AssuranceOS, the internal audit function any company can run

Nineteen governed Gemini agents run a company's internal audits end to end, and hand a person only the decisions that need a signature.

Comment

The problem

Internal audit is where a company checks that the controls it promised are the controls it runs.

NYSE-listed companies are required to maintain that function. For companies without a listing or regulatory requirement, the decision is priced in headcount: Robert Half's 2026 guide puts a single internal auditor at $68,750 to $99,750 in base salary, so a four-person function is close to half a million dollars a year fully loaded before it audits anything.

Even funded functions do not reach everything. The Internal Audit Foundation's 2026 North American Pulse survey found the share of functions reporting budget cuts rose from 11% to 19% in a single year, while the share of audit executives calling their funding sufficient fell from 53% to 45%. In practice, annual audit plans define what the function will cover — and what remains outside it, with residual risk someone has to accept.

AssuranceOS covers what an audit team covers, end to end, with a fleet of nineteen governed agents on Gemini 3.7 Flash, for a few dollars of model usage per audit. It provides audit execution capacity to a company that never staffed a full function, and extends the capacity of one that did.

What it does

AssuranceOS is a multi-tenant audit platform that a company can connect to its own environment. Create a company, connect the systems where its controls actually operate — today GitHub, Jira, Confluence, Google Drive, Okta, Entra ID and Google Cloud IAM — and a governed fleet plans the audit, collects evidence, tests complete populations of records, develops findings, follows remediation and independently verifies the fix. Source-system access is read-only; model output can propose work but cannot approve it or become canonical evidence. Those integrations are adapters behind a common connector contract, so the audit lifecycle is not tied to those products or to the seeded demonstration below.

I audit for a living, in a bank's third line of defence. The constraints here come from actual audit work: evidence must support conclusions, reporting authority stays human, remediation must be followed through, and the person who raised a finding cannot perform its independent retest.

Internal audit already has a rulebook, the IIA's Standards: conclusions need sufficient, reliable evidence; the function must remain independent; and agreed actions have to be followed through to closure. AssuranceOS turns those requirements into system constraints. A conclusion without accepted evidence does not render, a non-independent retest is refused, and remediation cannot close without fresh evidence. Most audit software records what you did. AssuranceOS enforces what you were required to do.

So one rule holds the whole design together: model output can propose work, and it can never grant itself authority or become canonical evidence. Every agent action is bounded by a signed release, a short-lived execution envelope, a default-deny gateway, evidence provenance, deterministic tests, and recorded human gates.

The governed audit lifecycle

Onboard, plan, collect, test, conclude, approve, remediate, retest, report, monitor. The agents work the lifecycle; approval stays with a person.

One audit, end to end

The deployment is live. The submission notes contain access to the evaluator surface on the running Cloud Run service, while the public Explorer at https://assuranceos-explorer-91995351602.us-central1.run.app requires no token, account or backend. Both expose the signed fleet, gateway denials, prompt-injection replay, and seeded ground truth beside the observed result.

The Explorer uses the product's own interface, with responses captured verbatim from a live instance running the seeded Asteria tenant.

The demonstration runs on Asteria Systems, a synthetic company built from patterns I encountered across four years in internal audit. Every party, system, date and figure was replaced; nothing derives from client records. What carries over is the shape of the failures a control has to survive. One recurring example is surprisingly mundane: a document changes, the systems built from it do not, and nobody notices.

On the seeded demonstration company, AssuranceOS finds a failure no single-system check can see: a customer contract changed a response SLA from eight hours to four, but the operating procedure and Jira automation still use eight. Every internal system therefore agrees—and they are all wrong. AssuranceOS reconciles the three sources, identifies three actual breaches and €7,200/month of unnoticed service credits.

One commitment, three systems, and the reconciliation between them

Two incidents look identical and are not reported: one belongs to a customer whose contract was never amended, one predates the amendment. Both refusals stay on the record with their reasons, because an audit that reports everything that looks wrong is ignored within a month.

Then the autonomous workflow stops and hands the decision to the audit lead. It assembled the evidence, tested the whole population, searched for reasons it might be wrong, and put the decision in front of the audit lead. Approving opens a remediation obligation against a named owner, exactly once, and requires an independent retest, by a different identity from the one that raised the finding, before it can close.

Those gates are deliberate. Independent retesting is enforced as an authorization rule rather than left to methodology, and a finding remains open until fresh evidence demonstrates that the agreed action worked.

What an audit costs to run

Token usage is recorded on every model call and totalled on a What this cost to run card, priced at published rates and shown alongside records tested, evidence hashed and human decisions required.

What an audit costs to run

Metered on the seeded tenant and projected across three audit sizes, at the published Gemini 3.7 Flash rate.

