Dilligence Room

An enterprise agentic fleet for M&A due diligence on Google Cloud & Gemini: eight specialist agents turn a hostile data room into a defensible deal decision with zero-trust governance.

Comment

Diligence Room

Inspiration

The Problem in M&A Diligence

Corporate acquisitions force deal teams to review more than 10,000 pages of unvetted documents under tight deadlines: scanned contracts, severance memos, cap tables, and financial models.

The worst risks hide in the gaps between disciplines:

  • Legal finds a Change-of-Control clause in Section 11.3 of a contract with Meridian Logistics.
  • Finance calculates that Customer X provides 18.3% of projected cash flow.
  • HR finds that the account lead for Meridian is resigning.
  • IP/Tech finds that a core software dependency (TitanBridge 4.1) reaches End-of-Life.

Read alone, each note looks minor. Together, they prove the target will likely lose its primary customer right after the acquisition closes. In traditional deal rooms, isolated teams miss this connection until it is too late to renegotiate price.

What we made

Diligence Room runs autonomous, zero-trust diligence on M&A targets:

1. Autonomous Ingestion and Screening

When a user uploads a file to Cloud Storage, Pub/Sub triggers the pipeline. A lightweight Gemma 4 Sentinel (gemma-4-26b-a4b-it) and Google Cloud Model Armor (diligence-room-d7) quarantine prompt injections, exfiltration lures, and PII before worker agents can read them.

2. Eight Specialist Agents

Eight domain agents (Legal, Finance, HR, IP/Tech, Tax, Regulatory, ESG, Real Estate) analyze documents within strict boundaries using Gemini 3.5 Flash on Vertex AI.

3. Governed Agent Gateway

The Agent Gateway blocks unauthorized cross-agent reads. When Legal asks Finance for customer revenue exposure, the Gateway returns only an aggregate number (18.3%), keeping raw financial spreadsheets private.

4. Coordination Keystone and Risk Synthesis

In Project Falcon (evaluating target Vantage Robotics, Inc.), the Coordinator monitors the deal graph. When four separate agents identify risks on the same counterparty, the Coordinator synthesizes CRITICAL finding b093295dab91: "Compound Customer-Exit Exposure Threatens Deal Economics." If any single workstream is missing, the Coordinator refuses to synthesize the finding.

5. Write-Time Evidence Gate

The evidence gate blocks hallucinations. An agent cannot save a finding unless every quoted verbatim_span matches the source document text word for word.

6. Human Approval Gate

The Negotiation agent drafts contract remedies and price cuts from critical findings, then stops at an explicit gate: draft -> pending_approval -> [STOPS FOR HUMAN REVIEW] -> approved -> send_logged. The Deal Lead must approve any draft before it leaves the deal room.

7. Executive Dashboard and Audit Traces

A 5-view web console links every finding back to its source document and execution span in Google Cloud Trace.

The Unlikely Hero: The Deal-Room Analyst

Junior transaction analysts spend days cross-referencing contradictory PDFs. Diligence Room gives them an autonomous agent fleet that works around the clock, discovers connected risks, proves every fact with exact text quotes, and halts before taking external actions. In Project Falcon, the analyst does not have to stumble across the connection by chance: the four workstreams bring it forward while there is still time to act.

The Twist: Documents Are Adversaries

Most AI systems trust uploaded files. In an M&A transaction, documents are untrusted, potentially hostile inputs. Sellers can upload prompt injections, exfiltration traps, or deceptive summaries.

Diligence Room enforces Zero-Trust rules:

  1. Documents are adversaries: All text must pass a four-layer screening gauntlet (Format Detection -> Chunk Parsing -> Gemma 4 Sentinel -> Model Armor) before entering agent context.
  2. Agents are principals: Each agent runs with its own identity, read scope, and write bounds.
  3. Memory is partitioned by policy: Legal cannot open raw financial ledgers; Finance cannot view HR files.

How we built it

We built Diligence Room natively on the Gemini Enterprise Agent Platform (GEAP). It was created for the AllThingsAgentic Hackathon in the Fortified Enterprise Fleet track:

GEAP Pillar Technology Implementation Details
Discovery & Lifecycle Agent Registry All 8 specialist agents publish official A2A cards via infra/agent_registry.py. gcloud agent-registry agents list discovers all agents. Firestore tracks semantic versions and rollback targets.
Core Execution Agent Runtime / Vertex AI Agent Engine Long-running asynchronous execution runs as a Google ADK reasoning engine (projects/378831539922/locations/us-central1/reasoningEngines/7141202128323739648) with retries and dead-letter queues.
Long-Term State Memory Bank Decoupled processes run recall("Meridian") to fetch verified counterparty facts weeks later without direct database imports.
Zero-Trust Access Agent Identity Each workstream uses a separate IAM identity; negative isolation prevents unauthorized reads (Legal ⊬ Finance, Finance ⊬ HR).
Routing & Policy Agent Gateway Deny-default router on Cloud Run returns machine-readable verdicts (allow/aggregate_permitted, deny/no_policy) and aggregate-only data.
Inline Guardrails Model Armor Managed template (diligence-room-d7) and custom project rules fail closed on unparseable outputs to quarantine attacks.
Observability & Tracing Agent Observability OpenTelemetry GenAI spans stream to Google Cloud Trace; every finding carries a durable audit_trace_id.
Foundation Models Gemini 3.5 Flash & Gemma 4 Gemini 3.5 Flash handles domain reasoning; gemma-4-26b-a4b-it serves as the Tier-1 Ingestion Sentinel.
Compliance Plane Cloud KMS & DLP Customer-managed keys (CMEK) protect data in US and EU; Cloud DLP inspects HR files; zero service account keys.

