Clearance Desk

Inspiration Studios already pay for rights systems. They still miss deliveries. Forty-eight hours before lock, Business Affairs is in email asking: can this cut ship in the US and EU with this soundtrack? One unlicensed sample or an unsigned cameo becomes a delay or a takedown. Rightsline stores the rows. Nobody sits on those rows and blocks a bad ship. We built the desk, not another ERP.

What it does Clearance Desk takes a cut manifest — music, archive clips, talent, target territories — and answers approve, conditional, or block. A Gemini / ADK director delegates to Music, Archive, and Talent agents. Each one imports and calls IBM tools at runtime: lookup_music_license, lookup_clip_license, lookup_talent_release. Those tools query live watsonx.data tables. A deterministic engine applies territory, expiry, and likeness rules. The UI shows findings, territory chips, the IBM tool trace, and a BA audit log. BA can escalate, acknowledge, or record a legal override. Override does not silently flip a block to approved. Three demo cuts: Midnight Signal — blocked (unlicensed sample + guest likeness) Harbor Light — conditional (expired cue + US-only clip for UK/AU) Afterlight — approved (catalog already covers the targets) You can also register any JSON cut sheet. No video file. The desk works from ids, the way a real cue sheet does. Hosted: https://clearance-desk-kzfs67wayq-uc.a.run.app

How we built it Python and FastAPI. The dashboard is a single BA desk. IBM: watsonx.data in eu-de (iceberg_data.studio) holds music_licenses, clip_licenses, and talent_releases. The app uses IAM, the lakehouse statement API, and those three tools. The same tools are exposed as an MCP server (python -m app.ibm.mcp_server). Demo mode falls back to local JSON so tests never hit the lakehouse. Google: Gemini writes the BA summary. ADK defines ClearanceDirector and the specialist agents (/api/agents/adk-config). The product is on Cloud Run in us-central1. Secrets stay in Secret Manager. The verdict is not the model’s opinion. IBM returns rows. The engine scores them. Gemini only rewrites the summary.

Challenges we ran into watsonx.data Lite is not a local Postgres. Schema needed an Iceberg location, queries had to run one statement at a time, and the first query client was the wrong API. We rewired to IAM plus the statement endpoint and cached the token and engine id. Six live lookups in series made the UI look frozen. We ran assets in parallel, cached rows, and capped Gemini at 20 seconds so a dead model cannot hang the desk. Google had retired gemini-2.0-flash mid-build. Cloud Run under a university org denied public IAM, then the runtime service account could not read secrets. We granted Secret Accessor and shipped a public *.run.app URL with ibm_live: true.

Accomplishments that we're proud of A judge can open the hosted URL, click one button, and see IBM queried in the trace — not mentioned in a README. Three cuts, three different verdicts, same catalog. The desk can say yes. BA actions leave an audit line without the agent inventing a license. That is the product we meant to build.

What we learned Rights clearance is a data problem first. If the agent invents a row, you have a liability. Tools plus a deterministic engine beat a long prompt. “Conditional” is the honest studio outcome; most cuts are messy, not illegal. Partner APIs in a hackathon are the product. Getting watsonx and Cloud Run actually called was harder than the UI, and it is what the track asks for.

What's next for Clearance Desk Persist the audit log. Emit escalate / override as events (Confluent is optional on this track and a natural next step). Connect real Rightsline or FilmTrack ids instead of the demo catalog. Deploy the ADK graph to Gemini Enterprise Agent Platform. Keep IBM Bob in the development loop and export the session trail the track wants to see.

Built With

• css
• docker
• fastapi
• gemini
• google-adk
• google-cloud
• google-cloud-run
• html
• httpx
• ibm-cloud
• ibm-watsonx.data
• iceberg
• javascript
• mcp
• presto
• pydantic
• python
• secret-manager
• uvicorn