Idea Lab · Oct 22 2026 · AI idea demo

Tinct

Tinct tags every piece of text an agent reads with its source: your request, the system's own directory, or untrusted material such as an email body or a web page. Before a tool call that sends, pays or deletes, it traces each sensitive argument back to that tagged text. If an argument appears only in untrusted text, or nowhere at all, the call is held for a person to approve. That catches the classic injection where a fetched email quietly supplies a new recipient or a new amount. Pick a scenario, read the context on the left, and check the planned calls on the right. You can edit any argument and the trace updates.

Example data only: invented people, domains and amounts. This is a sketch of the logic, not a measured result.

What the agent read

User · trustedSystem / directory · trustedEmail / web · untrusted

Tool calls the agent planned

What to try

Open Injected invoice email: the agent planned to forward invoices to an address that exists only inside the email body, so Tinct holds it.
In that scenario, change the recipient to books@northgate.example. It now traces to the directory and the call is allowed.
Open Hosting renewal: you asked for $84, the web page says $840 and a new account number. Both arguments are held; the payee is allowed.
Type an address that appears nowhere in the context. Tinct marks it "no source" and holds it, because the model made it up.

Known limits of this sketch: matching is exact text, so a value the model reformats (for example "$84.00" from "84 dollars") would need normalizing rules; long free-text fields like an email body are not traced, only addresses, amounts, accounts and URLs; and a trusted source can still be wrong. Tinct narrows what an injection can do; it does not judge whether your own request was wise.