Inspiration
Water-treatment incidents rarely arrive as one clean alert. An operator may need to combine sensor readings, field photographs, voice reports, operating procedures, and maintenance history while conditions continue to change.
We wanted to explore what an AI agent could contribute in that environment without giving a language model unsafe authority. A chatbot that merely summarizes an incident was not enough. Riverbend needed to detect a problem, investigate it in the background, take a bounded action, wait for human and physical evidence, verify the outcome, and document everything it did.
That became Riverbend Water Operations: an autonomous but safety-bounded incident-response agent for water utilities.
All plant data, evidence, identities, and operational actions in the project are synthetic.
What it does
The demonstration begins with normal plant operations, where settled-water turbidity remains near its baseline of 0.5–0.7 NTU.
When storm runoff is simulated, telemetry rises above the plant's 1.0 NTU alert threshold. A deterministic evaluator confirms the threshold crossing, creates incident INC-1042, and starts an asynchronous investigation.
Riverbend correlates five sources:
Turbidity sensor telemetry A field photograph of the gauge and water sample An operator voice note A storm-response bulletin in PDF format Filter Train 2 maintenance history Gemini 3.7 Flash analyzes the image, audio, and document and produces a structured assessment with source-attributed observations. Deterministic application code evaluates telemetry, maintenance records, permissions, state transitions, and action policies.
The storm bulletin deliberately contains malicious instruction-like text. Riverbend detects and blocks it because uploaded evidence is treated as untrusted data. Gemini can analyze evidence, but it has no tool authority.
Once the evidence confirms an urgent incident, Riverbend automatically performs one pre-authorized, low-risk action: it creates confirmation-sampling work order WO-1042. External communication remains behind an operator review, and the agent has no authority over plant controls.
After the operator records the notification posture, a synthetic laboratory result arrives. Riverbend evaluates it against the threshold. A recovered result finalizes HANDOFF-1042; an elevated result keeps the incident open and produces an escalation handoff instead.
Every step preserves timestamps, permissions, interaction IDs, action receipts, and idempotency keys.
How we built it
The application uses a React and TypeScript operations interface with a Python FastAPI backend.
Gemini 3.7 Flash is accessed through the Google Gen AI SDK and the Interactions API. Gemini performs multimodal extraction and structured correlation, while application code retains control of operational decisions.
The backend runs evidence processors concurrently so image, audio, document, and maintenance analysis can proceed in the background. The frontend polls the run state and displays evidence as each processor completes.
The deployed application uses:
Gemini 3.7 Flash for multimodal reasoning Google Gen AI SDK as the agent framework Cloud Run for the React and FastAPI application Cloud Build for reproducible container builds Artifact Registry for container storage Secret Manager for the Gemini credential Cloud Logging for runtime diagnostics A single container serves both the frontend and same-origin API. Active run state and JSON audit snapshots are currently instance-local, so the demonstration limits Cloud Run to one instance.
Safety By Design
Our most important architectural decision was separating model reasoning from operational authority.
Gemini may extract observations and recommend actions, but only deterministic code can authorize or execute them. Riverbend communicates this boundary directly in the interface:
Autonomous: confirmation sampling Human-gated: external notification No authority: plant controls Repeated sensor events use idempotency keys, preventing duplicate work orders. Failed processors remain visibly failed, and Riverbend never replaces a failed live assessment with a fabricated offline result.
Challenges we ran into
The first challenge was coordinating multiple asynchronous evidence processors while preserving partial progress. A single media failure needed to remain visible and retryable without discarding successful work or pretending the investigation had completed.
The second challenge was prompt injection. Because operating documents can contain arbitrary text, we needed to ensure that instructions inside evidence could never become executable commands. We solved this by removing tool authority from Gemini and enforcing the trust boundary in application code.
The third challenge was deciding where autonomy should stop. Requiring approval for every action made the system little more than a dashboard. Allowing every action would be unsafe. We introduced a risk-based boundary: low-risk confirmation sampling can happen automatically, while communication and consequential control remain restricted.
Cloud deployment also exposed the distinction between infrastructure availability and model-provider availability. Cloud Run could be healthy while Gemini requests failed because of regional or project-level quota. This led us to add redacted provider diagnostics and make failures explicit rather than hiding them behind fallback output.
Accomplishments that we're proud of
We are proud that Riverbend is a complete operational workflow rather than a chatbot or static dashboard.
Closed-loop autonomous response: Riverbend moves from threshold detection through investigation, bounded action, human review, physical verification, and final handoff.
Meaningful multimodal reasoning: Gemini 3.7 Flash analyzes a field photograph, operator audio, and a PDF bulletin, combining them with deterministic telemetry and maintenance data.
Safety without removing utility: The agent automatically dispatches low-risk confirmation sampling, while external communication remains human-gated and plant controls remain completely unavailable.
Prompt-injection resistance: A malicious instruction embedded in the synthetic bulletin is detected and blocked. Evidence can inform an assessment but cannot invoke tools or override policy.
Source-backed and auditable decisions: Every observation cites its source, and every transition preserves timestamps, permissions, Gemini interaction IDs, receipts, and idempotency keys.
Honest failure handling: Failed evidence remains visible and retryable. Riverbend preserves successful work and never substitutes fabricated fallback output.
Duplicate-action prevention: Replayed sensor events are recognized through idempotency keys, preventing duplicate work orders or notifications.
Production-minded deployment: We packaged the React frontend and FastAPI backend into one container and deployed it through Cloud Build to Cloud Run, with Artifact Registry, Secret Manager, and Cloud Logging.
Strong verification: The project is covered by backend and frontend tests, linting, TypeScript checks, production builds, and responsive desktop and mobile validation.
What we learned
We learned that useful agency is not defined by how much freedom a model receives. It comes from giving an agent a clear goal, bounded capabilities, deterministic policies, observable state, and a way to prove what happened.
We also learned that the strongest division of responsibility is not “AI versus traditional code.” Gemini is excellent at interpreting unstructured multimodal evidence, while deterministic code is better suited to thresholds, permissions, idempotency, and safety-critical transitions.
Finally, we learned that failure behavior is part of the product. An operational agent must be able to say what failed, preserve completed work, avoid unsafe action, and provide a controlled recovery path.
What's next for Riverbend Water Operations
The next step is moving run state and audit snapshots to Firestore and asynchronous execution to Pub/Sub or Cloud Tasks. That would allow Riverbend to survive instance replacement, scale beyond one Cloud Run instance, and manage investigations lasting hours or days.
We would also add OpenTelemetry traces, stronger operator identity and role enforcement, real laboratory and work-order integrations, configurable utility policies, and additional failure-injection scenarios.
Riverbend demonstrates our central idea: an operational AI agent should not merely explain an incident. It should safely help carry the response from detection to verified resolution while keeping people accountable for the decisions that matter.
Log in or sign up for Devpost to join the conversation.