MUSTER

A zero-trust control plane for enterprise AI agents that asks only for evidence that can change the action — and checks before retrying uncertain actions.

Comment

Inspiration

Enterprise AI agents are increasingly being asked to make consequential decisions across systems that do not share the same trust boundary.

A payroll system may know whether someone was scheduled. A site-access system may know whether they were present. A central agent should not need unrestricted access to all of those raw records just to make one decision.

There is another dangerous problem: if an irreversible external action is accepted but its response is lost, blindly retrying it can create a duplicate effect.

MUSTER was built around two ideas:

  1. Ask only for evidence that can still change the consequential action.
  2. If an irreversible action may already have happened, observe the external system before trying it again.

What it does

MUSTER is a zero-trust enterprise agent control plane for consequential decisions.

In the workforce demo, Ravi disputes his Saturday pay.

The deterministic MUSTER planner determines which facts can still change the result and routes narrow requests to specialized institutional agents.

The payroll agent establishes that Ravi was scheduled.

The site agent owns protected attendance evidence. The central MUSTER Control Plane is deliberately denied direct access to that raw source by Google Cloud IAM. The source-local agent reads its own evidence, uses Gemini to interpret it, validates the resulting candidate facts, and returns only narrow signed facts.

The policy requires at least 240 minutes on site. The admitted evidence establishes at least 508 minutes. The exact duration remains unresolved, but every admissible value still produces the same consequential action.

MUSTER therefore stops asking for unnecessary additional data and proposes the corrected weekly total of INR 5,100.

MUSTER also contains an Action Gate for irreversible external actions. In our verified Google Cloud sandbox proof, an action was accepted once and the response was deliberately lost. MUSTER recorded the outcome as uncertain rather than guessing. A fresh process then inspected the external system, observed that the action already existed, and confirmed the existing result with zero redispatch.

The final proof shows:

  • one external effect
  • zero redispatch
  • transfer count still one
  • sandbox only, with no real funds

How we built it

MUSTER separates probabilistic interpretation from deterministic authorization.

Gemma is used for low-trust worker claim intake. Ravi's own statement can start a case, but it carries no institutional authority and cannot justify an action.

Institutional source agents are built with Google ADK and use Gemini 3.7 Flash through Vertex AI to interpret source-local evidence.

Those model outputs do not directly authorize anything. Candidate facts are validated against deterministic rules, source authority is checked, and only admissible signed facts enter the decision process.

The central deterministic kernel then evaluates policy consequences and determines whether unresolved facts can still change the action.

Google Cloud is used for the verified deployment and proof path, including Cloud Run, Cloud Storage, Cloud SQL, IAM-scoped identities, and Vertex AI.

The Action Gate uses durable state, exact execution identity, finality tracking, and observation-based reconciliation so an uncertain irreversible action is not blindly redispatched.

A hosted judge replay exposes the verified Google Cloud evidence, decision, and Action Gate proof without exposing production credentials or enabling mutations.

Challenges we ran into

The hardest problem was maintaining very precise trust boundaries.

It is easy to accidentally give an LLM output more authority than it should have. We separated interpretation from authority so that Gemini may understand evidence, but the source validates and attests to facts, and deterministic MUSTER decides what action is allowed.

Another challenge was uncertain external execution. A timeout after dispatch does not mean an action failed. Treating it as failure and retrying can cause duplicate irreversible effects. We therefore model uncertainty explicitly and reconcile by observing the external system.

We also had to make the demo truthful about what was live versus replayed. The institutional Google Cloud execution and final Action Gate proof are verified replay artifacts, while the demo also starts a real local ADK model run. The UI labels these boundaries explicitly.

Accomplishments that we're proud of

  • A deterministic decision kernel separated from probabilistic AI interpretation.
  • Google Cloud IAM proof showing that the central Control Plane cannot directly read protected Site-A evidence.
  • Specialized payroll and site agents with source-specific authority.
  • Consequence-sensitive evidence acquisition that stops once additional precision cannot change the action.
  • Durable PostgreSQL-backed case state across process boundaries.
  • A verified unknown-after-acceptance sandbox proof with one external effect and zero redispatch.
  • A successful live demo using Gemma for worker claim intake and Gemini for institutional evidence.
  • A public Cloud Run judge replay with no credentials, mutation APIs, or live telemetry.
  • A green supported-platform CI pipeline with architecture contracts, static analysis, Python tests, and UI tests.

What we learned

The most important lesson was that model intelligence and decision authority should not be the same thing.

LLMs are very useful for understanding messy evidence, but high-impact decisions benefit from explicit source authority, narrow evidence release, deterministic policy evaluation, and durable execution semantics.

We also learned that privacy can sometimes be improved not by asking an AI to redact more data, but by proving that some additional data is not needed at all.

Finally, reliable agents cannot treat network errors as simple failures. When an irreversible action has uncertain finality, observing the external world can be safer than retrying it.

What's next for MUSTER

The next step is to generalize MUSTER from the workforce and procurement domains into a reusable enterprise policy and action-control platform.

That includes richer agent discovery, additional enterprise connectors, long-running workflows, policy tooling, observability, and deployment integrations while preserving the same core rule:

AI may interpret evidence. Sources establish authority. Deterministic MUSTER controls consequential action.

Built With

Share this project:

Updates