ProofLoop Multi-Agent Governance System

A governed multi-agent system that resolves receiving exceptions, waits durably for supplier proof, and protects financial authority.

Comment

Inspiration

Receiving exceptions look small until they stop work. A physical delivery, goods receipt, purchase order, and invoice can disagree by a few units, yet resolving that gap often turns into email chasing across operations, accounts payable, and suppliers. A dashboard can display the problem, but it cannot own the asynchronous work of gathering evidence, waiting for a supplier response, resuming safely, and preserving a defensible record.

ProofLoop was built to make the frontline receiving coordinator the hero. It turns one narrow, high-frequency dock-to-ledger exception into a governed agent workflow while keeping financial authority with people.

What it does

ProofLoop receives a blocked invoice event and delegates limited work to specialist Evidence, Reconciliation, Correspondence, and Policy agents. For synthetic case NS-INV-7841, the only permitted external request is delivery note DN-90012 for the outstanding 20 units. The workflow persists an AWAITING_SUPPLIER_REPLY checkpoint, rejects a repeated event with duplicate_ignored, resumes from a separate supplier-reply event, and routes closure only to a human Controller.

The most important product choice is what ProofLoop cannot do. It cannot release payment, change bank details, delete evidence, or bypass policy. A payment-release request is structurally denied with HTTP 403. Controller approval governs case closure only, never payment release.

How we built it

The buyer-facing product has two deliberately separate experiences. Tenant Zero is a clean onboarding workspace with an explainer, policy walkthrough, bounded Smart Advisor, draft-only connection placeholders, and browser-only sandbox activation. Guided Proof is a transparent simulation of the fictional Northstar Components case, including source-linked evidence, specialist-agent timeline, policy allowlist, Controller gate, audit hash, and PDF evidence export.

The separate live Google Cloud proof spine runs on Cloud Run in asia-southeast1. It calls Vertex AI gemini-3.5-flash through Google ADK 2.8 workers and persists synthetic case, event, and audit checkpoints in Firestore. Every mutating synthetic-event endpoint is protected by a Secret Manager-backed demo key. The public read-only evidence console exposes model identity, ADK version, durable case state, and audit trace without exposing credentials.

Challenges we ran into

The hard part was not producing fluent model text. It was preventing the model from widening authority. We constrained the action boundary in policy and deterministic code, restricted evidence collection to one authorised delivery note, kept payment outside the agent surface, added idempotent event claims, and used Firestore checkpoints so an asynchronous supplier reply can resume only the correct workflow state.

We also had to avoid misleading implementation claims. The hosted product interface is a Manus-hosted presentation layer with transparent simulation adapters. It does not route its scenario controls to Cloud Run. The Cloud Run service is a separately deployed, synthetic-only Google Cloud proof spine. Managed Google Enterprise Agent Platform services such as Agent Registry, Memory Bank, Agent Gateway, Model Armor, and Agent Observability are described as future hardening patterns, not claimed as live integrations.

Accomplishments that we are proud of

We created a complete, inspectable action loop rather than a chatbot or dashboard: event, scoped delegation, bounded supplier request, durable waiting state, supplier-event resume, duplicate suppression, Controller-only closure, and hard financial-action denial. The public 2:38 continuous English demo shows the hosted experience, Cloud Run evidence console, protected event flow, Firestore state change, and payment-release HTTP 403 in one sequence.

What we learned

Reliable enterprise agents need explicit authority boundaries, durable state, idempotency, recovery paths, human accountability, and evidence that a reviewer can inspect quickly. The useful innovation is not a model deciding more. It is a system that can complete more operational work while refusing to cross the financial and policy boundaries that should remain human-controlled.

Try it out

Built with

Gemini 3.5 Flash, Vertex AI, Google ADK, Cloud Run, Firestore, Secret Manager, React, TypeScript, Vite, Tailwind CSS, Express, tRPC, MySQL, Drizzle ORM, Vitest, Playwright, and jsPDF.

Scope and data disclosure

All Northstar Components names, case records, evidence, agents, events, and scenarios are fictional and synthetic. The live proof spine has no ERP, WMS, warehouse, bank, payment, or production supplier-system credentials or integrations. The full disclosure is available at https://github.com/dcontessa/proofloop/blob/main/DISCLOSURES.md.

Note: this repository is private; access has been granted to the Devpost and Google Cloud judging accounts.

Built With

Share this project:

Updates

posted an update —

A delivery lands 20 units short. The paperwork says everything arrived. So who's allowed to fix that, and how much should an AI agent get to decide on its own?

I built ProofLoop to answer that properly, not as a demo, but as a real design pattern for enterprise agents: what evidence they're allowed to use, what action they can take, when they pause, and why a human still holds the line on money. Wrote up the full pattern here for Google Cloud's All Things Agentic Hackathon: https://www.linkedin.com/pulse/20-unit-mystery-what-missing-carton-teaches-us-enterprise-acis-gah3c

Log in or sign up for Devpost to join the conversation.