Enter a name or nickname
Any name is accepted. It only labels this demo run and its register entries.
Not signed in.
Each run adds labelled steps below. Every step maps to a real backend call, and you can open it to inspect the exact JSON that came back.
Model answer
- passed: proof valid
- denied: 403, model not called
Privacy: the model only ever sees proof_id, decision and your prompt, never the credential.
Demo only. Credentials are synthetic; proofs are real local attestations from this host (HMAC + ML-DSA-65).