HeadlinesBriefing favicon HeadlinesBriefing.com

Shen-Backpressure Brings Formal Verification to AI Code Generation

Hacker News •
×

Broken access control remains the OWASP Top 10's #1 vulnerability, persisting because security rules live in prompts and checklists rather than being enforced structurally. When AI generates thousands of lines of code, behavioral gates fail because models cannot reliably remember every invariant across the entire codebase.

Shen-Backpressure offers a different approach by moving enforcement into the substrate itself. Instead of begging models to remember authorization rules, developers specify invariants in Shen's sequent-calculus type system, then generate guard types that refuse invalid states at compile time. The tool creates sealed interfaces and smart constructors that make violations impossible by accident.

The multi-tenant authentication demo shows how proof chains work: jwt-token → authenticated-user → tenant-access → resource-access. Each step requires discharging premises before constructing the next type, concentrating security checks at construction boundaries rather than scattering them across handlers.

This represents a fundamental shift from hoping models remember rules to designing systems where rules are structurally enforced. The approach works with Go, TypeScript, Python, and Rust targets, using ordinary language features like visibility modifiers to create unbreakable contracts.