Every IT asset management tool on the market can flag a problem. ServiceNow's Identification and Reconciliation Engine will tell you two records probably describe the same laptop. A software normalization tool will tell you "Acrobat Rdr DC" and "Adobe Acrobat Reader DC" are probably the same product. What none of them do is act on it safely, accountably, and with a human in the loop where it matters.
That gap is where Provenance lives. It is a fleet of eight governed AI agents, built for the All Things Agentic Hackathon under the Fortified Enterprise Fleet track, that takes ownership of the reconciliation residual: the pile of ambiguous, conflicting, or orphaned records that every ITAM tool eventually punts to a human. At one real organization, that punt costs 16+ documented hours a month across three people. Provenance resolves it and then does something about it.
The core idea: proposals, never direct writes
The architectural claim that makes Provenance different is not the AI itself; it is the governance wrapped around it. Every agent in the fleet can only ever propose an action. It cannot write to Firestore, cannot write to ServiceNow, cannot touch a license entitlement. Every proposal goes through a deterministic Action Broker, which independently re-checks the agent's declared risk ceiling and allowed action kinds against a central registry. It never simply trusts what the agent claims about itself.
The broker then classifies the proposal into one of four tiers, using configuration rather than model output:
- T0, reversible with no cost and no access change, executes immediately
- T1, reversible within a window, executes now with a grace period and automatic rollback if anyone objects
- T2, irreversible, financial, or destructive, held in an awaiting approval state until a named human signs off
- T3, legally binding or barred by segregation of duties rules, refused, with no code path that lets it execute at all
That last point matters: T3 is not a check the model is supposed to remember to make. It is structurally unreachable. Segregation of duties is enforced the same way. The approving human's identity is read only from the authenticated request context, never from the request body, and if it matches the agent that proposed the action, the request is rejected. The ledger itself only exposes an append method; there is no update or delete path in the code, and Firestore's own security rules deny update and delete on the ledger for every principal, including service accounts.
Eight agents, three planes
- Data plane: Resolver (entity resolution across serial numbers, hardware UUIDs, MAC addresses, and Azure AD device IDs), Normalizer (software catalogue cleanup), Position (license math for ELP and PVU)
- Action plane: Custody (chain of custody and disposal), Lifecycle (joiner, mover, leaver), Steward (reclaims unused seats), Renewal (contract negotiation memory)
- Governance plane: Attestor (compiles audit evidence packs)
All eight agents are fully built and running, each registered with its own scope, risk ceiling, and allowed action kinds, published live through the Agent Registry API.
Deterministic logic runs first everywhere it can. Resolver matches almost every pair of asset records on exact identifiers before a model is ever invoked; only the genuinely ambiguous middle ground, budgeted at roughly 15 percent of pairs, gets escalated to Gemini. On the seeded estate, that showed up concretely: 124 candidate pairs led to 66 resolved deterministically and just one call to Gemini, a 0.8 percent residual, well under budget.
Fact resolution follows the same deterministic first philosophy. Instead of ServiceNow's static source precedence ranking, Provenance scores every fact as confidence multiplied by source weight multiplied by recency decay. That recency term catches something a fixed ranking cannot: a normally trusted source that has not seen a device in 400 days correctly loses to a less trusted source that saw it this morning, the ghost asset case.
The stack
FastAPI and Pydantic v2 throughout, async end to end. Gemini 3.7 Flash handles residual reasoning, and Gemini 3.1 Pro takes the escalated or contested pass. Firestore is the store, with an in memory backend so the whole suite, including the broker's tier policy, rollback mechanics, and segregation of duties checks, runs without a cloud project. Model Armor screens only untrusted content such as vendor emails, contract PDFs, and HR text, and explicitly refuses to scan structured API responses from Intune, Jamf, or Entra, so the fleet's busiest path never pays a latency tax it does not need. Every proposal gets one OpenTelemetry span, with the trace id written onto its ledger entry, so the reasoning behind a decision is part of the permanent audit record rather than something that lives only in logs.
The system deploys to Cloud Run, with a Cloud Scheduler job sweeping every 15 minutes to handle T1 rollbacks. 280 tests cover the model layer, the broker's tier policy, per agent write scoping, and segregation of duties enforcement at the API layer.
Devpost submission: https://devpost.com/software/provenance-governed-agentic-itam
Code: https://github.com/Naazimsnh02/Provenance
Demo video: https://youtu.be/iauc3yFp-Xs
Top comments (0)