TraceLayer

Inspiration

Fraud detection systems can flag suspicious activity quickly, but the investigation that follows is still fragmented. Investigators often have to manually connect transaction history, customer records, device and IP signals, network relationships, compliance rules, and approval workflows across different systems.

I wanted to explore a different question: what if an AI agent fleet could handle the investigation itself, while still remaining governed, private, and auditable?

That idea became TraceLayer, a privacy-preserving multi-agent fraud investigation platform. The goal was not to build another fraud chatbot, but an autonomous investigation system that can plan, use tools, gather evidence, adapt to new findings, persist state across asynchronous workflows, and stop for human approval when a consequential decision is required.

I also wanted institutions to benefit from shared fraud intelligence without requiring them to expose raw customer or transaction records to one another. That led to the federated intelligence component of TraceLayer.

What it does

TraceLayer turns a suspicious transaction into a controlled, auditable investigation case.

When a case begins, the Case Manager uses Gemini 3.5 Flash to propose a structured investigation plan. The plan is validated against allowed actions, risk rules, and security policies before any tool is executed.

From there, specialized agents collaborate on the investigation:

• The Triage Agent scores the transaction and evaluates federated fraud signals.
• The Network Agent searches related transactions and traces shared accounts, devices, IP addresses, counterparties, and fund movements.
• The Evidence Agent builds a chronological evidence timeline with provenance.
• The Compliance Agent checks policy requirements, PII handling, and security findings.
• The Case Manager evaluates the results and requests human approval when necessary.

The investigation is dynamic rather than a fixed pipeline. After important findings, such as a high-risk triage result or a newly discovered transaction network, the Case Manager can ask Gemini to create a new plan.

Human investigators also remain part of the loop. They can approve, reject, or request more evidence. A request for more evidence is fed back into the planner so the agent fleet can adapt its next actions.

TraceLayer also includes privacy-preserving federated intelligence. Institutions contribute protected or aggregated fraud signals instead of sharing raw customer records. The interface clearly separates local evidence from federated risk signals and reports that external raw customer records exposed remain zero.

For adversarial scenarios, TraceLayer includes a security boundary that detects prompt injection and attempts to exfiltrate PII before those instructions can affect the investigation.

How we built it

TraceLayer is built as a governed multi-agent system on Google Cloud.

Gemini 3.5 Flash on Vertex AI is used for structured investigation planning and reasoning. Google ADK provides the agent execution runtime for approved tools, while the Triage Agent is also deployed through Agent Engine with a managed runtime identity.

The application backend is built with Python and FastAPI and deployed on Cloud Run.

Firestore stores persistent case, job, policy, and investigation state. This allows investigations to survive across asynchronous executions and supports paused cases that can later resume when additional information becomes available.

Pub/Sub handles asynchronous investigation jobs and worker execution. BigQuery supports related-transaction and network searches. Cloud Logging records structured operational events, and TraceLayer also maintains a hash-chained audit ledger for tamper-evident investigation history.

The orchestration layer includes an Agent Registry describing agent versions, permissions, roles, and data classifications. An Agent Gateway and policy layer validate agent actions before tool execution.

The architecture follows one core rule:

Gemini plans. Policy decides. Agents execute.

The model can propose an investigation strategy, but it cannot bypass authorization.

Challenges we ran into

One of the biggest challenges was making the system genuinely agentic without giving the model unrestricted control.

A fully deterministic workflow would have been easier to build, but it would not adapt to new evidence. On the other hand, allowing an LLM to freely execute arbitrary actions would not be appropriate for a financial investigation system.

I solved this by separating planning from authority. Gemini proposes structured plans, while deterministic policy checks validate every action before execution. This allowed TraceLayer to remain adaptive while preserving clear security boundaries.

Another challenge was long-running state. Fraud investigations do not always finish in one request. Evidence can arrive later, investigators can request additional information, and cases may need to pause. I designed the workflow around persisted Firestore state and asynchronous Pub/Sub jobs so a case can be resumed rather than restarted.

Federated intelligence also required careful separation in the product design. I wanted shared intelligence to improve detection without making it look like one institution could inspect another institution's raw transactions. TraceLayer therefore keeps local investigation evidence and federated signals separate and exposes only privacy-safe metadata such as aggregate risk, contributor count, privacy protection information, and provenance.

Finally, observability was important because a multi-agent system becomes difficult to trust if users cannot see what each agent did. TraceLayer records agent actions, tool usage, results, case state changes, and approval events so investigators can reconstruct how a case progressed.

Accomplishments that we're proud of

I am especially proud that TraceLayer became more than a sequence of scripted AI calls.

The Case Manager can generate and revise investigation plans based on changing case state. Human feedback can trigger replanning. Investigations can pause, persist, and resume. Network findings can change the investigation path, and consequential outcomes still require human approval.

I am also proud of the privacy boundary between federated intelligence and local evidence. The system can demonstrate cross-institution fraud intelligence while keeping external raw customer records out of the investigation interface.

Another major accomplishment was connecting the agent workflow to real Google Cloud infrastructure rather than running everything as a local prototype. TraceLayer uses Cloud Run, Vertex AI, Agent Engine, Firestore, Pub/Sub, BigQuery, and Cloud Logging as part of the deployed system.

The final result is an agent fleet that is autonomous where automation is useful, but controlled where accountability is required.

What we learned

The biggest lesson was that enterprise agents need more than intelligence.

Planning is only one part of an agent system. Identity, permissions, persistent state, asynchronous execution, observability, security boundaries, and human oversight are just as important when agents interact with real operational workflows.

I also learned that autonomy and deterministic controls do not have to conflict. In TraceLayer, Gemini provides flexibility by proposing plans, while policy enforcement provides predictable boundaries. That combination was much more useful than either a completely scripted workflow or an unrestricted autonomous agent.

Building the federated intelligence layer also reinforced the importance of clearly communicating privacy. It is not enough to say that data is protected. The system should make it visible which information is local, which information is aggregated, and which information was never exposed.

Finally, building TraceLayer showed me how much easier multi-agent systems are to understand when their actions are observable. Agent traces, structured events, evidence provenance, and human decisions make the system easier to debug and much easier to trust.

What's next for TraceLayer

The next step is to make TraceLayer closer to a production-scale enterprise fraud investigation platform.

I would like to expand the Agent Registry with richer lifecycle management, ownership, deployment status, and agent discovery across larger fleets.

I also want to extend observability with full OpenTelemetry tracing so an investigation can be followed across planners, agents, tools, Pub/Sub jobs, BigQuery queries, and approval events as one end-to-end trace.

The federated intelligence layer could evolve into persistent cross-case campaign intelligence, allowing TraceLayer to identify related fraud campaigns across multiple investigations while preserving institutional privacy boundaries.

I would also continue strengthening agent-level identity and access control so specialized agents receive only the Google Cloud permissions required for their specific tools and data.

Ultimately, the goal for TraceLayer is to move fraud operations from isolated alerts and manual investigation steps to a governed fleet of autonomous agents that can investigate continuously while remaining private, explainable, and accountable.

Built With

• agent-engine
• ai-agents
• bigquery
• cloud-logging
• cloud-run
• fastapi
• federated-learning
• firestore
• fraud-detection
• gemini
• gemini-3.5-flash
• google-adk
• google-cloud
• multi-agent
• pub/sub
• python
• restapi
• vertex-ai