Ledger Sleuth – Multi-Agent Forensic Audit System

Overview

Ledger Sleuth is a multi-agent forensic audit system developed by Hamza Ali and Kaml Mirza for Kaggle's AI Agents: Intensive Vibe Coding Capstone Project under the Agents for Business track.

The project explores how specialized AI agents can work together to investigate business sales data, identify abnormal behavior, generate follow-up queries, form evidence-backed hypotheses, and produce an executive-ready audit report.

Instead of acting as another static business intelligence dashboard, Ledger Sleuth is designed to actively investigate why an unusual business event occurred.

The Problem

Traditional dashboards are effective at showing what happened, but they generally stop there.

For example, a dashboard may reveal:

• A sudden decline in revenue
• An unusual increase in returns
• Unexpected changes in transaction volume
• Abnormal performance at a particular location

Finding the reason behind those changes typically requires an analyst to manually query databases, compare tables, test hypotheses, and interpret the results.

Ledger Sleuth was created to automate much of that investigative workflow using a coordinated system of specialized AI agents.

The Solution

A user can ask Ledger Sleuth a natural-language business question such as:

"Why did revenue drop in March?"

The system then performs an autonomous investigation that can:

1. Interpret the user's objective.
2. Build an investigation plan.
3. Generate SQL queries.
4. Retrieve relevant business data.
5. Detect statistical anomalies.
6. Investigate suspicious patterns across related data.
7. Develop a root-cause hypothesis.
8. Generate an executive audit report.

This transforms the interaction from passive dashboard exploration into an active forensic analysis workflow.

Multi-Agent Architecture

Ledger Sleuth uses a specialized five-agent workflow orchestrated with Google ADK 2.0.

Planner Agent

The Planner interprets the user's request and converts it into a structured execution plan.

Its role is to decide what information needs to be investigated before database queries are executed.

SQL Agent

The SQL Agent examines the available database schema and generates the queries required by the investigation plan.

Database access is intentionally constrained to read-only analysis.

Analytics Agent

The Analytics Agent performs statistical analysis directly in Python rather than relying on an LLM for numerical anomaly detection.

Techniques include:

• Z-score outlier detection
• IQR analysis
• Month-over-month trend analysis
• Variance and anomaly detection

This separation allows deterministic statistical operations to remain outside the language model.

Investigator Agent

When suspicious behavior is detected, the Investigator performs follow-up analysis.

It can cross-reference additional tables and request further database queries to gather evidence for potential root causes.

Report Agent

The final agent synthesizes findings from the investigation into a structured executive report.

Results are organized around business impact so that the output is useful for decision-making rather than being only a technical analysis trace.

Data Engineering

The project uses the public Kaggle Coffee Shop Sales dataset.

The source data was converted from CSV files into a relational SQLite database for structured querying.

To properly test forensic investigation scenarios, realistic synthetic anomalies were inserted into the data, including examples such as:

• Localized revenue drops
• Unexpected return spikes
• Shifts in transaction volumes

This allowed the multi-agent workflow to be tested against situations where meaningful abnormalities were intentionally present.

MCP Database Access

Ledger Sleuth uses the Model Context Protocol (MCP) as the database tool interface.

The database tool is deliberately restricted to read-only SELECT operations.

This creates a clear boundary between AI reasoning and database access while reducing the risk of agents modifying or destroying underlying data.

Security

Several safeguards were incorporated into the architecture:

• No API keys are hardcoded in the source code.
• Secrets are injected through environment variables and Google Cloud Secret Manager.
• Database access is restricted to read-only SELECT queries.
• SQL queries are parameterized.
• Direct user input is separated from the database execution layer.

These decisions were intended to make the agent workflow safer and more suitable for business-oriented applications.

Deployment

The application was containerized and deployed to Google Cloud Run.

The production system uses:

• FastAPI backend
• SQLite read-only database
• Google ADK 2.0
• Gemini 2.5 Flash through Vertex AI
• MCP tooling
• Google Cloud Secret Manager
• Cloud Run

Continuous deployment was also configured through GitHub so changes pushed to the main branch could trigger a new Cloud Run build and deployment.

Team

Ledger Sleuth was developed as a collaborative Kaggle capstone project.

• Hamza Ali — Lead Developer & AI Engineer
• Kaml Mirza — Project collaborator, contributing ideas, feedback, and suggestions during development

I led the technical implementation, including the multi-agent architecture, backend integration, database workflow, deployment, and overall system development.

What I Learned

Ledger Sleuth gave me practical experience building agentic systems beyond a simple chatbot or single LLM call.

The project involved designing agent responsibilities, coordinating multi-step workflows, integrating structured database tools through MCP, separating deterministic analytics from LLM reasoning, handling security constraints, and deploying the complete system to Google Cloud Run.

It also demonstrated how agent-based architectures can be applied to business analysis problems where the next analytical step depends dynamically on the results of the previous one.