Features and functionality

Autonomous execution

  • Risk-scores the audit universe and produces a portfolio plan that explicitly names exclusions and the residual risk accepted by a human.
  • Approved plans become durable engagements pinned to a signed Audit Pack and a fixed period, broken into typed tasks that lease, retry and resume over days.
  • A recurring scheduler launches versioned audit occurrences unattended. Monitoring signals become review cases rather than approved findings.
  • Read-only connectors. An agent that cannot write to your systems cannot break them at three in the morning.

A real tool-using agent loop

Agents request typed tools, the gateway executes or refuses them, and the returned data or denial is fed back into the next reasoning step. Thirteen tools expose explicit argument contracts; every run records the authorization decisions around them.

Governance the fleet cannot talk its way past

  • 19 Ed25519-signed ADK agent packages, deployed on Gemini Enterprise Agent Runtime with managed Agent Identity. Tool authority is the intersection of signed package policy and a lease-bound execution envelope.
  • AssuranceOS has its own default-deny task gateway for audit-specific authorization: every tool call must satisfy both the signed agent policy and the task's short-lived execution envelope. Google Agent Gateway is a separate managed egress boundary and, when configured, is bound and verified independently.
  • Prompt injection is screened at inbound context, tool arguments, model output and reasoning retention through Model Armor. The Asteria policy page carries a real payload; it is detected, reported and not obeyed.
  • OpenTelemetry traces, Cloud Trace and the canonical audit-event ledger preserve the reasoning and authorization path, including refused runs.
  • A published signed agent catalogue exposes each agent's mandate, non-goals, permitted tools, human gates and known limitations directly from its released package.

Evidence and reporting

  • Content-addressed evidence with hash-chained custody. Every conclusion traces to the exact bytes it came from.
  • Reports render only when every material claim resolves to accepted evidence or an explicit recorded scope statement. Otherwise issuance fails closed.

Judge Mode

  • Reads the live application and release registries: signed fleet inventory and digests, managed deployment and Memory Bank configuration, evaluation totals, canonical traces and gateway decisions, prompt-injection replay, idempotency replay, and the seeded ground truth next to observed results.
  • Asteria exposes a complete audit already run. Your company in the sidebar creates a fresh tenant that can attach GitHub, Jira, Confluence, Drive, Okta, Entra ID or Google Cloud IAM under its own read-only grants.

The same audit, run by two models

The audit workflow is model-transport agnostic; model selection sits behind one runtime contract, so model choice is a deployment decision and the governance guarantees are a property of the platform.

The full audit was run by Gemini 3.7 Flash on Vertex AI and by Gemma 4 12B on a local llama.cpp server with network egress denied. Both achieved the same full ground-truth match: the control conclusion was identical, the embedded injection was contained, the same false positives were suppressed, the same unauthorized actions were refused, and independent remediation verification was enforced.

That matters for organizations whose audit data cannot leave the auditee's network.

Technologies used

Google
Gemini 3.7 Flash via the Google GenAI SDK, on Vertex AI. Structured JSON validated against per-task schemas before it can influence workflow state
Google ADK + Vertex AI Agent Engine 19 signed agent roles deployed as managed reasoningEngine resources. Deployment is qualification-gated on all 76 release cases passing; every resource is read back through the API, with managed Agent Identity enabled
Vertex AI Memory Bank tenant-isolated, generated only from sessions approved for memory, bounded TTL, context rather than authoritative evidence
Model Armor inline guardrails on tool arguments and model output
Google Agent Gateway a separate managed network-egress layer. When configured, each deployed agent is bound to the gateway and the binding is read back and recorded; audit-specific authorization remains in the AssuranceOS gateway
Google Cloud Cloud Run (service + 5 jobs), Cloud SQL, Cloud Storage, Pub/Sub, Secret Manager, Cloud Scheduler, Cloud Trace, in 35 Terraform resources

Additional Google models

Model Job
Gemma 4 12B the same governed loop on loopback, for populations that cannot leave the auditee's network
EmbeddingGemma semantic retrieval over canonical evidence: how a person finds a record, with no authority over what a claim resolves to
Chirp 3 walkthrough interviews become transcripts, and transcripts become assertions to be tested

Findings and learnings

  • The hard part was making the agents authority narrower than their capability. Signed releases, task-bound permissions and human gates made that autonomy auditable.

  • Cross-system reconciliation also proved more valuable than checking systems independently: several systems can agree with each other and still be wrong.

  • Finally, keeping evidence and authority outside the model let the same audit run on Gemini and local Gemma without changing the conclusion or the governance guarantees.

Sources for the figures in "The problem": NYSE Listed Company Manual section 303A.07(c); Robert Half 2026 Salary Guide; Internal Audit Foundation, 2026 North American Pulse of Internal Audit (373 chief audit executives, surveyed October to December 2025).

Built With

Share this project:

Updates

Submission history