AaltoAI 2026 · Norrin challenge
The folder decides which model sees it
Not the prompt, where the model can be talked out of it. The folder carries a label, the provider carries a clearance, and the broker compares the two on every tool call.
Open the deck (PDF, 6 slides)The demo · 67 seconds, no sound
A workspace labeled confidential, opened on a provider cleared only for public: no tools, no messages, and the broker names the check that refused. Switching to a cleared provider lets the same session run, and the audit skill reads the data it is now allowed to see.
About the bands on the slides
Slides carry confidential and restricted bands because they quote the demo workspace the product guards. Every record in that workspace is fabricated for the demo. This page is public, so it is marked public.
What the deck shows
A folder carries a level in .confidentiality.json. A provider
carries a clearance. A provider cleared below a folder's level gets no access to it at
all, not even a file listing.
It is a guardrail, not a sandbox. It stops the tool calls it mediates, and it says out loud which check refused.