Cleveria — Enterprise Agent Fleet Identity & Authority Lock

• 

Three names you will see, and what each one is

Softronica S.A.S. is the company: Colombian, founded in 2011. Qnowa is its queue and turn management platform, in production for years with banks, clinics, government offices and service centres — it manages the lines real customers wait in. Cleveria is this submission: the reasoning and identity layer that answers who decided this when a machine, not a person, closes a case.

Qnowa is the operation. Cleveria is the authority over it. Softronica answers for both. That is why the demo you will open is branded Qnowa.

Try it now — no install, no account, ten seconds

The repository is private and already shared with the judges. The demos are public: you do not need repo access to verify our central claim.

https://sign.qnowa.com — the boundary

• Press "Make the agent try to sign"
• Expect: HTTP 403 PERMISSION_DENIED from Google Cloud KMS, shown raw
• What it proves: the agent's identity cannot touch the human key, and the refusal is issued by Google rather than by our code
• Note: you are not signing anything — you are making the agent try, which is the one thing this system exists to refuse. Anyone can walk in and check the boundary; signing itself needs a Cloud KMS permission Google classes as sensitive, so only registered test accounts can sign

https://demoportal.qnowa.com — the operation

• The customer-facing side of the same preproduction system
• What it proves: Qnowa is a real product with real queues; Cleveria is the layer on top

Inspiration

On 26 August 2026 we counted 58 rows marked "human" even though a machine had closed them. Four were in the dismissed state, where a customer's complaint is thrown out.

They were not from a synthetic dataset. They came out of Qnowa's own preproduction records — our queues, our schema, our defect.

No model chose to impersonate anyone. The closing function wrote "human" by default, the console exposed no flag to say otherwise, and the schema had no state meaning "a machine closed this." A system that cannot express "a machine did this" will record that a person did.

That is not a bug in a form. It is an agent-identity failure, and it is structural.

What it does

An agent that closes tasks and cannot sign as a human — not because it shouldn't, but because it can't.

The key that authorises human judgement lives in Cloud KMS. The agent's service account holds no binding on it. When the service tries, it does not get a polite refusal from our code. It gets this, from Google:

HTTP 403  PERMISSION_DENIED
Permission 'cloudkms.cryptoKeyVersions.useToSign' denied on resource '.../clave-humano'

We did not write that sentence. That is the whole point.

How we built it

Six Google models take part. Exactly one of them decides.

Model	What it does	Can it widen the machine's authority?
Gemini 3.6 Flash	adjudicates — the one judgement call in the flow	no: a function takes the minimum of its verdict and the ceiling
gemini-embedding-001	semantic fence: catches judgement written to dodge the keyword list	no — it can only ask for more caution
text-multilingual-embedding-002	second fence, scored independently	no — it can only ask for more caution
google/gemma-4-26b-a4b-it-maas (Model Garden)	co-signs: a model of another family must agree first	no — it can only withhold a closure. Its silence shuts the door
Speech-to-Text	turns a voice note into words	no. It is before the decision path, not on it
Text-to-Speech	turns the answer into speech	no

No model here can grant itself authority. Authority comes from a deterministic function and from which key IAM will let you touch. A model that fails, hallucinates or is poisoned opens no door: at worst it bothers a person unnecessarily.

Two agents and a person — not three agents. Three separate keys, three scopes, three IAM principals. The cloud refuses twice over: an agent cannot sign as the person, and one agent cannot sign as another agent.

Built on Google Agent Development Kit 2.8, Cloud Run, Cloud KMS (EC P-256), Firestore and Cloud Scheduler.

Challenges we ran into

Four things broke while we built this, and one we could not fix. All four are written up in the article, each with the command that shows it.

The one worth naming here: our own demo was producing cosmetic evidence. A script printed an invented signature when credentials were missing, without marking it. A dashboard announced a caught-attack figure the measurement did not support. We found them ourselves, before shipping — which is the same discipline this project exists to enforce.

Accomplishments that we're proud of

Sixteen break tests, all sixteen green in 196 seconds on our last run, 31 August 2026. They try to break the guarantee: replay a genuine human approval onto another case, poison the agent with an injection in four languages, forge a closure, reorder the ledger, kill the process mid-write.

Six of the sixteen run with no credentials and no network at all. You can verify every signature we claim, offline, on your own machine.

What we learned

A safeguard written in application code or in a system prompt is negotiable. The one we could not negotiate with came from the platform.

And a label is not an identity: those 58 rows carried no cryptographic signature at all — they carried a field that said human, which any code could write. That is exactly the problem.

What's next for Cleveria

Widening the safe lane rather than adding brakes: the machine should close more of what it can prove, not less. And moving from preproduction to customer-facing queues, which is a question of operational confidence, not of architecture.

Code and tests

The full repository — sixteen break tests, the adversarial bank, the offline verifier and the technical write-up — is private, with access already granted to [email protected] and [email protected] as the rules require.

If you are judging this and need access from a different account, write to [email protected] and we will open it immediately.

Category: The Fortified Enterprise Fleet · Organization: Softronica S.A.S.

Built With

• cloud-kms
• cloud-run
• cloud-scheduler
• cryptography
• firestore
• flask
• gemini
• gemini-embedding
• gemma
• google-adk
• google-cloud
• python
• rfc-8785
• speech-to-text
• text-to-speech
• vertex-ai