Sentinel: Autonomous Supply Chain Fleet

Inspiration

A global supply chain is one of the largest coordination problems in business. A Fortune 100 manufacturer runs thousands of parts across dozens of plants and distribution centers, buying from hundreds of suppliers across every time zone, against customer commitments with financial penalties attached. It touches the ERP, purchasing, transportation management, warehouse systems, supplier portals, EDI feeds, and the demand plan. None of them agree with each other.

Tens of thousands of disruptions hit that system every month. A container slips. Demand spikes on one part at one DC. A supplier confirms short. Each one has to be answered before anything moves: how short are we, which customer orders are exposed, is any of them Tier-1, what can each supplier actually deliver and by when, what does the late penalty cost if we do nothing, and can we move stock instead of buying it.

Five systems, three phone calls, 40 minutes. Every time. And the answer has to be right, because it ends in a purchase order with real money on it.

Most of these are routine. A few are serious. They all get the same 40 minutes — so the routine ones eat the capacity the serious ones need. That's the gap I've watched for 16 years.

Why generic AI doesn't solve it. Handing this to a chatbot fails on four counts, and each one is expensive:

• Policy isn't one rule. Spending authority varies by region, by spend category, by cost center, by customer tier. It has to be enforced deterministically on every transaction, not summarized approximately.
• One answer isn't enough. The right move requires playing out several scenarios — buy now, expedite, rebalance — and comparing total exposure, not sticker price. The cheapest purchase is frequently the worst outcome once the SLA penalty lands.
• A confident wrong number costs money. Language models invent figures. In this domain that's a real PO to a real supplier.
• Approvals need a trail. If you can't show who approved what, against which policy version, on what evidence — you have an audit problem, not an automation win.

I've spent my career on the supply chain side, not the engineering side. I learned agentic AI building through Build with Gemini and GDG sessions over the past year, and this is the first time the stack felt like it could carry a real enterprise workload without a platform team behind it. That's what I wanted to test.

The goal isn't headcount reduction. It's giving experienced planners their time back for the problems that actually need judgment.

What it does

Sentinel is a multi-agent fleet that handles supply disruptions on its own.

It detects the deviation, builds the mitigation options, prices them with a deterministic solver, checks the result against corporate policy, and executes. No human when the action is inside policy. When it isn't, it escalates a fully priced decision and waits for a signature.

Four scenarios, four different governance paths:

Deviation Situation Outcome DEV-001 100 units short, DC East Resolved on its own — $1,275 stock transfer, nobody asked DEV-002 Inbound note carries a prompt injection Blocked at the guardrail, logged DEV-003 Three × $4,900 against one supplier First clears, second trips the velocity cap DEV-004 500 units short, Tier-1 customer exposed Escalated — three priced options, signed approval

DEV-004 shows the point. Cheapest purchase is $9,200, but it takes 7 days and the late penalty is $4,550. Real cost $13,750. The solver picks a line rebalance at $12,210 instead. Then the director overrides it and pays $190 more for air freight, because a Tier-1 line is down and one day beats three.

The system does the math while judgment stays human.

How I built it

Three ADK agents on Gemini 3.7 Flash via Vertex AI, running on Cloud Run, triggered by Pub/Sub. BigQuery is the system of record. Firestore holds in-flight spend reservations. OR-Tools does the optimization. The codebase was built with Google Antigravity, gate by gate, with every claim verified against raw output before moving on.

No number that reaches a purchase order comes from a language model. OR-Tools produces a typed Scenario. The execution layer takes option_id, qty, cost_usd, and mode only from that object, and asserts the option exists in the catalog and the cost matches the solver. The orchestrator's response schema is two string fields — narrative and risk summary. There's no numeric field for the model to fill. It's structural, not a prompt.

Operational Knowledge Filters (OKF) enforce policy as data. Every threshold is a versioned row in BigQuery with an owner, not a constant in code:

Rule Dimension Ceiling Single transaction cap transaction $5,000 Velocity cap tenant $10,000 Velocity cap supplier $7,500 Velocity cap SKU $6,000 Velocity cap cost center $8,000 Velocity cap workflow lineage $5,000 Tier-1 guard customer tier escalate Degraded solver guard solver status escalate Kill switch fleet control block

Five spend dimensions rather than one, because a single cap is trivially sliced — cap by supplier and someone splits across SKUs. Reservations are held in a Firestore transaction so pending spend counts against the ceiling, which closes the check-then-act race. Finance changing a limit is a new row, not a redeploy, and every decision records which policy version judged it.

Everything is recorded. A hash-chained ledger: record_hash = SHA256(prev_record_hash + canonical_payload). Six phases per workflow — sense, sanitize, score, policy, intent, outcome — plus a signed approval record when a human decides.

The three agents are registered in Google Cloud Agent Registry as A2A entries with indexed skills, discoverable by other departments. The Vertex AI Memory Bank instance auto-registered alongside them, so there are four Sentinel entries in one governance catalog. Memory holds 90 days of computed supplier reliability, written only from SQL aggregation so it can't be poisoned by inbound text. Cloud Trace carries spans end to end.

Challenges

An LLM invented a purchase order. Early build produced option_id: "OPT-AIR-01" — doesn't exist — at a price the solver never generated, and wrote it to the ledger as fact. Prompting doesn't fix that. I made the response schema incapable of holding a number.

A single spend cap is easy to beat. Cap by supplier, they slice across SKUs. Cap by SKU, they slice across cost centers. Five dimensions is the minimum.

Check-then-act is a race, and proving it takes real contention. Two workflows reading $9,800 against a $10,000 ceiling both pass. The first concurrency test ran both workflows sequentially — validated the logic, never exercised the race. Two threads on a barrier, ten runs, is the difference.

The hash chain "broke" for hours and the chain code was fine. A stale Pub/Sub push subscription was still delivering retries to Cloud Run, writing to the same ledger while I ran locally. Two writers fork a chain. The fix was deleting a subscription, not changing code. Cost more time than any real bug.

Model availability set my region topology. Gemini 3.5 Flash wasn't available in my regions, so it runs 3.7 Flash on the global endpoint with data and compute pinned to us-central1. I say that instead of claiming data sovereignty I don't have.

Lessons Learned

LLMs have to be architecturally excluded from arithmetic. Instructing them to be careful isn't a control.

Thresholds belong in a database with versions and owners, not in code.

BigQuery allows DML, so an audit ledger there is tamper-evident, not immutable. Hash-chaining makes that provable instead of just claimed.

At-least-once delivery will cut you a second PO if the idempotency key isn't deterministic.

The hard part of an agentic system isn't getting the agent to act. It's constraining what it's allowed to decide, and proving afterward what it did.

What's next

Model Armor and a Gemma classifier alongside the pattern guardrail. BigQuery Data Engineering Agent to author the feed-repair pipeline as Dataform SQLX. A Conversational Analytics agent over the analytical views. OIDC-signed approvals instead of HMAC. A real ERP connector. Multi-tier BOM traversal.

All data is synthetic. The README lists every limitation, including what I didn't build.

Built With

• agent-registry
• agentic-ai
• ai-governance
• audit-trail
• autonomous-agents
• bigquery
• cloud-run
• deterministic-ai
• firestore
• gemini
• google-adk
• human-in-the-loop
• memory-bank
• milp
• multi-agent
• opentelemetry
• optimization
• or-tools
• policy-as-code
• procurement
• prompt-injection-defense
• pub-sub
• supply-chain
• vertex-ai