• 

  architecture_diagram

• 

  task_execution_lifecycle

• 

  logo

Sollu

Elevator Pitch

Say it once. Sollu turns a voice note into real tasks and actions, while earning autonomy for safe tasks and keeping sensitive actions under human control.

Inspiration

The idea started with a very ordinary problem.

After a busy meeting, it is easy to leave a voice note containing five different things: look something up, create a task, update a document, check a price, or send an email. The hard part is not recording the note. The hard part is actually turning that rambling list into finished work.

Most assistants take one of two approaches. They ask for permission for almost everything, which quickly becomes tiring, or they give themselves too much freedom and treat low-risk and high-risk actions the same way.

That did not feel right.

People do not give trust uniformly. You might be comfortable letting someone organize your to-do list, but you would probably want more control before they send an email on your behalf.

Sollu is built around that idea.

What Sollu Does

You give Sollu a voice note with multiple errands.

Gemini breaks the note into individual tasks and organizes them into Now, Next, and Later.

Each task is also classified by how risky and reversible the action is:

• Read-only: runs automatically.
• Soft: asks for approval and can earn autonomy after repeated approvals.
• Hard: always requires human approval.

The important part is that approval is not just a checkbox.

When a task is approved, Sollu actually performs the action. It can run grounded research, create Notion pages, update connected workspace services, or send an email through the appropriate executor. The resulting artifact is then attached to the task.

Sollu also provides spoken confirmation using Gemini TTS.

How We Built It

The live request enters a FastAPI service running on Google Cloud Run and is routed through a real Google ADK BaseAgent on the production POST /tasks path.

The pipeline is:

Voice note → ADK agent → Gemini reasoning → task classification → trust evaluation → Firestore persistence → execution

Google ADK

The VoiceAgent is a custom Google ADK BaseAgent running through an ADK InMemoryRunner.

It sits directly on the live request path rather than existing only as a demo wrapper.

Gemini

gemini-3.5-flash handles the main reasoning flow, including audio parsing, task extraction, structured output, and grounded research.

gemini-2.5-flash-tts is used separately for spoken confirmations.

Trust Ladder

The trust model is stored in Firestore and tracked independently for each task class.

• Read-only tasks have a threshold of 0
• Soft tasks have a threshold of 3
• Hard tasks have no automatic threshold

Crossing a threshold creates a promotion event. Rejecting an autonomous soft task resets that class back to zero approvals.

This makes autonomy reversible rather than permanent.

Real Actions

Sollu uses an MCP client to connect the reasoning layer with real workspace actions such as Gmail, Google Sheets, and Notion.

Real actions are protected with hash-based idempotency keys so a retry does not accidentally perform the same action twice.

Traceability

Every request carries a correlation_id through the workflow.

That ID connects the original voice note, triage decision, trust evaluation, execution, and resulting artifact across Firestore and Cloud Logging.

Challenges We Faced

Making grounded research usable

Our first grounded research implementation was far too slow.

Without a response schema, one path took around 244 seconds. By combining Google Search grounding with a structured response_schema, we reduced the measured path to around 18.7 seconds while keeping the result structured and usable.

Trusting the wrong source metadata

We also discovered that the source information exposed in the model response was not always reliable.

Instead of trusting the model's own source field, we read the actual grounding metadata and extracted the publisher domain from there. This even helped us catch a case where an IDC finding was incorrectly displayed under a generic Google source label.

Real actions introduce real risk

Once an agent can send email or create external artifacts, retries become dangerous.

A duplicate model call should never become a duplicate real-world action. We solved this with deterministic idempotency keys based on the note, intent, and arguments.

A single trust score was not enough

Our first version used one global approval counter.

That broke the trust model immediately.

Someone approving several harmless Notion actions should not automatically grant permission for email. We rebuilt the system so trust is tracked independently for each task class in Firestore.

What We Are Proud Of

The Google Agent Framework is actually part of the product

The ADK agent is on the live request path. Every real voice-note request goes through it.

Autonomy has boundaries

Sollu does not simply count approvals and eventually trust everything.

Low-risk actions can become autonomous, while high-risk actions such as sending email remain human-controlled by design.

The system is actually deployed

Sollu runs on Google Cloud Run with Firestore as persistent application state, and the production workflow has a measured median end-to-end request time of about 6.5 seconds from upload to task cards.

What We Learned

Building this changed how we think about agentic systems.

Trust is not one number. Different actions deserve different levels of autonomy.

Real actions also change the engineering problem completely. Once an agent can modify external systems, idempotency, traceability, and failure handling stop being optional details.

We also learned not to blindly trust model-generated metadata. Structured grounding information is much more useful than assuming the model's explanation is always correct.

Most importantly, autonomy works better when it is treated as something an agent earns, rather than something it receives by default.

What's Next

There are several directions we want to take Sollu next.

A larger set of low-risk read-only capabilities could allow it to safely search email, calendars, and Drive. More medium-risk actions could become eligible for earned autonomy, while destructive actions would remain explicitly human-controlled.

We also want real undo support for reversible actions, proactive triggers beyond voice notes, and a persistent memory layer.

Today, trust is tracked by task class. The longer-term goal is to make trust personal as well, so the system can distinguish between context and relationships instead of treating every task as identical.

The part we are most interested in carrying forward is the trust ladder itself.

Reversibility-gated autonomy is bigger than a single hackathon feature. It can become infrastructure for agents that are expected to act in the real world.

Built With

• agentic-ai
• google-cloud
• python
• typescript
• voice-ai