How to read Concordat

Three rival banks are hunting one fraud ring together. None of them can see the others' customers, and none of them ever will — that constraint is the whole point, not a limitation of the demo.

This page explains what you are looking at, what every term means, and what to click. Five minutes here makes the dashboard read as a story rather than a wall of panels.

The problem, in one paragraph

A mule network moves stolen money through many accounts at many banks, precisely because no single bank can see the whole trail. Each one watches money arrive, move once or twice, and leave. Privacy law forbids them from pooling raw customer records to assemble the rest, so the rings that cross institutions are the ones that get away.

The industry's usual answer is to ship everyone's data to one central provider. That is the arrangement privacy teams resist hardest, and reasonably: it replaces many small risks with one very large one.

Concordat tries a third thing. Each bank runs its own fleet of AI agents inside its own walls. When a trace dies at the boundary, the fleet does not give up and does not hand over data. It negotiates — agreeing terms under which a joint answer can be computed without either side seeing the other's records.

Who the players are

Three invented banks. Nothing here is a real institution and no data is real.

Bank Alpha

Where the victim banks. Alpha receives the fraud report and starts every investigation, so it is the initiator. The money leaves Alpha almost immediately.

Bank Meridian

The next stop for the money, and the strict one. Its policy demands the largest group size and the shortest agreement — which is why it forces the counter-offer you see in every negotiation.

Bank Union

Holds the cash-out end of the trail, where the money is finally withdrawn. Its policy is looser than Meridian's, so it rarely sets the final terms.

Neutral ground

A fourth Google Cloud project holding only shared, public things: the directory of which fleets exist, this dashboard, and the temporary rooms. It holds no bank's ledger and runs no bank's code.

Each bank is a genuinely separate Google Cloud project with its own identity and its own data. That is not decoration: it means one bank reaching for another's records is refused by Google, not by our code. There is nothing to trust us about.

What happens in an investigation

A report arrives
Usually a customer's voice note — nobody reports fraud by filling in a form. The fleet listens and pulls out the account, the amount, and the date the caller meant when they said "the twelfth".
Alpha traces alone, and fails
It follows the money through its own ledger, lowering its own thresholds when a hop comes back empty, until every remaining path leaves the bank. That wall is the point of the whole project.
It opens negotiations
Alpha proposes terms. Each peer's policy engine answers — accept, counter, or refuse. Alpha concedes to the strictest terms on the table and all three sign.
The agreement becomes infrastructure
The signed terms compile into a temporary clean room. Each bank publishes totals over its own accounts, under the agreed privacy threshold. Nobody sees anybody's rows.
A human decides
Nothing is enforced until a person approves. Then each bank acts only inside its own walls: Alpha freezes Alpha's accounts and files its own report.
The room dissolves
Each bank revokes its own contribution. Only the audit trail survives.

Reading the dashboard

The chips under “Cases”

Every chip is one complete investigation. Click any of them to follow it. They all chase the same planted ring, so the numbers repeat — what differs is how each case got there and how far it has gone.

The strip under the case id

What actually ran on this case, read from its own audit trail. If a line is not in the record, the strip does not claim it happened — which is why older cases honestly show fewer layers than recent ones.

Label	Means
`INTAKE`	How the case arrived — a voice note the fleet listened to, or typed text.
`MEMORY BANK`	What the fleet remembered from earlier cases before it started, and what it kept afterwards. Only group totals are ever stored, never a person.
`PERIMETER GATE`	Which checks ran on text leaving the bank. `rules` are fixed patterns, `gemma` is a small model running inside the bank's own container, `armor` is Google's detector. Each can only tighten, never loosen.
`DISCOVERY`	How Alpha found its counterparts — a registry of which fleets exist, then a direct connection, bank to bank.
`AGREEMENT`	The agreed group size and how long the permission lasts. When it expires, enforcement is refused until the banks renegotiate.

The three bank panels

One per institution. Alpha shows what it found in its own ledger. Meridian and Union show what they disclosed — totals computed under the agreed threshold. The line “we never saw a row” is literal: the initiator receives sums and counts, never records.

