SovereignMesh — Zero-Trust Enterprise Agent Fleet

Zero-Trust enterprise agent fleet on Gemini 2.5 & Google Cloud GEAP. Gating high-stakes actions with Zanzibar ReBAC, Model Armor, and adversarial Consensus Hardening Protocol (CHP).

Comment

Inspiration

As autonomous AI agents evolve from conversational assistants into mission-critical enterprise operators—managing procurement, authorizing disbursements, and remediating cloud infrastructure—a dangerous systemic risk has emerged: unbounded ambient blast radiuses.

In traditional deployments, autonomous agents are granted static API credentials and execute tools with absolute trust. A single indirect prompt injection embedded in a vendor PDF, a poisoned database row, or a hallucinated parameter can trigger an unauthorized $50,000 wire transfer or assign roles/owner to an external identity.

We were inspired by Google Cloud's Gemini Enterprise Agent Platform (GEAP) vision and Google's pioneering work on Zanzibar ReBAC (Relationship-Based Access Control). We asked: What if enterprise agents never operated with ambient authority? What if high-stakes actions were continuously red-teamed by an adversarial multi-agent consensus council before a single dollar moves or a single firewall rule changes?

That question led to SovereignMesh—a Zero-Trust, self-governing enterprise agent control plane built on Gemini 2.5 and GEAP.

What it does

SovereignMesh fortifies autonomous agent fleets across the five foundational pillars of enterprise governance:

  1. Enterprise Agent Registry (AGENTS.md): Auto-discovers and validates fleet agents, capability scopes, and model assignments (Gemini 2.5 Flash for high-speed operations, Gemini 2.5 Pro for deep adversarial audit).
  2. Zero-Trust ReBAC Tool Interceptor: Implements Google Zanzibar relationship graphs (viewer, editor, executor, council_auditor). Every autonomous tool execution fails closed unless explicit relationship tuples exist.
  3. Model Armor Guardrail Firewall: Pre-execution payload inspection screening arguments for indirect prompt injection, role hijacking, path traversal (../../), and credential exfiltration.
  4. Consensus Hardening Protocol (CHP v1.0): Any high-stakes action (spend > $5,000, privileged IAM roles, unverified vendor accounts) triggers a 3-phase adversarial deliberation:
    • Proposer (Gemini 2.5 Flash): Submits the action with formal business justifications.
    • Challenger Red Team (Gemini 2.5 Pro): Interrogates the GEAP Memory Bank to identify ledger discrepancies, unverified bank accounts, and anomalous spend patterns.
    • Sovereign Adjudicator: Computes the mathematical consensus confidence score ($R_0$). If $R_0 \ge 0.85$, it certifies the decision; if $R_0 < 0.85$, it rejects execution and requires an immutable human countersignature.
  5. GEAP Memory Bank & Signed Decision Ledger: Persists long-term entity intelligence across sessions and generates exportable JSON-LD cryptographic certificates with SHA-256 state hashes for compliance audits (SOC-2, ISO-27001).

How we built it

  • Core AI Engine: Built on Google Cloud Vertex AI and the @google/genai / @google/generative-ai SDKs with Application Default Credentials (ADC). We utilize Gemini 2.5 Flash for high-throughput operational drafting and Gemini 2.5 Pro for high-context adversarial cross-examination.
  • Authorization & Guardrails: Custom in-memory Zanzibar ReBAC engine evaluating relationship tuples alongside an active Model Armor regex/entropy sanitization layer.
  • Consensus Protocol: Normative implementation of CHP v1.0 with domain confidence floor thresholds and SHA-256 cryptographic hashing.
  • Control Plane Frontend: Full-stack Next.js 15 (App Router) and TypeScript dashboard styled with bespoke Vanilla CSS (zero bloat, high-density dark mode) featuring the interactive Deliberation Arena, Zanzibar Interceptor, Fleet Registry, and Decision Ledger.
  • Video & Media: 1080p narrated video walkthrough rendered via FFMPEG with AI-generated scene storyboards and voiceover synthesis.

Challenges we ran into

  • Sub-Second Tool Interception: Ensuring that Zanzibar relationship lookups and Model Armor payload inspections execute with sub-millisecond latency so operational agents are not slowed down on routine, low-risk actions.
  • Adversarial Challenger Calibration: Fine-tuning the Challenger agent's prompt to aggressively catch fraud and discrepancies in the Memory Bank without triggering false rejections on valid, edge-case corporate transactions.
  • Auditable Cryptographic Proofs: Structuring the signed decision locks in a clean, self-contained JSON-LD schema that enterprise security auditors can independently verify without access to the internal model weights.

Accomplishments that we're proud of

  • Neutralizing Real-Time Attacks: Successfully demonstrating complete neutralization of a $18,500 tampered invoice attack with prompt injection—dropping the consensus ratio $R_0$ to $0.05$ and blocking the wire before execution.
  • Mathematical Decision Gating: Bridging declarative policy (AGENTS.md and Zanzibar ReBAC) with dynamic multi-agent deliberation (CHP v1.0).
  • Production-Grade UI/UX: Building a clean, responsive enterprise command center that lets security teams visualize real-time agent debates and inspect cryptographic certificates with one click.

What we learned

  • The Power of Flash vs. Pro Orchestration: Pairing Gemini 2.5 Flash for operational agility with Gemini 2.5 Pro for deep adversarial deliberation provides the optimal balance of enterprise throughput, cost efficiency, and rigorous security.
  • Why ReBAC Beats RBAC for Agents: Traditional Role-Based Access Control is too coarse for AI agents. Relationship-Based Access Control (ReBAC) enables granular, entity-bound tool authorization (e.g., Agent X can execute payments ONLY for Purchase Orders where Agent X is an assigned editor).

What's next for SovereignMesh — Zero-Trust Enterprise Agent Fleet

  • Confidential Space / TEE Enclave Attestation: Running the Sovereign Adjudicator inside a Google Cloud Confidential VM with hardware-level remote attestation.
  • OpenTelemetry & SIEM Connectors: Streaming real-time deliberation traces and decision locks directly into Google Cloud Logging, Chronicle, and Splunk.
  • Multi-Cloud & ERP Mesh: Native connector modules for SAP S/4HANA, NetSuite, Workday, and AWS IAM.

Built With

Share this project:

Updates