Virtual Jury

Inspiration

A mock trial costs $30–150k and gives a litigator one run with one panel. The interesting question is never "what will a jury do" — it's "which piece of evidence is carrying my case, and what happens when it's gone?" That is a sensitivity analysis, and sensitivity analysis wants hundreds of runs, not one.

The failure mode of "ask an LLM to simulate a jury" is that one context playing twelve jurors produces twelve flavors of the same reasonable opinion. Jurors have to be isolated — different contexts, different people, no leakage — and they have to commit before they hear each other. Our agent platform, Roundtable, already does per-tenant isolation as its core primitive. The jury is the vertical where isolation is the product.

We built this for an unlikely hero: not an enterprise back office, but the small-firm contingency litigator who will never have a $100,000 mock-trial budget — and the jury consultant who wants to run the experiment five hundred times instead of once.

What it does

• Counsel submits a JurySpec: the case packet (summary, exhibits, witnesses, judge's instructions), a panel (size, seed), and variants ("without exhibit 2").
• Model Armor screens the packet. The Clerk of Court — a Google ADK agent — provisions one isolated juror workspace per seat on a pooled GKE fleet (a registry row, ~300 ms each), with a seeded persona.
• Every juror reads the identical packet and seals a verdict before any cross-talk. Then they deliberate: each hears an anonymized digest of the others and restates a position; code detects holdouts and convergence.
• Baseline and variants run as parallel panels. Three panels of twelve seal and deliberate in ~35 s.
• The Clerk writes a findings report: what carried the majority, where it breaks, variant effects, recommendations for counsel. Every count in it comes from a tool result.

How we built it

ADK LlmAgent + FunctionTools for the Clerk (Gemini 3.1 Pro on Vertex AI's global endpoint; the jurors run Gemini 3.7 Flash — two Gemini models, split by role). The tools enforce the procedure in code — run_deliberation_round throws if verdicts aren't sealed; tallies and diffs are computed, never narrated. Jurors are pooled Roundtable workspaces: one always-warm arthur-class service on GKE serving N tenants with PostgreSQL row-level security, addressed over A2A with tenant-bound HMAC (the workspace id is inside the signed string). Firestore holds runs/events/panels with transactionally sequenced events behind an SSE stream; BigQuery holds every juror call as a traced span; Model Armor guards the gateway; Cloud Run hosts the API + UI.

Challenges

• Pooled domain services reject free-form message/send; the tenant-bound HMAC path is arthur-class only — so jurors became chat-class agents on a plugin-free core image (which is the right shape anyway).
• The fleet's least-privilege service account had never been granted Vertex or BigQuery roles; every juror call 403'd until it was. (Bonus: that restored tracing for the whole pooled fleet.)
• A2A calls are stateless — so the orchestrator owns all state and replays context; a run is a pure function of its inputs, which made reproducibility and idempotent re-provisioning natural.
• LLM juror populations converge fast in deliberation. Rather than hide it, we made sealing-first the design and report the sealed split as the primary signal.

Accomplishments

Three isolated 12-juror panels provisioned, sealed, and deliberated in 38 seconds. A Clerk-written report that identified the single load-bearing defense exhibit, quoted a juror's flip verbatim, and gave counsel three specific recommendations — every number traceable to a tool call. Model Armor blocking a live injection attempt in the case packet. 61 tests; procedure enforcement unit-tested without any pods.

What we learned

Isolation changes outcomes. The same seed produces the same twelve people, and the sealed distribution moves with the evidence in ways a single-context simulation cannot show. And: "the AI writes, code decides" survives contact with a multi-agent fleet only if the tools enforce the procedure — an instruction alone does not.

What's next

Calibration against closed cases with public outcomes, published scorecard-style. A packet editor that ingests real exhibits (with Model Armor in the path). Panel demographics controls. No damages modeling until it can be validated. Design-partner conversations with contingency plaintiff firms and jury consultants.

Built With

• a2a
• artifact-registry
• bigquery
• cloud-build
• cloud-firestore
• cloud-monitoring
• cloud-trace
• express.js
• gemini
• gemini-3.7-flash
• google-adk
• google-cloud-run
• google-genai-sdk
• google-kubernetes-engine
• model-armor
• node.js
• opentelemetry
• postgresql
• react
• roundtable
• secret-manager
• typescript
• vertex-ai