1 / 9

Authorized to Act.
Never Trusted to Hold the Keys.

Your Autonomous AI Operator that reads your Gmail, manages your Calendar, and searches your Drive — secured by Auth0 Token Vault.

Presented by Emmanuel Veranyuy Mfon — Senior Software Engineer

 Live Demo  GitHub
0:00 – 0:15

AI agents are powerful.
But giving them your credentials?
That's terrifying.

What if an AI could act on your behalf — read your email, manage your calendar, search your files — without ever seeing a single token?

0:15 – 0:30

Zero-Trust AI Pipeline

Beriwo uses Auth0 Token Vault to create a zero-trust boundary between the AI and user credentials. The AI can request tool execution, but credentials are resolved server-side — the model never sees a single token.

A 3-phase sandboxed pipeline enforces security at every layer: the AI is never simultaneously given tools and the ability to talk to users.

1

Sandbox Planner

Produces a structured JSON plan. Cannot execute anything.

NO tools NO tokens
2

Secure Executor

Token Vault resolves credentials. RBAC + Consent + Step-up enforced.

Token Vault RBAC Gate FGA Audit
3

Synthesis Module

Formats results for the user. No tool access whatsoever.

NO tools NO tokens
0:30 – 1:00  ·  AUTH0 LOGIN + RBAC

7 Auth0 Features

Deep integration across the entire authorization lifecycle

Token Vault

Every tool wrapped with defineProtectedTool(). AI requests tool calls — credentials resolved server-side. The model never sees a token.

Post-Login Action

Custom Auth0 Action enriches JWTs with ai_tier, ai_tools, ai_can_write, ai_max_calls claims at login time.

Consent Gate

Write tools physically removed from executor unless user explicitly approves. Code-level enforcement, not a prompt instruction.

Step-Up Auth

High-risk ops check JWT auth_time. If login is older than 5 minutes, re-authentication required via Auth0 popup.

FGA Audit Trail

Every tool authorization decision logged: userId, action, resource, decision (allow/deny), reason, tier, timestamp.

Token Refresh

Google social connection with offline_access. Automatic token refresh when the 1-hour access token expires.

AUTH0 HACKATHON CRITERIA

System Architecture

Token Vault
The AI never touches credentials. API calls are managed via request execution, and the Vault securely resolves access tokens completely server-side.
Sandboxing
A strict 3-phase pipeline separates planning, execution, and synthesis. The model logic boundary physically isolates user communication from tool execution.
Step-up Auth
High-risk and sensitive write operations mandate a JWT auth_time evaluation. Sessions older than 5 minutes trigger an immediate re-authorization challenge.
Consent Flow
All state-changing tools are physically removed from the AI's execution capabilities until the human explicitly grants approval through an interactive UI gate.
2:30 – 3:00  ·  ARCHITECTURE RECAP

5 Layers of Security

1
Sandboxed AI
3-phase pipeline — AI never has tools + user communication simultaneously. Prevents prompt injection exploiting tool access.
2
RBAC
Auth0 Action enriches JWT with tier claims → Policy Gate physically removes unauthorized tools from the executor.
3
Consent Gate
Write tools don't exist in the executor's registry unless a human approves. Code enforcement, not prompt instructions.
4
Step-Up Auth
JWT auth_time check with 5-minute window. Stale sessions require re-authentication for sensitive operations.
5
FGA Audit
Every decision (allow/deny) logged with user, action, resource, decision, and reason. Full compliance trail.

Demo Script

0:00

The Hook

Problem statement: AI agents need your data, but credentials exposure is terrifying.

0:15

Intro

Beriwo reveal — 10 tools, Token Vault, zero-trust. Show live app.

0:30

Auth0 Login + RBAC

Auth0 Universal Login, Post-Login Action, JWT custom claims for AI tiers.

1:00

Live Demo — Reads

Query emails + calendar. Show 3-phase pipeline streaming in real time.

1:45

Live Demo — Writes

Trigger send_email → consent card → approve → success. Show FGA audit.

2:30

Architecture Recap

5 security layers diagram. Sandboxed AI, RBAC, Consent, Step-up, FGA.

3:00

The Insight

Feedback for Auth0: first-class SPA flow, built-in AI RBAC, FGA integration.

3:20

Close

"Authorized to act — but never trusted to hold the keys." Logo + links.

3:00 – 3:20  ·  FEEDBACK FOR AUTH0

Our Insight for Auth0

1

First-Class SPA Flow

Leverage read:user_idp_tokens internally so SPA developers get seamless Token Vault without the Management API hybrid workaround.

2

Built-In RBAC for AI Tools

Read custom claims from Auth0 Actions to automatically filter tool availability based on user tier — no manual policy gate code needed.

3

Native FGA Integration

Built-in audit logging and per-resource permission checks for AI tool execution. Every ALLOW/DENY recorded automatically.

Beriwo

Ber!wo
Authorized to Act.

Your AI assistant that's authorized to act — but never trusted to hold the keys.

Presented by Emmanuel Veranyuy Mfon — Senior Software Engineer

 Try Live Demo  View Source