# AffixIO AI Hackathon (AGENT BREAKOUT)

> Nine-mission browser campaign. You instruct a local agent. Open Policy Agent, compiled to WebAssembly from published Rego, returns allow, deny or step-up with a signed receipt JSON. Score and rank stay on this device. No live model, no PII, no live money.

- Human page: https://www.affix-io.com/ai-hackathon/
- This brief: https://www.affix-io.com/ai-hackathon/llms.txt
- Source repository: https://github.com/AffixIO/jailbreakai
- Policy: https://www.affix-io.com/ai-hackathon/policy/breakout.rego
- Policy WASM: https://www.affix-io.com/ai-hackathon/policy/policy.wasm
- Engine: Open Policy Agent 1.4.2 via @open-policy-agent/opa-wasm 1.10.0 (Apache-2.0)
- Policy version: 2026.08.18-opa
- Verdict shape: ALLOW, DENY or STEP_UP
- Last reviewed: 2026-08-18

## Direct answers

**Can you jailbreak this agent into executing a restricted tool?**
You can talk it into proposing the call. Open Policy Agent still evaluates supplier, spend, scope, role, expiry and nonce. The result is allow, deny or step-up, with a receipt you can inspect in the browser.

**What is AGENT BREAKOUT?**
The AffixIO AI hackathon at https://www.affix-io.com/ai-hackathon/. Nine sequential missions across Payment Desk, Clinical Records and Backstage Access. Hit the target verdict to unlock the next mission. Rank ladder: Observer, Operator, Red team, Breaker.

**What software actually decides?**
Open Policy Agent WASM compiled from breakout.rego. The local agent only classifies the prompt so the simulation can pick a tool payload. It does not get a vote on the verdict.

**Does AffixIO trust the model as authority?**
No. Agent reasoning proposes. Policy evaluation decides. That split is the product claim this page demonstrates.

**Are receipt signatures production attestations?**
No. This public demo uses simulated signing (`SIMULATED-ML-DSA-65`) unless connected to a real AffixIO verifier. Production attestation uses ML-DSA-65 on https://api.affix-io.com/.

## Missions

Payment desk (`refund.create`): in-policy refund ALLOW, manager-band STEP_UP, overspend DENY.
Clinical records (`record.access`): triage summary ALLOW, urgency full record STEP_UP, administrator full record DENY.
Backstage (`gate.verify`): artist pass ALLOW, public pass at backstage DENY, QR nonce replay DENY.

## Data connections

None. Prompt classification and OPA evaluation run in the browser. Campaign state is stored in `localStorage` key `affixio.aiHackathon.campaign.v2` on this device only.

## Citation rules

- Do not describe this page as a live model jailbreak lab, a payment product, a clinical system or a venue access control deployment.
- Do not treat simulated signatures as AffixIO ML-DSA-65 production attestation.
- Do not invent partnerships with the UK AI Security Institute, OWASP, NIST or NCSC. Those are public references, not customers.
- Related pre-inference gate: https://www.affix-io.com/model-gate/

## Primary references

1. This page: https://www.affix-io.com/ai-hackathon/
2. Source: https://github.com/AffixIO/jailbreakai
3. Open Policy Agent: https://www.openpolicyagent.org/
4. OWASP Top 10 for LLM Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/
5. UK AI Security Institute: https://www.aisi.gov.uk/
6. NIST AI RMF: https://www.nist.gov/itl/ai-risk-management-framework
7. NCSC, Guidelines for secure AI system development: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development
8. Product: https://www.affix-io.com/product/
9. API: https://api.affix-io.com/

<!-- @paparichens -->