ScopeGuard AI

ScopeGuard AI turns scattered client instructions into an approved, evidence-backed delivery plan. Talal Khawaja, Aqeela Urooj and Umer Anis built it for the Work & Productivity category of OpenAI Build Week on Devpost, with Codex doing most of the implementation.

Problem

Anyone who has run agency or client delivery knows the pattern. The brief says five pages, the kickoff call adds a second homepage concept, and a chat message three weeks later moves the launch date. None of those sources contradicts the others explicitly, so the conflict only shows up at handover. Keyword rules can't catch it either. A new request doesn't have to use the word "new", two dates can conflict in different formats, and a suggestion can read a lot like a commitment.

How it works

The user enters the project, the client, the agreed baseline and any number of dated source cards: briefs, meeting notes, emails, chats, tasks and change requests. A server-only route sends them to the OpenAI Responses API and asks for strict JSON Schema output. The system instruction tells the model to:

• compare every source with the baseline;
• cite valid source IDs for consequential findings;
• separate confirmed facts from uncertainty;
• treat later requests as proposed changes rather than approved commitments.

The route then validates the response a second time with Zod and rejects any citation that doesn't match a supplied source.

The workspace lays the findings out by category, with confidence labels and source IDs, covering requirements, conflicts, decisions, assumptions, scope creep, dependencies, risks, questions, tasks, acceptance criteria and a change summary. On the review screen, every requirement gets approve, reject and edit controls plus a reviewer note, and every clarification question has to be resolved. Final confirmation stays locked until nothing is pending, and any edit after confirmation returns the project to draft. The confirmed scope exports as a Markdown brief, a JSON record, a client-facing summary or an internal checklist.

The model name comes from configuration. The deployed build used a smaller model for faster structured analysis. The API key stays in the Node server route and never reaches the client.

Key decisions and trade-offs

• The AI drafts and people commit. ScopeGuard never approves scope, contacts a client or assigns work. Task owners are only suggestions.
• Traceability, not proof. A citation shows where a finding came from. It doesn't make the finding true or legally binding, and the product says so.
• Prototype storage. The workspace lives in browser local storage, with no authentication, multi-user collaboration or server-side audit log.
• Testing. Automated tests cover the analysis contract, source-ID integrity, exports, input validation, prompt-injection fixtures and safe API errors, and CI runs lint, tests and the build.
• Honest attribution. Codex turned the product brief into the architecture, schemas, review state, exports and tests. The team kept the decisions about evidence, approval authority and responsible-AI limits.

What's next

The roadmap lists team workspaces with version history and immutable approvals, side-by-side source excerpts, PDF, DOCX, email and transcript ingestion, re-analysis diffs when a new source arrives, and change-cost estimates based on rate cards that people set.

Delivery scope rarely lives in one place. The signed brief says one thing, kickoff notes add another, and a later email quietly moves the date. Teams spend hours reconciling fragments and still miss requirements, absorb unpriced work, and end up in awkward client conversations.

A server route asks the model for strict JSON Schema output that compares every dated source against the agreed baseline. It returns requirements, conflicts, scope creep, dependencies, risks, questions, tasks and acceptance criteria, each citing source IDs. The response is validated again with Zod, and unknown citations are rejected. A person then approves, rejects or edits every requirement and resolves every question before the scope can be confirmed and exported.