An AI application pipeline you can audit

The problem

A study-abroad agency submitting students to Chinese universities fills in the same information over and over. Passport details, transcripts, family background, funding evidence. A different portal or paper form for every university, often in Chinese, on systems with no API to talk to.

The same agency works through a referral network of sub-agents, and needed to let a local recruiter add students without ever seeing the head agency’s book of business.

The extraction pipeline

This is the part I would point a technical buyer at.

It makes two Gemini calls, deliberately. I measured that a single grounded call with a JSON response schema silently stops running its searches. So the first pass researches with search grounding and answers in plain text. The second pass re-attaches the same documents in JSON mode at temperature zero and re-checks every spelling and number against the source rather than retyping it from memory.

Every filled value carries provenance. Six labels: generated, researched, default, copied, inferred, reconstructed. A human reviewing the form can see exactly which values came off a document and which the model worked out. This is the difference between an AI feature you can put in front of a compliance officer and one you cannot.

Documents are handled by type. PDFs and images go through the Files API, uploaded, polled until active, and deleted in a finally block. Office and text files are inlined. Papers that only need to be acknowledged, like a medical report, are named to the model but never uploaded, because there is no reason to pay to have a document read when you only need to know it exists.

Failure is designed. Three attempts, retrying only on transient errors and never on a bad request. A run is a tracked row, so it can be cancelled, and a cancelled run means a late worker writes nothing. Stale runs are swept on both the read and the write path. Values are written through the form’s own validator, so a value the form rejects is dropped and reported field by field instead of failing the whole run. The whole thing is reversible.

The permission model

Access control is one composable query predicate that combines a per-organisation access list with the member’s role scope, and rebases itself onto related models. That means an application can never drift out of sync with who is allowed to see the student it belongs to, because both are derived from the same expression rather than checked in two places.

Sub-agent workspaces nest to unlimited depth, with exclusive membership enforced at both the invitation and the acceptance step rather than only at one.

The delivery

The customer build shipped in nine days. Thirty-nine commits, 191 files, all mine.