VEK Assurance Cloud

An AI-native assurance platform that combines Gemini with deterministic VEK qualification to verify, govern, and document high-stakes AI outputs before businesses act on them.”

Comment

Inspiration

Generative AI can help small businesses operate faster, but its outputs are probabilistic. The same system can produce a strong answer, an unsupported claim, or an unsafe instruction. Large enterprises can build compliance teams and custom safety infrastructure around this problem. Small businesses usually cannot.

I created VEK to explore a practical question: How can a business benefit from powerful AI without automatically trusting every generated output?

VEK existed as a deterministic technology framework before this competition. During the Build with Gemini XPRIZE, I built VEK Assurance Cloud as a new, deployed application of that framework. It demonstrates how Gemini-generated outputs can be captured, evaluated against disclosed demonstration policies, and stopped before they advance when they do not satisfy the required conditions.

My broader inspiration comes from building with limited resources while seeing how difficult it is for small businesses to adopt AI responsibly. Trust should not require a Fortune 500 security budget.

What it does

VEK Assurance Cloud is a deterministic post-generation qualification and execution-authorization layer.

Gemini produces a candidate output. VEK then evaluates the captured output using a fixed policy, validator version, configuration, and scenario state. The result is one of four outcomes:

PASS: The captured output satisfies the demonstration policy and may advance to a synthetic execution simulator. WARN: A non-critical concern was detected and should be reviewed. REVIEW: The system requires a human decision. BLOCK: The output is stopped and cannot advance.

For every evaluation, the system creates a replayable proof envelope containing the relevant hashes, policy identifier, validator version, decision, and reason codes. Judges can replay the same captured artifact 100 times and verify that every replay produces the same qualification result and proof hash.

VEK does not make Gemini deterministic, and it does not independently prove that an AI-generated statement is factually true. It provides a deterministic answer to a narrower but important question: Did this fixed output satisfy this disclosed policy under this validator version?

The public judge console uses only synthetic data and simulated infrastructure. It performs no real transactions or external actions.

How we built it

The application uses Gemini through a server-side integration so API credentials never enter the browser. Google AI Studio supported rapid prompt and scenario development, while the deployed application uses the Gemini API and Google Cloud Run.

The interface is built with React, TypeScript, Vite, and Tailwind CSS. A Node.js and Express backend manages Gemini requests, validation, proof-envelope creation, rate limiting, and secret isolation.

For deterministic evidence, the application canonicalizes covered JSON data using RFC 8785 JSON Canonicalization Scheme principles and generates SHA-256 hashes. Automated Vitest tests verify expected PASS, WARN, REVIEW, and BLOCK behavior, along with replay and hash stability. GitHub Actions run build, test, and security checks before changes are released.

The demonstration includes several synthetic scenarios, including an evidence-supported response, an unsupported claim, an ambiguous case requiring review, and a prompt-injection attempt. These scenarios show both successful and unsuccessful paths instead of presenting only a perfect result.

How AI operates the business

Gemini performs the generative work: interpreting the scenario and producing the candidate response. VEK performs the deterministic qualification step and controls whether the captured response may advance inside the demonstration.

Humans remain responsible for defining policies, deciding what evidence is required, reviewing WARN and REVIEW outcomes, handling customer relationships, and approving any future production integration. The current public application does not allow AI to independently control real financial, physical, or business infrastructure.

The business model can combine implementation services, qualification-policy packages, evaluation engagements, and recurring software licensing. This gives small businesses a practical path to adopting AI while preserving human authority and producing evidence that customers, auditors, and partners can inspect.

As the platform grows, it can also create work around policy configuration, AI-system integration, assurance testing, auditing, and customer training.

Challenges we faced

The largest technical challenge was maintaining consistent canonicalization and hashing across browsers, servers, and Unicode inputs. Small differences in serialization can produce different hashes even when the underlying information appears identical.

A second challenge was establishing an honest scientific claim boundary. Deterministic qualification is not deterministic generation, factual verification, or a guarantee of physical safety. The interface and documentation had to communicate that distinction clearly.

The third challenge was demonstrating enough of VEK to make the application understandable and testable without exposing proprietary production policies, theorem mappings, customer information, credentials, or patent-sensitive implementation details.

What we learned

We learned that trust is easier to understand when it is visible. A PASS, WARN, REVIEW, or BLOCK result becomes much more meaningful when a user can inspect its reason codes, download its proof envelope, and replay the evaluation.

We also learned that a good AI assurance product should not hide uncertainty. It should expose why an output advanced, why it stopped, and when a human must take responsibility.

What’s next

The next stage is to conduct additional small-business pilots, develop customer-specific policy packs, expand API and agent integrations, and obtain independent technical evaluation.

The long-term goal is to make VEK an assurance layer that can sit between AI-generated proposals and consequential business actions—allowing businesses to move quickly with AI while preserving evidence, accountability, and human control.

Built With

Share this project:

Updates