Armada

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

You don't prompt Armada. You employ it.

A governed AI workforce that earns real authority overtime, and proves its work instead of claiming it.

Inspiration

Every "AI agent" demo asks you to trust a black box with your inbox, your Stripe account, your codebase, on day one, on faith. For any work that actually matters, that is a non-starter. And there is a second, quieter problem underneath it: even when an agent says it did the job, you have no way to know it really did. Agents are fluent, and fluency makes a convincing "done."

So we asked the two questions nobody was answering together:

1. What would it take to hand an AI real authority over real accounts, safely?
2. How would you ever prove an autonomous agent did the work, instead of taking its word for it?

The answer to the first looks exactly like how a company onboards a human: an interview, a probation period, trust that is earned through performance and lost through failure, a chain of command, and a human signature on the things that carry risk. The answer to the second is the thing almost no agent system has: an independent auditor that checks the world itself, not the agent's story about it.

Armada is both answers, shipped and running on Google Cloud.

What it does

Armada is a company you staff with AI employees. You hire them, they go on probation, they earn autonomy through real performance, and every consequential action escalates to you for a one-tap approval, on your phone, your watch, or straight out of the macOS notch.

🧑‍💼 Hire, don't prompt. Create an AI employee with a role, a department, a manager, and a voice. A readiness assessment places them. New hires start in shadow mode: they produce proposals and touch nothing real until you graduate them.

🎚️ Autonomy is earned, then re-earned. Every employee carries a trust score that maps to a level (Probationary → Junior → Senior → Executive). Reads earn a little, successful executions earn more, failures and denials cost trust, and trust decays on a 7-day half-life. Autonomy is never a static flag.

🔏 Approve X, and only X runs. Consequential actions (external email, invoices, moving money, sharing) always require you. Approving mints a single-use, HMAC-signed execution grant bound to the exact parameters you saw. The agent cannot approve one thing and run another, and a grant can never be replayed. Financial actions additionally carry a signed intent-and-total mandate.

🤖 Real work across 34 integrations. Gmail, Slack, GitHub, Stripe, Notion, HubSpot, Linear, Shopify, Klaviyo, Jira, and 24 more, each per-user and multi-tenant. Verified doing genuine writes, not staged demos.

🎯 It runs itself, and proves it. Set a standing objective. The Chief of Staff plans, delegates across the fleet, and drives it on a cadence with no human in the loop. Then an independent auditor re-checks every acceptance criterion against live data, cites concrete evidence, and reports a verified percentage that the worker can never self-grade. Objectives run in achieve or maintain mode.

📞 Call your fleet. Real native-audio Gemini Live voice calls, each employee in a distinct voice, including multi-party conference calls: add a teammate mid-call and everyone, human and AI, hears each other and speaks, one clean floor at a time.

🎨 Grantable superpowers. Employees can be granted generative capabilities, image, video, speech, and music (Veo 3, Lyria 2, Chirp 3 HD, and Gemini image). Every prompt is screened by Model Armor and every output is SynthID-watermarked.

🧠 They raise their hand. A blocked or uncertain employee does not guess. It reaches out to the responsible human (a typed ask or an actual phone call), pauses cleanly, and resumes exactly where it left off once answered.

One gate, every surface. Web console, iPhone, Android, Apple Watch, the macOS notch app, an MCP server, an A2A endpoint, webhooks, cron, and live voice all cross the same checkpoint: trust check → approval gate → credential broker → Model Armor → signed audit. No surface, and no external agent, can bypass governance.

How we built it

Google-native, end to end. The whole system holds one invariant: every action an agent takes passes through the same governance gate, no matter what triggered it.

The central design split is "ADK is the brain, the control plane is the hands." The Google ADK runner drives the Gemini agent loop and decides what to do, but it holds no credentials and touches no database. Every tool call it emits is an authenticated call back to the control plane, the only place that enforces trust, consumes grants, screens with Model Armor, brokers credentials, meters spend, and writes the audit trail. That separation is the security model.

• Reasoning: Gemini 3.5 Flash on Vertex AI, every agent run, chat turn, interview, objective cycle, and the audit. The conference "conductor" that decides who speaks on a call is Gemini 3.5 Flash too.
• Runtime: three Cloud Run services, a Next.js control plane (governance, tools, trust, approvals, billing, objectives), an IAM-protected ADK runner, and a native-audio Gemini Live voice gateway. Service-to-service calls use OIDC identity tokens plus a shared secret.
• State + memory: Cloud SQL (Postgres 16) for all durable state via Drizzle, and Vertex AI Memory Bank for institutional memory, distilled after each run and recalled before the next.
• Autonomy: Cloud Scheduler drives the objectives heartbeat and every cron trigger. Pub/Sub feeds Gmail change events into webhook-triggered runs.
• Safety + identity: Model Armor screens prompts and inbound events at the gate. Each hire is published as an A2A agent card in the Agent Registry and carries an Ed25519 identity that signs its action assertions. BigQuery + Cloud Trace (OpenTelemetry) are the audit lake and per-tool spans.
• Generative: Veo 3 (video), Lyria 2 (music), Chirp 3 HD (speech), and the Gemini image model, all governed and SynthID-watermarked.
• Identity + delivery: Firebase Auth + FCM for SSO and actionable approval pushes to iPhone and Apple Watch.
• Four native surfaces: a Next.js web console, a Flutter app for iOS and Android, a watchOS Apple Watch app, and a macOS notch companion, all on the same governed backend.

