AuditFlow AI

Inspiration

Enterprise audits remain highly manual. Auditors must review large volumes of evidence, identify risks, document findings, request approval, and preserve a reliable audit trail. AuditFlow AI explores how AI agents can assist auditors without replacing human judgment.

What it does

AuditFlow AI is a human-in-the-loop audit workflow for enterprise use. It receives audit evidence, masks sensitive information, coordinates specialized audit agents, produces evidence-backed findings, identifies risks, requires human approval, and preserves approved reports in Firestore.

The system follows three rules: mask PII before processing, create no finding without evidence, and perform no persistence or external dispatch without human approval.

How we built it

The backend uses Python and FastAPI. Google ADK defines the planner, evidence reviewer, compliance auditor, risk analyst, and report gatekeeper. Gemini 3.6 Flash and the Google GenAI SDK generate structured audit reports.

Every report enters an AWAITING_APPROVAL state. Only reports approved by a human reviewer may be persisted in Firestore. The application is containerized and deployed on Google Cloud Run.

Challenges

The main challenge was preventing AI automation from bypassing audit controls. We separated draft findings from approved findings, preserved workflow state, masked sensitive data, enforced evidence requirements, and created a clear approval boundary.

What we learned

Enterprise AI agents need explicit permissions, reliable state management, evidence traceability, human checkpoints, persistent records, and clear responsibility boundaries.

What's next

Next steps include richer evidence ingestion, policy-specific control libraries, stronger authentication, expanded observability, deeper agent delegation, and an improved auditor-facing interface.

Built With

• cloudrun
• fastapi
• firestore
• gemini3.6flash
• googleadk
• googlegenaisdk
• python