The agent that refuses to guess

I work at a B2B telecom consultancy. I'm not the one auditing the bills, but every month I watch how it's done: open the invoice PDF, check every line against the signed contract, compare it with what the account used in earlier cycles, and write up whatever doesn't add up. It's slow, it doesn't scale, and it's the first task dropped when the month gets busy — which is exactly when the money leaks. And outside a consultancy it's worse: most companies just pay the bill because it arrived. So I built an agent that does the whole job. One invoice PDF in; a dispute letter for the carrier and an executive summary for the customer out, with nobody in the loop. It runs on Gemini 3.5 Flash and the Google ADK, on Cloud Run and Firestore, and it's open source: github.com/Bren0-lz/invoice-sentinel . This post is about the one decision that shaped everything else, and about the four defects that only showed up when I stopped reading my own code and started attacking the running service. The decision: no money figure ever comes out of the LLM An agent that writes a dispute letter is writing a document addressed to a third party and signed by the customer. If a figure in it is invented, the customer doesn't lose a feature — they lose credibility with their own supplier, and they lose it in writing. So the rule is absolute, and it isn't a line in a prompt. It's enforced in three layers, each of which would have to fail independently: Structurally. The rule engine is pure Python with Decimal . No module under rules/ imports an LLM client. Five rules across three families, running concurrently under a ParallelAgent . In the tool signatures. No auditor tool accepts a monetary value as an argument. flag_anomaly(finding_id, rationale) cannot be talked into disputing four thousand reais that nobody computed, because there is no parameter to put it in. A test asserts this with inspect.signature , so the guarantee survives someone adding a tool later. In the generated prose. amount_guard