gdp-ts: Type-Level Authorization Proofs for Sensitive Operations and Agent Code

X postChris TateTool

Chris Tate and Guillermo Rauch showcase gdp-ts, a TypeScript library implementing 'Ghosts of Departed Proofs' to enforce authorization checks at compile time via the type system.

Key points

  1. gdp-ts is a TypeScript library, linter, and AI skill created for safer API design.
  2. Sensitive functions require typed proofs demonstrating that callers performed the required authorization checks.
  3. Missing proofs are caught by the TypeScript compiler before deployment, preventing critical security oversights.
  4. The pattern originates in Haskell ecosystems (based on research by Matt Noonan and Ollie Charles) but previously remained niche due to human syntactic overhead.
  5. Both Tate and Rauch highlight that the pattern suits agent-generated code, as AI agents thrive under tight loops with rigorous type constraints.

Why it matters

As AI agents generate an increasing volume of code, manual reviews struggle to keep pace. Enforcing access checks within the type system ensures that missing security logic fails the build rather than slipping into production.

Analysis

By adapting the 'Ghosts of Departed Proofs' pattern to TypeScript, gdp-ts turns authorization requirements into structural compile-time obligations. Rauch observes an inversion in developer workflows: while human engineers often resisted the syntactic overhead of formal proof threading, AI agents benefit from explicit, hard constraints akin to Rust's borrow checker, catching omissions with zero runtime performance cost.

Original post

Chris Tate

@ctatedev · 5 October 2026

This makes required checks for sensitive operations part of the type system Especially useful for agent-written code 1. Define required checks 2. Require typed proof 3. Catch missing proof at compile time t.co/yBwL9foZSc

120 likes6 replies99 bookmarks16k views

View on X
Selected replies (5)
  • @sunglassesface @ctatedev @grok can you explain wtf this is for people with low IQ that dont care about marketing
  • @grok @sunglassesface @ctatedev gdp-ts is a TypeScript tool that forces permission checks into the type system. Sensitive actions (change password, etc.) require a special "proof" token. You only get that token by actually running the auth check on the exact user and resource. No matching proof? The code
  • @sunglassesface @grok @ctatedev very avant-garde
  • @Souniolang @ctatedev Step 1 carries the weight: proofs enforce the checks someone remembered to list. The ones that never made the list keep passing — silently. The next failure mode for this pattern is the list's own coverage.
  • @gol_tiro @ctatedev catching a missing proof at compile time is a nice fit for agent code, forgetting the check just fails the build. does threading the proof through get annoying in a bigger codebase?

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 6 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Repository:rauchg/gdp-ts

    gdp-ts: Compile-Time Authorization Proofs in TypeScript

    gdp-ts brings the 'Ghosts of Departed Proofs' paradigm to TypeScript, enforcing authorization and entitlement checks at compile time via the type checker.

    550starsTypeScript

    Web development· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

  • Repository:miskaone/learn-powerplatform-fyi

    Mastery Gate: Deterministic Control of AI Agents via WebMCP

    Mastery Gate is an experimental PL-400 learning platform demonstrating how websites can deterministically govern AI agents via the WebMCP protocol. Instead of relying on prompt instructions, a TypeScript engine dynamically manages tool availability and structurally protects answer keys.

    TypeScript

    AI & LLMs· Demo

  • X post:fks

    Flue 2: TypeScript Agent Framework Adopts React-Inspired Hooks

    Fred K. Schott has announced Flue 2, a TypeScript framework for building AI agents that introduces a React-style hooks pattern to tackle capability composition and runtime adaptability.

    639bookmarks126.6kviews

    AI & LLMs· Announcement

  • Link:infisical.com

    Infisical: Open-Source Security Infrastructure for Developers and AI Agents

    Infisical is an open-source platform (MIT licensed) covering secrets management, certificate lifecycle management (PKI), and privileged access management (PAM). Designed for modern cloud environments and AI agents, it prevents credentials from being committed to disk or leaked via LLM prompt injection by brokering API calls and access sessions.

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.