Spent Guard Fleet

Six agents. Real statistics. Enforced policy. One decision your CFO can trust.

Comment

Inspiration

Most AI fraud-detection demos follow the same shape: an LLM looks at a transaction and decides it "seems suspicious." That's a five-minute build, and it's not how real financial controls work.

We wanted to build the thing a real finance team would actually trust — a fleet of specialists that each check something different, that are allowed to disagree with each other, and where a policy layer can override everyone's consensus if the dollar amount alone crosses a line.

Not "the AI thinks this is fraud." More like: the vendor checks out, the spend pattern doesn't, and company policy says a human signs off on anything over $10,000 regardless of what anyone concludes.

What it does

Spend Guard is a six-agent fleet that investigates vendor payments in real time.

Orchestrator (Gemini 3.5 Flash) coordinates every check and reconciles the findings, including genuine disagreement between specialists.

Vendor Vetter checks whether a vendor is registered and legitimate.

Spend Analyzer runs four real statistical checks — z-score, frequency, time-pattern, and isolation forest — against a vendor's real transaction history, before any LLM reasoning happens. The model explains the numbers; it never invents them.

Compliance Checker enforces a hard policy independent of the other agents: any payment $10,000 or more requires human sign-off, no exceptions. It can veto a clean consensus even when both specialists say a payment looks fine.

Human Escalation Agent opens a real, persistent approval-queue record, not a log line, with a reviewer CLI to approve or reject.

Cross-Department Liaison demonstrates a second department, Procurement, discovering and reusing the same Vendor Vetter agent Finance uses, via the Agent Registry.

Every decision runs through all 7 GEAP infrastructure pillars — Registry, Runtime, Memory Bank, Identity, Gateway, Model Armor, and Observability — deployed as real, independently running Cloud Run services, not a single monolith.

How we built it

We started from the seven GEAP pillars and built outward: a real Agent Registry with versioning and an approval workflow, an HMAC-signed tamper-evident Memory Bank, Workload Identity Federation for zero-trust service identity, an Agent Gateway that is the only publicly reachable service, Model Armor guardrails tested against live unscripted attack attempts, and full audit logging.

The detection layer runs real statistics — z-score, frequency, time-pattern, and isolation forest — against a real public dataset from Chicago's open vendor-payments portal, not invented numbers.

The system was later split from in-process agent calls into five independently deployed Cloud Run services communicating over real, authenticated HTTP, using Google Cloud Build, Terraform, and Workload Identity Federation for service-to-service authentication.

Challenges we ran into

Splitting the system into real, independently deployed services surfaced bugs that never existed when everything ran in one process.

A run_id mismatch between escalation records and pipeline state: ADK's AgentTool pattern spins up its own nested session with a different session ID, so a value the orchestrator's LLM tried to relay in a tool call never matched. We fixed it by threading the real ID through explicitly in code via a before_tool_callback, rather than trusting the model or the tool's own session context.

Security we had declared but never actually enforced: our Terraform correctly declared IAM invoker bindings between services, but nothing was presenting credentials on the wire. A real curl request against a "secured" service succeeded, unauthenticated. We fixed it with real Google-signed ID tokens minted via each service's own Workload Identity.

A timeout mismatch under real network latency: our orchestrator's per-attempt timeout was tuned for local calls, and once specialists were genuinely separate services, some legitimate responses arrived after the orchestrator had already given up and retried, compounding the slowness. We raised the timeout with real headroom and verified the fix live.

GPU cost reality: we deployed a real Gemma endpoint for plain-English case summaries, hit a zero-GPU-quota wall on our project, and made the deliberate call to delete it and keep the graceful-degradation path rather than risk an unattended cloud bill neither of us could afford as students.

Each of these was found through genuine live testing against deployed infrastructure, not code review alone, and each was root-caused and fixed properly, not patched around.

Accomplishments that we're proud of

A fail-closed system that does not guess: when a specialist agent crashed, chaos-tested live with a reserved sentinel vendor ID, the orchestrator retried three times with real exponential backoff, then escalated to a human instead of approving or blocking blindly.

A Compliance Checker that can genuinely override a clean consensus, where both specialists say a payment is fine and policy still forces a human review above $10,000.

Real statistical fraud detection, verified live: a $9,000 payment against a $1,200 historical average correctly triggered at 33.67 standard deviations, cited exactly by the model, not paraphrased.

Zero-trust identity that is actually enforced: all four backend services return a real 403 to any unauthenticated request, confirmed live.

An honest README. When our own cross-check found that Memory Bank and Observability were not fully wired into the live pipeline yet, we did not quietly leave the original claims. We rewrote them to say exactly what is true, with the specific evidence for each.

What we learned

Deploy early, deploy for real. Every bug in this project was invisible until the system was running as separate, independently deployed services with real network latency, real authentication, and real ways to fail. Code that only works running as one process on a laptop has not proven anything about how it behaves in production.

We also learned that a system's credibility comes as much from what it admits it cannot do yet as from what it claims. An honestly documented limitation is worth more than an overclaimed feature a judge might test and find missing.

What's next for Spend Guard

Wire Memory Bank and Observability fully into the live pipeline so the tamper-evident history and full audit trace are genuinely part of every decision, not just tested in isolation.

Bring Cross-Department Liaison into the live Gateway path so cross-department agent discovery is demonstrable end-to-end, not just via a standalone script.

Expand the real anomaly-detection dataset beyond Chicago's public vendor-payments data to a broader, multi-source baseline.

Built With

  • docker
  • fastapi
  • firestore
  • gemini
  • gemma
  • google-adk
  • google-cloud-build
  • google-cloud-run
  • pub-sub
  • python
  • scikit-learn
  • streamlit
  • terraform
  • vertex-ai
  • workload-identity-federation
Share this project:

Updates

Submission history