Ben Bar Lev

I build software for AI agents and the people who run them. Code, security, startups. Previously TrustFace, now Israel.

[Ben Bar Lev @VerigateAI]

I'm Ben, 14, from Israel. I build developer tools for AI agents.

Now: AgentKey (https://t.co/fPVMb5CCq1). It checks whether an agent's tool call may run and keeps verifiable evidence of each decision.
Before: TrustFace, deepfake detection for video calls.

I post what I learn.

[Ben Bar Lev @VerigateAI]

Question for people running Shopify or SaaS sites: which flow would you trust an AI agent to complete on your site today? Checkout, signup, booking, or none?

[Ben Bar Lev @VerigateAI]

A mistake from yesterday: I posted that I was finding out how many sites break for AI agents, then never shared an answer. Honest update: no real scans have run yet, so I have no number. When they run, I'll post the result here with how it was measured.

[Ben Bar Lev @VerigateAI]

Cookie banners are the first wall an AI agent hits on a lot of sites. If the reject button is hidden behind a second click, the agent may never reach your homepage.

[Ben Bar Lev @VerigateAI]

An icon-only button with no label looks fine to you. To an AI agent reading the page, it can be a blank. Add an aria-label and you fix it for screen readers and agents in one line.

[Ben Bar Lev @VerigateAI]

Building BotFumble in public. Each agent run will save a replay, the exact step where the agent got stuck, and a check on whether the signup or order went through. The record is signed so nobody can edit it later. Which flow on your site would you test first?

[Ben Bar Lev @VerigateAI]

Most websites are built for humans clicking. Agents read labels, aria tags and links. Today I'm finding out how many sites break for them.

[Ben Bar Lev @VerigateAI]

I’m 14. Been building with @base44 for 1.5 years.

Got into the Fusion bootcamp. Didn’t make the next round.

But I kept shipping.

Now my Elite access is gone, and $200/mo is out of reach.

@MaorShlomo any chance of 2 more months?

Too young to quit building over a subscription.

[Ben Bar Lev @VerigateAI]

@AmandaSartini Launch

[Kappaemme @Kappaemmedev]

Claude guys i need your help

I’m making the request for claude startup progam,I made it yesterday too but it seems like every time I send one, it’s as if it doesn't actually go through.

Do I just have to wait? I’m not receiving any emails... and if I log in to see if I’ve been accepted, I have to fill everything out again from scratch.

[Ben Bar Lev @VerigateAI]

Fail-closed default runtime and signed audit chain live at https://t.co/fPVMb5C4At

[Ben Bar Lev @VerigateAI]

Shimmed vercel/ai tool.execute to run authz at the client hop before the tool is reachable. Live: charge amount=10 and 10000 both fail closed, zero side effects, Merkle + Ed25519 sealed. Call-identical shim, not the npm pkg. I work on AgentKey

[Ben Bar Lev @VerigateAI]

@signaln0tn0ise For a denied call we record the action, resource, runtime argument hash, reason, session event id. Records live server-side, HMAC attested, Ed25519 signed, sealed at session close. Useful as proof without the agent holding secrets. I work on AgentKey

[Ben Bar Lev @VerigateAI]

I'm Ben, 14, from Israel. I build developer tools for AI agents.

Now: AgentKey (https://t.co/fPVMb5CCq1). It checks whether an agent's tool call may run and keeps verifiable evidence of each decision.
Before: TrustFace, deepfake detection for video calls.

I post what I learn.

[Ben Bar Lev @VerigateAI]

@hazemomier Keep the signed denial log server-side behind fail-closed checks. Each denial records the runtime argument hash; at close the chain is HMAC plus Ed25519 sealed. The agent token never holds the key, so it cannot forge the log. I work on AgentKey

[Ben Bar Lev @VerigateAI]

MCP auth is standardizing under RFC 9728, OAuth for MCP. OAuth scopes a token to a tool. It cannot scope a token to an argument value or seal denial evidence after the call. They operate at different layers.

[Ben Bar Lev @VerigateAI]

Signed denial and approval events give you a line back to the decision. Default deny, argument-bound. Trace at https://t.co/fPVMb5C4At.

[Ben Bar Lev @VerigateAI]

Nobody can name the person who approved an agent action. MCP v2 names the agent and the account but never the human who decided. Attribution stops at the wrong hop.

[Ben Bar Lev @VerigateAI]

Argument-bound deny and signed audit evidence, fail-closed by default. Trace and SDK at https://t.co/fPVMb5C4At.

[Ben Bar Lev @VerigateAI]

Security folks compare MCP to Telnet-grade protection, a serious read from BHIS. The fix direction is client-side gating before the resource server, with authorization bound to the call, not broad tokens.

[Ben Bar Lev @VerigateAI]

Authorization has to run before the tool call and be bound to the value. That is the default we build: deny first, signed evidence after. https://t.co/fPVMb5C4At.

[Ben Bar Lev @VerigateAI]

Four popular agent frameworks this week showed the same gap: a guardrail flag that never enforced, a peer that self-approves, and a jump that bypassed a reject. The hole is at the framework hop, not the model.

[Ben Bar Lev @VerigateAI]

If the permission check is never called, the agent acts regardless of intent. Post-hoc guardrails can only report after the tool already ran.