The negotiation

The actual messages between the banks, in order. Read the arrows: → is Alpha asking, ← is a peer answering.

→ meridian  investigation_request  round 1 · k=10 ttl=72h   Alpha's opening ask
← meridian  counter_proposal       k=25 ttl=48h          too loose — Meridian counters
← union     counter_proposal       k=15 ttl=72h          Union wants 15
→ meridian  investigation_request  round 2 · k=25 ttl=48h   Alpha concedes to the strictest
← meridian  policy_verdict         accept
← union     policy_verdict         accept
→ union     concordat_signed       all three countersign

The thing worth noticing: the verdicts come from deterministic code reading each bank's own policy file — never from a model. No phrasing of a request can talk a policy round, which is the only arrangement a bank's risk committee would ever accept.

The money flow picture

The victim on the left, then each bank's mule accounts, then the cash-out point on the right. The dotted vertical bars are the institutional boundaries. Lines crossing them are inferences agreed under the concordat, not records that moved: no account number ever crossed those bars.

The audit trail

Every action, with which agent took it. It is append-only and it is the only thing that outlives the clean room. Collapsed by default because it is long — open it if you want to check that the story above matches what actually happened.

What you can do

The dashboard is public and read-only except for one button, which is deliberate: the approval gate exists to prove a human decided, so you should be able to be that human.

Open a case marked awaiting_approval, scroll to Joint finding, and press Approve enforcement. The case moves to enforcing, then closed. Alpha freezes its own accounts, opens a reimbursement claim for the victim, and files a report with the regulator — and never learns the name of a single Meridian customer.

Two honest caveats. Approving is one-way: a closed case cannot return to the gate. And if the case's agreement has expired, the gate will refuse you on purpose — the finding is still true, but the permission to act on it has lapsed. The strip tells you which is which before you click.

Glossary

Concordat: An agreement between parties who do not share a jurisdiction. Here: the signed terms under which banks will jointly compute one answer. It names who is party to it, the minimum group size, how long it lasts, and exactly which computations are permitted.
k · group-size threshold: An answer is only returned if at least k customers fall into the group, so no individual can be singled out. The banks negotiate this number; here they settle at 25. It has a real cost: a ring smaller than k stays hidden, even from the banks that agreed to look for it.
ttl · time to live: How long the agreement, and the room built from it, remain valid. After that the permission lapses and enforcement is refused until the parties renegotiate.
Clean room: A temporary shared dataset built from the signed terms. Each bank's contribution carries a privacy policy, so a query for an individual row is refused by BigQuery itself. That refusal is not our code being careful — a bug in our code could not lift it.
Perimeter · boundary edge: A perimeter is everything one bank owns: its data, its agents, its identity. A boundary edge is a transaction where the money left that perimeter — the exact point a solo investigation goes blind.
Salted hash: Account numbers never cross a boundary. They are scrambled with a secret unique to each case, so peers can tell whether they are looking at the same account without either side learning who it is — and the scrambling is worthless outside that one case.
Diplomat, tracer, policy engine: The agents inside each fleet. The tracer follows money in its own ledger; the diplomat talks to other banks; the policy engine decides what may be agreed to. Only the first two use a language model.
A2A: The open protocol the fleets use to talk to each other. Each bank publishes an agent card describing what it can do, and messages go directly between banks with nothing in the middle.

Check it yourself

The central claim is that a bank physically cannot read a peer's ledger. That is not a promise in a document — it is enforced by Google, across account boundaries, and you can watch it fail:

sa-bank-alpha → its own ledger     : 3,743,998 rows
sa-bank-alpha → meridian's ledger  : 403 Access Denied
sa-bank-alpha → union's ledger     : 403 Access Denied

Inside a single project, all anyone can show you is that they chose not to grant access. Across separate projects, the access does not exist to grant.

All transaction data here is synthetic, generated from a fixed seed with a fraud ring planted inside it. No real customer, account or transaction appears anywhere in this system.

← Back to mission control