TrustFix

An autonomous AI security agent that continuously audits Google Cloud, proves questionnaire compliance with live cryptographic proof, and executes governed fixes.

Comment

💡 Inspiration

Modern engineering teams waste hundreds of hours every quarter manually filling out customer security questionnaires (SOC 2, ISO 27001, vendor risk reviews). Even worse, static questionnaires only prove compliance at a single point in time—often relying on outdated screenshots that don't reflect actual, live infrastructure risk.

We asked: What if an autonomous AI agent could continuously read security questionnaires, interpret complex security intent, audit live Google Cloud resources directly using keyless identity, and propose human-governed remediations with mathematical proof?

That vision is TrustFix—the world’s first autonomous cloud assurance and security remediation agent.

🚀 What It Does

TrustFix transforms point-in-time compliance into continuous, evidence-backed cloud assurance:

  1. Automated Questionnaire Ingestion: Upload any vendor questionnaire or standard security assessment (.csv, .xlsx, or raw text).
  2. Autonomous Intent Mapping: Powered by Google ADK and Gemini 3.5 Flash, TrustFix maps natural language compliance questions directly to deterministic, code-backed Google Cloud control definitions.
  3. Keyless Live Cloud Auditing: TrustFix queries live Google Cloud APIs using project-scoped, keyless service account identities across 9 major GCP services:
    • Cloud Storage: Bucket IAM, public access prevention (PAP), and live HTTP 403 probe validation.
    • Cloud Run: Serverless unauthenticated invoker gating vs IAM/IAP authentication.
    • VPC Firewalls: Administrative port exposure (SSH 22, RDP 3389, open 0-65535).
    • Cloud SQL: Public IPv4 exposure, Private Service Connect, and TLS enforcement.
    • Cloud KMS: Customer-Managed Encryption Key (CMEK) 90-day automated rotation.
    • Keyless IAM: Detection of leaked user-managed JSON service account keys vs Workload Identity.
    • Cloud Logging: Data Access and Admin Activity compliance audit trails with 365-day retention.
    • Secret Manager: Unauthenticated accessor gating and version rotation schedules.
    • Google Kubernetes Engine (GKE): Control plane private endpoint isolation and private worker nodes.
  4. Governed Human-in-the-Loop Remediation: When a security gap is found, TrustFix generates an exact IAM diff, risk rating, and rollback script. Changes are only applied after explicit human review.
  5. Cryptographic Proof Packs: Every completed assurance run produces a sealed, tamper-evident SHA-256 Cryptographic Proof Pack containing full evidence lineage and digital attestation.
  6. Real-Time Voice Assistant: Built-in interactive voice agent for spoken cloud posture briefings and voice-activated assurance runs.

🛠️ How We Built It

  • Agent Orchestration: Built with the Google Agent Development Kit (ADK) and Gemini 3.5 Flash for multi-turn intent extraction, tool execution, and deterministic control routing.
  • Backend Architecture: Fast, scalable FastAPI (Python 3.12) microservices with Google Cloud Client Libraries (google-cloud-storage, google-cloud-run, google-cloud-compute, google-cloud-kms).
  • Frontend & Mission Control: Next.js 15 (App Router), React, and TypeScript featuring a dark-themed Command Center, live event streaming, and custom audio waveform visualizations.
  • Security & Keyless IAM: Full Workload Identity Federation with zero stored credentials, verified Google IAP boundary isolation, and Firestore state persistence.

🥊 Challenges We Ran Into

  • Strict Determinism vs LLM Creativity: While LLMs excel at understanding messy questionnaire phrasing, compliance requires 100% deterministic evaluation. We solved this by pairing Gemini 3.5 Flash for question parsing with strict, code-backed Python evaluators for actual GCP API inspection.
  • Live Proof Validation: Ensuring that an observed IAM configuration actually reflects real-world network access. We implemented independent, real-time HTTP probes to mathematically verify 403 Forbidden responses against public bucket endpoints.
  • Zero-Friction Onboarding: Enterprise cloud security onboarding is notoriously painful. We designed 1-click project auto-discovery and deep-linked Google Cloud Console authorization flows to eliminate manual configuration.

🏅 Accomplishments That We're Proud Of

  • 9 Comprehensive Google Cloud Services Supported out of the box with live inspection and automated remediation.
  • Sub-Second Live Auditing: Full project inspection, compliance grading, and proof generation complete in seconds.
  • 100% Test Coverage: 29/29 automated backend tests and 0 TypeScript build errors across the entire monorepo.
  • Cryptographic Evidence Lineage: Every single finding is tied to an immutable SHA-256 digest that can be handed directly to external auditors or customers.

📚 What We Learned

  • How to leverage the Google Agent Development Kit (ADK) to build safe, auditable agentic workflows with human-in-the-loop governance.
  • Best practices for designing keyless, least-privilege cloud inspection pipelines without handling user API keys or static credentials.

🔮 What's Next for TrustFix

  • Multi-Cloud Expansion: Extending the TrustFix assurance engine to AWS and Microsoft Azure.
  • Automated Evidence Sync: Direct connectors for Vanta, Drata, and Jira for automatic compliance sync.
  • Autonomous Drift Healing: Automated background healing of security drifts with configurable auto-approval policies.

Built With

Share this project:

Updates