-
-
Web UI.
-
Archetecture.
-
Antigravity CLI,
Inspiration
In the film and music industry, royalty statements are notoriously opaque. Independent creators often lack the tools to verify if distributor payouts match actual streaming data. I wanted to build an agent that could handle the messy "reasoning" of reconciliation—explaining why a number is off—while maintaining the absolute financial integrity required for accounting.
What it does
RightsLedger ingests streaming data and distributor reports into ClickHouse Cloud. It then uses a Gemini-powered agent to:
- Compare expected vs. actual payouts.
- Generate natural language explanations for discrepancies.
- Draft dispute letters for underpayments.
- Securely write audit trails back to ClickHouse via the Model Context Protocol (MCP).
How we built it
The project is a solo effort built with a Python/FastAPI backend and a ClickHouse Cloud database.
- LLM: Gemini 3.6 Flash (via google-genai SDK) provides the reasoning engine.
- Database: ClickHouse Cloud handles the streaming telemetry and audit logs.
- Integration: The official mcp-clickhouse server (stdio transport) serves as the bridge between the AI and the data layer.
- Security: A custom "Deterministic Policy Gate" intercepts all AI recommendations to ensure no "untrusted instructions" (Prompt Injections) can override the mathematical reality of the ledger.
Challenges we ran into
The biggest challenge was ensuring the agent remained idempotent. In early iterations, re-running a reconciliation would result in duplicate audit rows. I had to implement a strict verification step where the agent checks the state of the ClickHouse ledger before committing a new write-back, ensuring a "0/4 writes" state if the data is already current.
Another challenge was simulating a realistic prompt injection. I seeded the database with a malicious "Midnight Protocol" record where the title metadata contained a system override command. Watching the security gate successfully neutralize that attack while still calculating the correct $250 discrepancy was the "aha!" moment of the build.
Accomplishments that we're proud of
I am particularly proud of the Security Architecture. Inspired by the CaMeL (Defeating Prompt Injections by Design) research paper by Debenedetti et al. (Google DeepMind / Google / ETH Zurich), which I discovered through an Agentic AI Foundation (AAIF) webinar, I implemented a strict isolation between untrusted distributor data and the agent's instructions. This ensures that even if a distributor tries to "hack" their way out of an underpayment via metadata injection, the deterministic financial logic remains the sole authority.
What we learned
Building RightsLedger reinforced a core lesson in agentic AI security: the safest architecture doesn't try to make an LLM "unhackable" — it treats the LLM as a reasoning layer that can be wrong or manipulated, and puts deterministic code in charge of anything that actually matters (money, authorization, database writes). Isolating untrusted data from instructions, and never letting the model's output become the final word on financial truth, made the system meaningfully harder to compromise without requiring perfect prompt engineering. We also learned firsthand how easily duplicate writes creep into an "autonomous" pipeline if idempotency isn't designed in from the start — the fix is straightforward, but it's easy to miss until you watch a rerun quietly double your audit trail.
What's next for RightsLedger
- Expanded Detection Patterns: Moving beyond the seeded demo to detect more sophisticated "social engineering" attempts within royalty notes.
- Read/Write Separation: Implementing a multi-agent "Human-in-the-loop" approval flow for high-value dispute notices.
- Automated Testing: Expanding the test suite to include adversarial "red-teaming" of the financial reasoning engine.
Log in or sign up for Devpost to join the conversation.