The Google Cloud & Gemini stack, in full

Capability	How Armada uses it
Gemini 3.5 Flash (Vertex AI)	The reasoning model for every agent run, chat turn, interview, objective cycle, and the independent auditor, and the conference "conductor" that routes who speaks on a call.
Native-audio Gemini Live	Real, low-latency voice calls and multi-party conferences, one identity, held inside the voice gateway.
Google ADK	The Python runner builds an agent per hire and drives the Gemini loop; every tool call proxies back to the control plane for enforcement.
Vertex AI Memory Bank	Institutional memory, salient lessons distilled after each run, recalled and injected before the next.
Cloud Run	Three services: the Next.js control plane, the IAM-protected ADK runner, and the voice gateway (OIDC + shared-secret between them).
Cloud SQL (Postgres 16)	All durable state, via Drizzle with reproducible migrations.
Model Armor	Prompt-injection and policy screening at the tool gate, on inbound events, and on every generative prompt.
Agent Registry + Agent Identity	Each hire is a published A2A agent card carrying an Ed25519 identity that signs its action assertions.
Cloud Scheduler + Pub/Sub	The autonomy heartbeat and cron triggers; Pub/Sub feeds Gmail change events into runs.
BigQuery + Cloud Trace (OpenTelemetry)	The audit lake and per-run, per-tool spans correlated by trace id.
Firebase Auth + FCM	SSO and actionable approval pushes to iPhone and Apple Watch.
Veo 3 · Lyria 2 · Chirp 3 HD · Gemini image	Grantable generative capabilities (video, music, speech, image), Model-Armor-screened and SynthID-watermarked.

How it gets better

Armada is built to improve on three loops, not to sit still:

1. Every employee learns. After each run, Vertex AI Memory Bank distills the salient facts and lessons; before the next run they are recalled and injected, so an employee compounds context across its entire working life. And because memory can entrench a bad habit, it is explicitly ranked beneath the current order.
2. Standing tracks performance. Trust is a live score: successful executions raise it, failures and denials lower it, and it decays on a 7-day half-life. Perform, and you earn more autonomy; slip, and you are pulled back. A probation-to-graduation track and performance reviews make this a real HR loop, not a config flag.
3. The work corrects itself. Every objective cycle ends with an independent audit against live data, and the auditor's exact finding ("Issue #22 is still missing its acceptance note") is fed into the next cycle's prompt, so the worker targets precisely what remains unmet. The loop closes: the world moves, the fleet acts, the auditor checks reality, and both the employees and the product get sharper from what it finds.

Over a 30-hour run this drove five company archetypes to a fully verified board, and the platform discovered roughly 16 of its own systematic fixes, and grew two brand-new tools, from where the audits failed.

Challenges we ran into

1. Verifying autonomous work when you cannot trust a word the agent says. This is the deepest problem in agentic AI, and the one we spent the most on. An agent is fluent, and fluency produces a convincing "done" whether or not anything happened, we caught one reporting it had "successfully coordinated the Ops Brief" when the document did not exist. A self-report is not evidence. So verification had to be state-based (judge the world through read-only APIs, never the agent's transcript), run in a separate auditor context the worker cannot influence, cite concrete evidence per criterion, and fail safe (unverifiable means not done). Then the hard part compounded: verdicts had to stay stable over a world that keeps moving. We hit verdict flip-flopping on judgment-heavy criteria, so we drove auditors to temperature: 0 and rewrote criteria to be mechanically checkable (named lists, explicit counts, string-matched ids). We hit a subtler trap, an audit that ran out of steps and emitted nothing was zeroing real, already-verified progress, so we separated "criterion unmet" from "audit inconclusive": a broken audit must never erase verified reality, it holds the last known state.

2. Giving an AI real authority over real accounts without ever letting it hold a credential. The security model is an architecture, not a setting. The agent brain (Google ADK) decides what to do but holds no tokens and touches no database; every tool call is an authenticated hop back to a control plane that is the only place trust, grants, credentials, screening, metering, and audit live. Credentials are brokered just-in-time, per-user, per-action, and never persisted to the agent. Consequential actions mint a one-time HMAC grant bound to a SHA-256 hash of the exact parameters the human approved, so an agent physically cannot approve one thing and execute another, and a grant cannot be replayed. The invariant that made this defensible: every surface, web, iOS, Android, watch, the notch, an MCP client, an A2A client, a webhook, cron, or a live voice call, crosses the identical gate.

