Consentinel — Devpost submission

Inspiration

In May 2026, an actress sued a major studio. Her claim: her teenage face had been used, without her knowledge, as the digital basis for a well-known character. She says she found out seventeen years later, from a clip circulating online.

Around the same time, SAG-AFTRA challenged an AI-generated Darth Vader voice appearing in Fortnite. The striking detail wasn't that the voice was synthetic. It was that James Earl Jones had signed a grant. The entire dispute came down to one question: did that grant actually cover this use?

That's the moment the idea clicked for us. This isn't a technology problem. AI can already copy a performer's face and voice with unsettling precision — that ship has sailed. What hasn't caught up is the paperwork. Every contract already spells out, in plain language, exactly what's allowed: this voice, this territory, these three years, face excluded. Think of it as a permission slip.

Two things go wrong with permission slips today:

Outward — strangers use a performer's likeness without one, and their agency finds out by accident, months or years later, from a stranger's screenshot.
Inward — a studio loses track of its own slips. A film passes through dozens of vendors, any of whom might have quietly used a generative tool, and someone has to certify the whole production is clean before release. Usually by emailing everyone and hoping.

What it does

One registry, two directions.

Every signed grant — performer, licensee, permitted use, territory, validity window — lives in a single consent registry. From there, Consentinel watches both ways.

Enforcement (outward) — for talent agents and estates. We search five languages for anyone using a client's face or voice without a matching grant, read every page we find, and assemble a case file: the exact sentence on the page, the exact clause it breaches, and a draft takedown notice. There is deliberately no send button. A human sends it.

Clearance (inward) — for studio business affairs and post-production. Upload a clip before it ships, and the same rules answer: cleared, blocked, or unverified. Nothing defaults to cleared. We prove coverage; we don't assume it.

A third moment matters too. When a distributor acquires a finished film, they demand proof the AI elements were cleared. Consentinel produces that document, so it becomes something a studio has to hand over rather than something nice to have.

How we built it

The spine of the system is a consent registry in Firestore. Two ADK (Agent Development Kit) pipelines read from it in opposite directions — enforcement and clearance — and share one deterministic rule engine between them, so a "cleared" verdict means the same thing no matter which direction produced it.

The pipeline, end to end:

Ingest. Drop in a contract PDF. Gemini extracts six fields — performer, licensee, permitted use, territory, validity dates — and quotes the exact source sentence behind each one. We check that quote really appears on the page it claims; any field that fails is dropped rather than guessed. Nothing is taken on faith.

Discover. Gemini writes search phrases in five languages and Parallel's Search API runs them across the open web. We also download and inspect the media those pages point at, because voice clones are sold as audio samples and synthetic endorsements run as video ads — the listing text alone never confirms the offering is real. Text discovery runs in the console today; media inspection runs from the pipeline.

Judge, in two separate steps — and the separation is the whole point. Gemini reads each page and answers a fixed set of factual questions. Then plain code, no model, checks those answers against the registry: is there a grant, does it cover this use, this territory, this date, this licensee? A language model never gets to decide that someone broke a contract. It only gets to describe what it saw.

Build the case file. The quote, the clause, a draft notice, and nothing further without a human in the loop.

Security had to match the ambition. Everything that touches untrusted content — page triage, media triage — runs with no tools, no secrets and no write access. That isn't a policy we wrote down, it's structural: with a response schema set, ADK refuses tools and agent transfer outright, so an agent reading a hostile page has no capability to reach for. The agents are deployed to Vertex AI Agent Engine as four runtimes, one per pipeline, with triage isolated on its own least-privileged service account. The reconciler that makes the final call never receives raw page text at all, so a page engineered to instruct our agent has no path to a decision. Model Armor screens the untrusted paths for injection and PII on top of that. And the evidence bucket is configured so that no principal in the system can delete an object — we verified that by trying it as project owner and getting a 403 — because evidence you can quietly delete isn't evidence.

We shipped a working agency console on Cloud Run, backed by this pipeline, for the Agentic Cinema hackathon on Google Cloud.

Team: Prachit (foundation and app), Vedant (agents and tools), Swara (product, UI, docs, demo). Three people, one registry, two directions.

Challenges we ran into

The hardest problem wasn't technical capability. Gemini is very good at reading a page and describing what's on it. The hard problem was trust boundaries: deciding, explicitly, what an AI model is allowed to be the last word on, and what it never gets to touch.

We kept hitting the same failure mode in early designs. It's tempting to let the model that finds the evidence also render the verdict, because it's convenient and the model is usually right. We threw that version out. "Usually right" isn't good enough when the output is a takedown notice with someone's name on it. Rebuilding the judge as two hard-separated steps — model reads, code decides — cost us real time, and it's the decision we're proudest of.

A close second: writing our own limits down. It was tempting to imply we do deepfake forensics or speaker verification, because it would have sounded more impressive in a pitch. We don't, and we said so plainly in our own documentation: no voiceprint matching, no legal advice, no platform-wide monitoring. A clean boundary is worth more than an overclaim a judge — or a real court — can puncture.

Then there was the ordinary hackathon arithmetic: two AI pipelines, a shared registry, four deployed runtimes and a demo console, built by three people against a clock. Something had to be simple so everything else could be rigorous. We chose the UI to be that something, and the trust architecture to be the thing we refused to cut corners on.

Accomplishments that we're proud of

We're proudest of the judgment architecture. Gemini reads and describes evidence, but a separate, deterministic rule engine — plain code, no model — decides whether a contract was actually broken. It would have been faster to let one model do both. We rebuilt it mid-hackathon because we wanted a verdict we'd put our own names on.

Close second: the isolation holds, and we can show it. One of our demo pages is the same listing with a paragraph added telling our agent to report it as authorised. The verdict doesn't move. The reading agent holds no tools and can only fill in fields, so the instruction has nowhere to go — and the finding gains a badge saying the page tried.

We're also proud that every extracted contract field arrives with the exact sentence it came from, and that we said plainly what Consentinel doesn't do instead of overselling it.

In the time we had, we didn't just build something that flags a problem. We built something that can defend its decision, then hands it to a human before it goes anywhere.

What we learned

The most convincing AI systems aren't the ones that sound most confident. They're the ones that are honest about exactly where the model's authority ends. "Gemini finds it, code decides it, a human sends it" is three short clauses, but it's the sentence that makes the whole product defensible.

We also learned that grounding a product in a real lawsuit changes how you build. It's easy to design for a hypothetical. It's much harder, and much more useful, to design for a young actor discovering a stranger's clip online seventeen years too late and asking why nobody was watching. Every hard call we made, we made by asking whether it would have helped her agency catch this sooner. Most of the time that question had a clear answer.

What's next for Consentinel

Platform-wide monitoring at enterprise scale. More languages in the sweep. Media discovery wired into the console alongside text. And a standardised clearance document that distributors can accept as proof of coverage on sight — turning what is currently a console into the compliance record the industry eventually has to keep.