Shirley XueAll work
Product + CodeHackathonMulti-agentQwen Cloud2026

TrustFlow — agents negotiate, code enforces

Problem
European enterprises are stuck between banning AI tools and uncontrolled GDPR / EU-AI-Act exposure. In Germany a works council can turn weeks of approval into months.
Solution
Agents negotiate; a compiler — pure code, same input, same policy — signs; humans activate; a gateway enforces. No model anywhere in the enforcement path.
Result
Hackathon demo on Alibaba Cloud. I originated the concept and co-built it with a software engineer, both of us directing AI agents.

Every new AI use case in a European enterprise needs sign-off from compliance, IT, procurement, and worker representatives.

TrustFlow turns that negotiation into software: stakeholder agents debate the request, a deterministic compiler turns their agreement into a signed machine-enforced policy, and humans stay in control of activation. Built for the Qwen Cloud Global AI Hackathon (Track 3, Agent Society) and deployed as a live demo on Alibaba Cloud. The idea was mine, and we co-built it — I owned the product, design and evidence side, my teammate led the engine implementation, both of us directing AI agents.

Agents can propose; only deterministic code can decide. Where that line falls:

  1. The boardroom emits structured proposals — never executable rules.
  2. No LLM sits in the enforcement path. PII scanning, model routing and audit logging are pure code.
  3. Humans activate. Nothing enforces until the data-protection officer and IT sign the compiled policy.
  4. Agents accelerate humans, never replace them: an approval still ends in a human sign-off, and a rejection gets an explainable appeal path instead of a dead end.

Negotiate, compile, sign, enforce

The system is a pipeline with a hard hand-off in the middle: creative negotiation on top, hard guarantees at the bottom. An LLM proposes the policy; deterministic code validates, hashes, signs, and enforces it.

TrustFlow architecture — employee and governance portals feed an agent boardroom, whose proposals go through a deterministic compiler and human sign-off into an active policy enforced by an edge gateway with an audit logView full size
The system — one boundary: agents propose, deterministic code decides and enforces
  1. 01

    Agent boardroom

    Qwen-powered specialists debate the request in structured rounds — proposals only.

  2. 02

    Deterministic compiler

    Pure code merges demands, floor-checks them against the org's red lines, validates the schema, hashes and signs.

  3. 03

    Human sign-off

    DPO and IT activate the compiled policy. No enforcement before signatures.

  4. 04

    Edge gateway

    PII scanning, model routing, audit logging on every inference — no LLM at the edge.

Five specialists, structured disagreement

The demo models a German fintech's approval lanes with five agents, each with a real mandate: a workflow runner advocating the business case, corporate compliance holding GDPR and EU-AI-Act red lines, IT owning routing and data residency, procurement gating on vendor contracts, and a works-council liaison tracking the worker-representation agreement.

They debate across structured rounds — opening, lane statements, rebuttals, finals, up to 15 turns — reacting to the shared transcript rather than answering isolated prompts. Every turn returns a schema-validated envelope: stance, demands, concessions. Disagreement resolves into one of three deterministic outcomes: approved, denied, or pending an external gate.

The glass-box view makes the whole thing inspectable for judges: the debate transcript, the pipeline strip, and a live gateway panel where you can send a prompt through the compiled policy and watch an email get masked or an IBAN get blocked.

The TrustFlow glass box — five specialists' negotiation transcript on the left, the compiled-policy gateway panel on the right masking an email address in a live prompt, outcome ALLOWED with a local redaction hopView full size
The glass box · the payment-data scenario: agents negotiated sovereign routing, the gateway masks PII in a live prompt

Measured against a single agent

The obvious question: why five agents instead of one well-prompted 'AI governance advisor'? We measured it. Same request packet, same qwen-max model: a tool request with the vendor's data-processing agreement still unsigned.

The single agent conditionally approved — audit controls only — and never mentioned the unsigned contract. The specialist boardroom caught it in round one: procurement vetoed, the debate explored workarounds, and the compiled outcome stayed DENIED. The comparison is captured, committed to the repo, and reproducible with one command.

Side-by-side baseline: one generic agent conditionally approves and never surfaces the unsigned vendor DPA; the specialist boardroom denies, with procurement blocking in round oneView full size
Same input, same model · the monolith would have cleared the vendor gate; the boardroom caught it in round one

The product around the agents

Governance software fails when only lawyers can read it, so the employee portal translates the machinery into a plain answer: what's approved, what's blocked, and exactly which gate is missing. A compliance-readiness meter shows the signed gates (vendor contract, works-council agreement, compiled policy hash) and what's still pending; the full boardroom trace sits one tab away for anyone who wants the reasoning.

Denied isn't a dead end either — an employee can appeal, which re-opens the boardroom with an advocate agent arguing their case.

TrustFlow employee portal — compliance readiness at 80% waiting for human sign-off, with signed vendor DPA, works-council agreement and compiled policy hash, and the full five-agent negotiation trace belowView full size
The employee portal · readiness, gates, and the full negotiation trace — governance a person can read

Where it stands

A hackathon build, not a product. Five demo scenarios — happy path, works-council gate, high-risk denial, sovereign routing, vendor-contract veto — are asserted by the test suite; replay mode runs the full pipeline on recorded live transcripts, so judges could see everything without an API key; the live demo ran on Alibaba Cloud.