Challenges we ran into

  1. Guardrails Failing Open: Early testing showed that unrecognized guardrail responses were treated as safe. We rewrote the Model Armor client to fail closed on any non-standard response.
  2. Inconsistent Entity Names: Models generated slight variations of corporate names (e.g. "Meridian Logistics" vs "Meridian Logistics, Inc. account"), which broke multi-agent convergence. We enforced strict entity schemas in tool parameters instead of relying on fuzzy matching.
  3. Cross-Region Latency: Running agents across different regions slowed down execution. Moving active Firestore databases and Cloud Run services to asia-south1 cut round-trip latency from 834 ms to 156 ms, dropping total deal replay time from 262s to 57s.
  4. Runaway Tool Loops: Complex edge cases caused early prototypes to loop repeatedly. We added the Loop Guard with hard limits on iterations, tool calls, token usage, and time.
  5. Mid-Run Container Crashes: When cloud workers restart mid-run, they can duplicate findings. We added state checkpoints and idempotency keys to ensure restarted runs create zero duplicate findings.

How we evaluate and defend the fleet

Shadow evaluations

Our evaluation harness uses the same evidence-gated finding path as the fleet. A pinned 20-document golden set contains four keystone documents with exact expected titles, severities, entities, and source locators, plus 16 clean or irrelevant documents that test false positives. Candidate logic is compared with the baseline after a deterministic offline run. Missing findings and severity downgrades fail the evaluation; new findings are surfaced for review. We also keep a deliberately weakened Legal v2.5 candidate to confirm that the harness catches a lost change-of-control finding. The implementation is in evals/golden_set.py and evals/harness.py.

Red-team testing

The red-team runner feeds 20 hostile files through the full ingestion pipeline. The ledger covers eight prompt injections, five exfiltration attempts, four cross-workstream leaks, and three poisoning or cross-deal attacks. Each fixture declares the layer and security reason that should block it. A test passes only when the document stops before routing at that exact layer, and the scorecard reports raw totals without smoothing failures. See redteam/runner.py and redteam/expected.yaml.

Observability and auditability

OpenTelemetry spans instrument the armor screen, agent tools, gateway decisions, coordinator synthesis, and every negotiation state transition. Offline tests capture those spans in memory and assert their security attributes. Live runs export through the same instrumentation seam to Google Cloud Trace. Each finding stores an audit_trace_id, so the dashboard can connect an executive conclusion to the run that created it. The observability code and span tests live in observability/ and tests/test_stage_spans.py.

Failure and boundary testing

Separate suites verify exact-quote evidence, cross-workstream and cross-deal denials, loop limits, retries, dead-letter handling, crash recovery without duplicates, registry rollback without memory loss, human approval before send, and the deterministic 49-event replay. These tests exercise the enforcement code directly rather than relying on model self-reporting.

Accomplishments that we're proud of

  • 1,103 Automated Tests Passing: 100% pass rate across unit, integration, isolation, and evidence-gate test suites.
  • Mypy Strict Typing: 0 type errors across 209 Python files.
  • 20/20 Red-Team Attacks Blocked: 100% containment across 4 attack types (8 injections, 5 exfiltrations, 4 cross-workstream leaks, 3 poisoning attempts).
  • 0.0% False Positive Rate: Processed 20 clean data-room documents with zero false alarms.
  • 49-Event Deterministic Replay: Replays 14 simulated deal days in under 4 minutes (seed 42).
  • 143 Audited Deal Events: Preserves an immutable event ledger in Firestore.
  • $170 Cloud Budget Guardrail: Kept cloud spend within budget with alerts at 50%, 80%, and 100%.

What we learned

  1. Enforce Security in Code, Not Prompts: You cannot prompt-engineer safety into enterprise workflows; you must enforce boundaries through identity checks, network policy, and write-time schema validation.
  2. Tiered Models Save Money: Placing a small Gemma 4 sentinel in front of Gemini 3.5 Flash cut token waste on junk and hostile files by 74%.
  3. Separate State from Agent Code: Storing deal findings separately from agent manifests allows instant rollbacks without wiping deal memory.
  4. Keep Humans in the Loop: Autonomous agents should draft remedies, but a human must approve every real-world action.

What's next for Diligence Room

  1. Portfolio Risk Clustering: Compare risk graphs across multiple deals to spot shared supplier risks across private equity portfolios.
  2. Automated Seller Q&A Lists: Turn missing evidence gaps into prioritized question lists for sellers.
  3. Enterprise Connectors: Connect directly to SAP, NetSuite, Intralinks, and Datasite data rooms.
  4. Antitrust Filing Drafts: Turn market-share findings into draft regulatory filings.

Project Extensions

  1. Gemma 4 Ingestion Sentinel: Integrated gemma-4-26b-a4b-it via the Gemini Developer API for Tier-1 prompt-injection detection (ingestion/sentinel.py).
  2. Technical Build Article: Published Zero-Trust Agent Fleets.
  3. Public Demo Update: Shared the project and demo publicly on X.

Project Links & Live Endpoints

Built With

Share this project:

Updates

Submission history