VerdictFlow - Evidence Relay

Inspiration

AI can produce persuasive recommendations without showing whether they are supported. In research, safety, compliance, and internal review, the real question is:

Can someone defend the decision later?

We built VerdictFlow to turn AI output into evidence-bound, human-owned decisions with a complete history of how the outcome was reached.

What it does

VerdictFlow sits between an existing AI workflow and an approved downstream action.

It:

• checks AI claims against exact source evidence;
• rejects unsupported claims;
• quarantines instruction-like text in source material;
• routes uncertainty to a human owner;
• blocks closure until every finding has a disposition and rationale;
• creates a versioned decision packet;
• reopens changed findings while preserving the previous decision.

The public demo runs anonymously in fixture mode so judges can test the complete workflow without credentials.

How we built it

We implemented four bounded agents:

1. Intake
2. Evidence
3. Scope/Safety
4. Synthesis

Deterministic gates validate evidence quotes, schemas, allowed statuses, and source boundaries. A file-backed repository and local event bus provide reproducible execution, while the live backend runs on Cloud Run with Gemini 3.5 Flash-Lite through Vertex AI and the Google Gen AI SDK.

We also benchmarked Gemma 3 as an independent advisory reviewer. Gemma can flag grounding and instruction risks, but it cannot change evidence validation, workflow state, or human decisions.

Challenges we ran into

The hardest problem was defining the boundary between model assistance and decision authority.

Source documents may contain text that looks like instructions. We needed to inspect that content without allowing it to control the agent. We also had to ensure that every evidence quote remained inside the declared source boundary.

Finally, we separated deterministic fixture results from live model-quality results so the evaluation would remain reproducible and honest.

Accomplishments that we're proud of

VerdictFlow demonstrates a complete decision-assurance lifecycle:

• four-agent execution trace;
• exact-quote verification;
• unsupported-claim handling;
• prompt-injection quarantine;
• human verification task;
• closure gate;
• versioned decision packet;
• reopen and supersede flow.

On the three-case live Gemini benchmark, the system achieved:

• 3/3 expected finding statuses;
• 3/3 grounded outputs;
• 3/3 schema-valid outputs;
• 1/1 injection-resistance case.

The Gemma advisory benchmark achieved 3/3 schema-valid outputs and flagged the injection case.

What we learned

Reliable agentic systems need explicit boundaries around evidence, authority, and state.

A second model opinion does not create accountability by itself. Accountability comes from deterministic gates, human ownership, replayable traces, and preserved decision history.

We also learned that fixture control metrics and model-quality metrics must be reported separately.

What's next for VerdictFlow — Evidence Relay

Next, we will expand the labeled evaluation set, add blinded human evaluation, measure precision, recall, and calibration, and connect production adapters for Firestore, Cloud Storage, Pub/Sub retries and dead-letter queues, identity and permissions, ADK orchestration, and OpenTelemetry.

Built With

• ai-agents
• audit-logging
• cloud-run
• decision-assurance
• evidence-verification
• gemini
• gemini-3.5-flash-lite
• gemma-3
• google-genai
• human-in-the-loop
• javascript
• node.js
• prompt-injection-detection
• provenance
• vertex-ai