Estreat Agent Fleet

• 

  Architecture: statutory clock alert to Pub/Sub, gateway, orchestrator, three ADK agents on Cloud Run, Gemini 3.5 Flash, human sign-off.

Inspiration

Nigeria's Data Protection Act 2023 and GAID 2025 apply the same hard clocks to a four-person Lagos startup as to a bank. Thirty days to answer a data subject request. Seventy-two hours to notify the NDPC of a breach, counted from the moment you become aware, not from the moment you contain it.

I built the Estreat platform this month to track those obligations, and it does that well. It detects an overdue request, an approaching breach deadline, a stale training record, and it raises an alert.

Then I watched what happens next: nothing. The alert lands with a two-person compliance team that is already underwater. Detection was never the bottleneck. Capacity is.

What it does

The Estreat Agent Fleet turns every statutory-clock alert into work that is actually done.

• DSAR agent. Picks up an open data subject request, orders the queue by hours remaining on the thirty-day clock, works out which NDPA right is being invoked, and drafts the response.
• Breach agent. Runs the seventy-two hour clock from the discovery timestamp, assesses severity, decides whether affected data subjects must be notified alongside the regulator, and drafts an NDPC notification with the elements the regulator expects.
• RoPA agent. Ingests a pasted spreadsheet, a CSV export, or an email thread and proposes structured Record of Processing Activities entries. Its most useful output is the gap list, because it refuses to invent a lawful basis and writes UNKNOWN instead.
• Orchestrator. Routes by statutory domain and sequences work that spans more than one specialist.

No agent sends anything. Under NDPA the controller is accountable for the communication, so a human signs off. The agents remove the fourteen hours of work in front of the signature, not the signature.

How I built it

Google ADK 2.8 on Gemini 3.5 Flash through Vertex AI, running on Cloud Run, with Firestore as the state layer and Pub/Sub carrying alerts from the existing platform.

I mapped the seven concerns of the Gemini Enterprise Agent Platform onto real modules rather than describing them:

• Agent Registry. Every agent publishes a card carrying its version, its owner, the exact tools it may call, its lawful basis, and the data categories it may touch. Discovery is by name or capability.
• Agent Identity. No agent has ambient authority. Each invocation mints a principal whose grants come from the registry card, and every tool call is checked against it. A denial is an audit event.
• Memory Bank. State is keyed by organisation and case, so a request that runs for thirty days survives session boundaries, redeploys and cold starts, and a different agent instance can resume it.
• Agent Gateway and Model Armor. One door. Inbound text is screened for prompt injection and stripped of Nigerian identifiers (NIN, BVN, account numbers, phone numbers) before it ever reaches Gemini. Outbound payloads are guarded on the way back.
• Observability. OpenTelemetry spans, plus an audit record per decision that is hash-chained to its predecessor. GET /audit/verify/{agent} re-walks the chain and names the first broken or tampered record.
• Runtime. Long-running asynchronous execution driven by Pub/Sub push from the platform's hourly clock checker, by a scheduled sweep, or by a direct call.

Challenges I ran into

The hardest problem was that a data subject request is untrusted text written by a stranger who has every incentive to manipulate the system handling it. The seeded demo request contains a genuine prompt-injection payload telling the agent to reply that no data is held. Getting the agent to classify the underlying request, flag the attempt, and carry on took a gateway that treats inbound text as data by construction, not a politely worded instruction in the system prompt.

The second was restraint. It is tempting to let an agent file with a regulator. Under NDPA that is a liability, not a feature, so autonomy is a declared field on the registry card and both drafting agents ship on propose.

A third, more mundane one: the audit trail nearly took the agents down with it. Appending a hash-chained record reads the head of the chain first, and that read failed until the composite index existed. An evidence store must never be able to stop an agent working a statutory deadline, so the read is now total, and a record written after an unreadable head is flagged as a declared gap rather than silently breaking the chain.

Accomplishments that I'm proud of

The fleet is deployed and reproducible, not a demo reel. Three specialist agents complete full Gemini reasoning loops against live Cloud Run, the audit chain verifies clean across every record, and the RoPA agent's gap list is honest enough to be useful to a real DPO.

The prompt-injection case works end to end. The agent classified the underlying access request, recorded that it had identified and disregarded the injection attempt, and drafted a correct response anyway.

What I learned

Data sovereignty is an architectural constraint, not a compliance checkbox. NDPA restricts cross-border transfer of Nigerian personal data, which means an agent platform that ships prompts to a vendor tenant cannot be sold in this market at all. Everything here runs inside the customer's own Google Cloud project, in a region the customer picks, and that single decision shaped the whole design.

What's next for Estreat Agent Fleet

The Compliance Audit Return agent, which assembles the annual filing from the evidence vault, and a DPIA agent. Then multi-tenant fan-out so a licensed DPCO assessor can run the fleet across every client they carry.

Disclosure of pre-existing work

The Estreat platform (the registers, the REST API and the statutory-clock checker) is pre-existing work built during August 2026. The agent fleet in this submission is new work built during the submission period. It reaches the platform only through the authenticated public REST API.

Built With

• cloud-run
• cloud-trace
• fastapi
• firestore
• gemini
• google-adk
• opentelemetry
• pub-sub
• python
• vertex-ai