VendorGuard AI

Lab 1 - Digital Transformation & Operations Github repo: https://github.com/Leong1104/VendorGuardAI Live demo: https://vendorguard-dun.vercel.app Video demo: https://youtu.be/CbwLtqDLIpw

Inspiration

Invoice fraud is simple: reissue an invoice with a new bank account and hope nobody cross-checks the documents. Most AI fraud tools respond with a black box — a score with no reasons. Under PDPA Malaysia, that's unusable: you can't block a payment on a hunch. So we flipped the design: the AI never decides the risk.

What it does

An analyst uploads a batch of AP documents (supplier profile, PO, invoices, delivery order, receipt). VendorGuard classifies and extracts each PDF with Gemini, normalizes the fields in pure code (ISO dates, MYR amounts, masked bank accounts), links everything into one transaction, and runs five deterministic control checks — duplicate invoice, bank-account mismatch, payment-status conflict, missing PO reference, overdue invoice. Each finding has fixed points and cites its exact source document and field. The AI only narrates the result. High-risk cases go to a human: block payment, request bank verification — all audit-logged.

Our test scenario scores 70/100 (high risk) traceable to its source PDF.

How we built it

Next.js 16 + Supabase (RLS deny-by-default, private storage) + Gemini, deployed on Vercel. All data access is servepure TypeScript function, so identical inputs always give identical findings.

Challenges

Keeping the LLM honest — early prompts "helpfully" inferred missing PO references, destroying the fraud signal. Wnted only, with strict JSON schemas at temperature 0.
PDPA by design — accounts are masked bs never exist downstream; deleting a batch removes everything but the deletion audit record.

What we learned

Explainability is an architecture decision, k logic in deterministic code and provenance, auditability, and PDPA compliance come naturally. AI belongs at the edges: rea narrating clear conclusions out.