3. A fleet that self-directs for 30 hours on real money without thrashing. Standing autonomy surfaces failure modes that never appear in a one-shot demo. Objectives needed two lifecycles (achieve closes at 100% verified, maintain re-verifies forever), because a "keep the books current" mandate must reopen when the world moves the balance after you verified it. A naive stall detector flagged perfectly healthy maintainers holding 100% as "stalled" and silently doubled their cadence, real work has to distinguish "not progressing" from "done and holding." Verification racing delegation forced per-cycle re-verification. And the loop only truly closed once we fed the auditor's exact finding into the next cycle's prompt, so the worker targets precisely the criterion still unmet.

4. Institutional memory that entrenched its own mistakes. Vertex Memory Bank makes employees compound context, and that is exactly what made it dangerous. The fleet kept sourcing customers from a cached copy because its own memory reinforced the stale pattern, current instructions and remembered ones were competing as equals. The fix is a genuinely non-obvious principle for stateful agents: memory is strictly subordinate to the current order, background context only, and any memory that conflicts with a fresh instruction is treated as outdated.

5. Real-time multi-agent voice, and delegation that does not cascade. A conference call is N concurrent native-audio Gemini Live sessions sharing one room, which demands hard floor control (exactly one speaker owns audio and transcript at a time), sub-second routing (a 0ms heuristic for named/team/follow-up turns, the model conductor only for genuinely ambiguous ones), and a recorder that mixes buffered agent audio without ever blocking the live call. Underneath, delegation nearly took us down once: a briefly-busy runner exceeded the dispatch ack, an inline fallback dropped the child run id, and the manager re-delegated in a cascading retry storm. We made the completion webhook the single source of truth for delegation status, made delegate_task idempotent, and preserved the run id across the fallback, so authority flows down the org chart exactly once.

Accomplishments that we're proud of

We proved it, we did not just claim it. We ran a 30-hour live experiment on the production system: five company archetypes (a dev shop, a SaaS startup, an e-commerce store, an agency, a finance desk) as real standing objectives, acting on real connected accounts, metered on the real treasury, against a living world that injected fresh external business events the fleet did not create.

• The board converged to a full all-green, independently-verified state, every archetype at 100% verified simultaneously, across roughly 48 self-directed cycles each.
• The system discovered around 16 of its own systematic fixes by watching itself work, and even grew two new product tools out of what the auditor found was missing.

And alongside the research:

• Multi-party AI voice conference calls, add an employee mid-call and everyone hears each other. We have not seen this anywhere else.
• Cryptographically enforced approvals, a one-time HMAC grant bound to the exact parameters you approved.
• Four native surfaces and two protocol surfaces (MCP + A2A) on a single governance gate, so even an external agent obeys your trust rules.
• Real writes across 34 connectors, per-user and multi-tenant.

We believe this is the most rigorously governed autonomous AI workforce out there, and the only one where every autonomous outcome is independently verified against live data instead of self-reported.

What we learned

• Autonomy is a trust-and-verification problem, not a model problem. The unlock was never a bigger model. It was earned authority plus independent verification that makes delegation safe enough to actually use.
• A self-report is not evidence. The single most important thing we built is the auditor that refuses to believe the agent and checks the world instead.
• Memory must sit beneath the current order. An agent's institutional memory is powerful and dangerous in the same breath, it will entrench a bad habit unless it is explicitly rank-ordered below fresh instructions.
• Decoupling is a security feature. Splitting the brain (ADK) from the hands (the control plane) is what makes "the agent holds no credentials" true rather than aspirational.

What's next for Armada

• A deeper org: performance reviews, promotions and demotions by track record, and per-department budgets.
• Richer calls: more native-audio languages and warm transfers between employees mid-call.
• A marketplace of pre-built employees and grantable capabilities.
• Enterprise deployments: VPC Service Controls and private, in-tenant runners for regulated customers.
• Deeper Gemini reasoning driving the Chief's long-horizon planning.

Armada · Hire it. Govern it. Trust it.
_{Built on Gemini 3.5 Flash, Google ADK, and Google Cloud.}

Built With

• a2a
• bigquery
• cloud-run
• cloud-scheduler
• cloud-sql
• dart
• firebase
• firestore
• flutter
• gemini
• google-adk
• lyria
• mcp
• model-armor
• next.js
• node.js
• postgresql
• pub-sub
• python
• react
• swift
• tailwindcss
• typescript
• veo
• vertex-ai