ATLAS: Autonomous Assurance Fleet

Inspiration

SOC 2 preparation is still screenshot archaeology. Teams export the same records, chase the same owners and repeat the same judgment calls while evidence goes stale underneath them.

Compliance teams do not need another chatbot. They need an agent system that can do the evidence work, show exactly what it touched and refuse to invent certainty when the proof is incomplete.

What ATLAS does

ATLAS turns SOC 2 preparation into an autonomous, inspectable evidence workflow with eleven registered roles.

Five domain hunters collect evidence across identity, infrastructure, SDLC, HR and vendors. A separate Control Judge uses Gemini 3.5 Flash to decide what each artifact actually proves. Deterministic services handle handoffs, drift, redaction and packaging so collection, judgment and policy are never blurred together.

The workflow is concrete:

Discover: a central registry exposes approved roles, versions, capabilities and scopes Collect: hunters retrieve evidence and preserve its source, collector identity, screening state and SHA-256 hash Judge: Gemini returns cited SATISFIED, INSUFFICIENT or NEEDS_HUMAN rulings Remember: Firestore carries decisions, memories, handoffs and idempotent task keys across runs Govern: application-level identities and scopes constrain each role while Model Armor and a labelled deterministic guard screen untrusted content Observe: OpenTelemetry spans make the workflow inspectable in Cloud Trace Prove: ATLAS emits a root hash that binds artifact hashes with every control's ID, status, verdict and human-touch count, plus a gap register and an independent verifier with every evidence package

Human intervention is measured rather than hidden. Missing evidence becomes one precise escalation, not a confident-looking green check. The manifest root binds artifact hashes with each control's ID, status, verdict and human-touch count, so changing a verdict breaks independent verification.

The moment that proves the product

The deployed Cloud Run proof reads real Google Cloud IAM bindings and real Cloud Storage assets through Cloud Asset Inventory.

Those records prove configuration facts. They do not prove that quarterly access recertification happened or that recovery testing succeeded. Gemini correctly returned INSUFFICIENT, ATLAS recorded the missing proof and the workflow escalated the gap instead of manufacturing a passing result.

That is why the verified private-run demo intentionally shows 3% audit readiness. Only 2 of 64 controls have qualifying evidence in the seeded run. The low number is not hidden, it demonstrates that ATLAS fails closed.

The security path is equally explicit. For a seeded prompt-injection fixture, managed Model Armor returned clean while the labelled deterministic second layer quarantined the content. ATLAS records the provenance as model-armor+deterministic, showing the real defense path instead of crediting the managed service for a verdict it did not produce.

How we built it

The live console, API and SSE activity stream run in one FastAPI container on private Cloud Run. Python async control flow coordinates the role sequence in-process. A separate public Cloud Run service gives judges a read-only console where every control has a visible, provenance-labelled ruling: 59 seeded deterministic decisions plus five sanitised Gemini 3.5 Flash rulings captured from the verified private run, one per hunter domain. Two use live GCP metadata and three use explicitly labelled fixtures. That runtime makes no live model calls and has no direct project IAM role bindings.

Gemini 3.5 Flash through Vertex AI performs evidence summarization and structured control judgment Google ADK LlmAgent roles provide the agent framework Firestore stores the durable ledger, memory, handoffs and idempotency keys Pub/Sub receives event copies for decoupled downstream use Cloud Storage holds generated evidence manifests Cloud Trace receives OpenTelemetry audit spans Cloud Scheduler completed one authenticated private sweep with HTTP 200 on August 29, 2026 and is paused outside validation to control spend Model Armor screens untrusted content with a clearly labelled deterministic second layer

The current Cloud Run revision uses one runtime service account. Role identities and scopes are application controls in this prototype, which we document rather than presenting them as separate cloud principals.

The independent verifier checks internal integrity and required provenance fields, including artifact hashes and control verdicts. It does not cryptographically authenticate package origin or bind the full natural-language ruling narrative.

Data sources

The deployed proof uses live Google Cloud IAM and Storage inventory through Cloud Asset Inventory. The SDLC path uses a clearly labelled fixture in this revision with an optional GitHub adapter available in code. HR and vendor data remain fixture-only.

This separation is visible in the evidence metadata so judges can distinguish live infrastructure facts from reproducible demo data.

Production and demo readiness

ATLAS keeps the live workflow on a private, scale-to-zero Cloud Run service. Judges can safely explore a separate public service at https://atlas-public-demo-jguwjegiqq-uc.a.run.app. It is visibly labelled and exposes a ruling for all 64 controls: 59 seeded deterministic decisions plus five sanitised Gemini 3.5 Flash rulings captured from the verified private run, one per hunter domain. Two use live GCP metadata and three use explicitly labelled fixtures. The public control statuses are synthetic inspection fixtures and do not replace the private run's 3% audit-readiness result. The service exposes only read routes and has no direct project IAM role bindings, production secrets, live model calls or cloud-data access.

The public repository includes a credential-free local mode, labelled fixtures, reproducible setup instructions and 52 passing tests:

https://github.com/himanshu748/atlas

The demo video is public:

https://www.youtube.com/watch?v=ZbEzvKVPXIU

Challenges we ran into

The hardest engineering problem was preserving truth at system boundaries.

A configured service does not prove that a control operated. An IAM export does not prove that a review occurred. A managed security service being present does not prove that it caught a specific payload.

ATLAS addresses those gaps with explicit provenance, conservative judgment states, idempotent handoffs, layered screening and an independent verifier. The result is less flashy than an always-green dashboard and far more useful in a real audit.

Accomplishments we are proud of

A complete agent workflow that takes action beyond a chat loop Eleven discoverable roles with scoped application identities Live enterprise infrastructure reads in the deployed proof Durable memory and handoffs across asynchronous sweeps Honest failure handling for insufficient evidence and missed managed screening A hash-verifiable evidence package whose root binds artifact hashes and every control verdict, plus a gap register A private Google Cloud workflow that scales to zero, plus a separate read-only public judge surface with no direct project IAM role bindings

What we learned

Reliable enterprise agents are defined as much by what they refuse to claim as by what they automate.

The strongest pattern was to keep collected facts, AI judgment and deterministic policy decisions separate, then connect them with durable provenance. Autonomy becomes trustworthy when every decision can be inspected and every unknown can become a bounded human handoff.

What is next

Next we would add production HR, vendor and SDLC connectors, assign separate cloud service accounts to individual roles and cryptographically sign package roots. We would also enable recurring Scheduler sweeps only during active assurance windows while preserving the private scale-to-zero deployment.

Built With

• cloud-asset-inventory
• cloud-run
• cloud-storage
• cloud-trace
• fastapi
• firestore
• gemini-3.5-flash
• google-agent-development-kit
• model-armor
• opentelemetry
• pub/sub
• vertex-ai