Teaching an Agent Fleet to Distrust Documents: Zero-Trust M&A Diligence on Google Cloud

TL;DR

Diligence Room is an enterprise zero-trust runtime for autonomous multi-agent fleets, demonstrated through a high-stakes M&A due-diligence scenario on a synthetic robotics company, Vantage Robotics, investigated under the deal name Project Falcon. Eight specialist agents analyze a hostile, unvetted data room under strict information barriers, taking the transaction from document upload to executive risk synthesis as a deterministic replay in under four minutes.

The architecture rests on three reframings: documents are adversaries, agents are principals, and memory is partitioned by policy rather than convenience. It was built for the AllThingsAgentic Hackathon's Fortified Enterprise Fleet track on the Google Gemini Enterprise Agent Platform.

2:00 AM in the virtual data room

Picture an M&A war room at 2:00 AM, forty-eight hours before a term sheet expires. A seller has dumped 10,000 pages of contradictory files into a data room: scanned contracts, redacted cap tables, customer MSAs, employee exit memos, and financial workbooks. A transaction analyst has one question: what in this room will blow up the acquisition six months after close?

The worst liabilities usually live between corporate silos. A legal specialist finds a change-of-control termination right in Meridian Logistics' contract. Finance sees that customer accounts for 18.3% of FY27 cash flow. HR notices that the account director is resigning. An engineer flags that a core middleware package reaches end-of-life before renewal. Each item looks ordinary alone. Together, they point to a customer collapse that eviscerates deal EBITDA.

Human deal rooms rarely connect those dots in time because teams work in separate systems. A monolithic “chat with your docs” agent fails differently: it blows out its context window, invents numbers to fit clauses, or naively executes prompt injections hidden in uploaded files.

The answer is not a bigger chatbot. It is a fortified fleet of specialized agents that can screen hostile input, enforce domain boundaries, and prove every claim against verbatim evidence before a human signs a check.

The twist

Every architectural choice follows three principles:

• Documents are adversaries. Every vendor-supplied file is hostile input until it passes a four-layer screening gauntlet.
• Agents are principals. Legal, Finance, HR, IP/Tech, Tax, Regulatory, ESG, and Real Estate agents have distinct service identities, read scopes, and write permissions.
• Memory is partitioned by policy. Finance projections do not drift into HR's workspace. Legal requests only an explicitly permitted aggregate through the Agent Gateway.

Four layers between an upload and a finding

1. Gemma Sentinel: the ingestion gate

Before a premium model sees document text, every chunk passes through gemma-4-26b-a4b-it on the Gemini Developer API. The sentinel is an inline tripwire for direct prompt injection, sensitive PII markers, and coarse classification hints. Poisoned text is quarantined before it reaches an agent's reasoning context.

2. Model Armor API: the managed perimeter

Cleared chunks enter the Google Cloud Model Armor template alongside custom project inspection rules. The design is fail-closed: document text that cannot be cleared does not become agent context.

3. Agent Gateway: deny-default policy routing

When Legal needs to know whether Meridian is material, it cannot browse the Finance data room. It sends a structured request to a Cloud Run gateway. The gateway checks identity and policy, then returns the allowed aggregate:

legal -> finance (revenue_concentration): ALLOW / aggregate_permitted -> 18.3%
hr -> finance (raw_payroll_export): DENY / no_policy

The first request gets one scoped scalar. The second is blocked and recorded as an auditable security event.

4. Evidence Gate: the anti-hallucination wall

At the database write boundary, finding_create verifies that each quoted verbatim_span is an exact substring of the cited document chunk. If a model fabricates or paraphrases a quote, the write aborts with evidence_unresolvable and the audit trace records the rejection.

Project Falcon's defining moment

The architecture matters most when independent signals converge:

1. Legal finds Meridian's 90-day change-of-control clause and logs a high-severity, verbatim-backed finding.
2. Through the gateway, Legal receives Finance's verified 18.3% revenue-concentration aggregate.
3. HR records the resignation of the Meridian account owner.
4. IP/Tech flags TitanBridge 4.1 reaching end-of-life before renewal.

No individual specialist is authorized to declare a deal-killing emergency. The Coordinator Keystone instead evaluates convergence across the deal graph, then synthesizes the critical customer-exit exposure only when every input is independently evidence-backed. Remove a workstream, or fail a cited span, and the coordinator refuses to produce the conclusion.

Human approval is a gate, not a formality

After a critical exposure appears, the Negotiation Agent can draft remedies such as seller indemnities, escrow holdbacks, or pre-closing customer waivers. It cannot send them.

draft -> pending_approval -> halted for human review -> approved -> send_logged

The move from pending_approval to approved requires cryptographic human-to-output authorization from the deal lead. Nothing leaves the room without that consent.

What broke, and the defenses it produced

Runaway tool loops

An edge-case contract clause once sent a specialist through ten repetitive tool calls. The Loop Guard now caps iterations, tool calls, tokens, and per-step wall time. A breached bound saves a checkpoint and emits a run.bounds_exceeded receipt.

Plausible but false citations

An agent once produced a convincing environmental-indemnification finding with a slightly paraphrased citation. The Evidence Gate rejects it at write time; low-confidence results remain candidates and cannot trigger autonomous escalation.

Mid-run container crashes

Workers restart. Without transactional state, restarts produced incomplete records and duplicate findings. Crash-Resume and Idempotency commits execution state to an append-only event log, resumes from the last checkpoint, and uses idempotency keys to prevent duplicate outputs.

Regressed agent deployments

An updated Legal prompt subtly regressed on complex indemnities. The Registry Rollback mechanism caught the change through shadow evaluations on a golden set and restored the prior agent version. Because deal state lives in partitioned storage rather than agent code, the rollback does not destroy the transaction record.

The platform underneath

Diligence Room combines agent cards and a registry for lifecycle management; a Google ADK and Vertex AI Agent Engine runtime for long-running work; partitioned Firestore and memory-bank state; per-workstream IAM identities; Cloud Run policy routing; Model Armor guardrails; OpenTelemetry traces; and Cloud KMS and Cloud DLP controls for compliance.

Those components are only useful when they reinforce the same operating model: a document does not earn trust by arriving in the data room, an agent does not earn access by sounding helpful, and a claim does not earn action by sounding plausible.

Closing thought

Autonomous agents do not need to be unconstrained black boxes. Treat documents as adversaries, agents as narrowly scoped principals, and human approval as a real boundary, and a multi-agent system can turn a complex workflow into something defensible, inspectable, and auditable.

Demo and verification

• Repository: github.com/divagr18/diligence-room
• Live dashboard: Diligence Room dashboard
• Hosted gateway: Gateway edge