{"slug": "muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less", "title": "MUSTER: Building Safer Enterprise AI Agents That Ask Less and Retry Less", "summary": "A developer built MUSTER, a framework for safer enterprise AI agents that minimizes data requests and retries. The system uses a control plane where models interpret evidence but sources attest to facts, and deterministic authorization decides actions. It also handles uncertain outcomes after irreversible actions by checking what happened before retrying. The developer demonstrated the framework in a Google Cloud deployment using Gemini and Gemma 4.", "body_md": "AI agents are getting good enough to do real work inside companies.\n\nThey can read documents, understand images, call tools, make decisions, and trigger actions.\n\nBut once an agent is allowed to do something important, two problems become dangerous very quickly:\n\nI built MUSTER to explore those two problems.\n\nThe basic idea is simple:\n\n**Before acting, ask only for evidence that can still change the result.**\n\n**After acting, if the result is uncertain, check what happened before trying again.**\n\nImagine an employee named Ravi says his Saturday pay is wrong.\n\nTo resolve the case, different systems hold different pieces of information.\n\nThe payroll system knows whether Ravi was scheduled.\n\nThe site system knows whether he was present and how long he was on site.\n\nA simple AI-agent architecture could give one central agent access to all of those systems.\n\nI did not want MUSTER to work that way.\n\nInstead, each source keeps control of its own evidence.\n\nThe payroll agent works with payroll data.\n\nThe site agent works with site-access evidence.\n\nThe central MUSTER Control Plane does not get blanket access to the raw source data.\n\nIn the Google Cloud deployment, this boundary is enforced with IAM. The Site Agent can read its protected Cloud Storage evidence, while the tested central Control Plane identity receives an actual access denial.\n\nThe Site Agent can send the needed evidence content to Gemini for interpretation. After that, only validated and signed narrow facts are returned to MUSTER.\n\nSo the model can help interpret evidence, but interpretation alone does not give it authority.\n\nThe way I think about it is:\n\n**Models interpret. Sources attest. Deterministic MUSTER authorizes.**\n\nSuppose Gemini interprets a site attendance image and a gate log.\n\nThat model output does not automatically become truth inside MUSTER.\n\nThe source first validates the candidate observation and signs the resulting attestation.\n\nMUSTER then checks whether that source is actually allowed to attest that type of fact.\n\nFor example:\n\nRavi saying, \"I was there,\" is different.\n\nHis own claim can enter the case, but it has no institutional authority.\n\nIn the demo, I use Gemma 4 for this low-trust worker claim intake.\n\nThe claim can help start the process, but it cannot authorize the final action.\n\nThis is the part of MUSTER I found most interesting while building it.\n\nThe payroll policy requires Ravi to have worked at least 240 minutes.\n\nThe admitted site evidence establishes that his on-site duration was at least 508 minutes.\n\nAt this point, MUSTER still does not have an exact duration value.\n\nA normal workflow might keep asking for more evidence until every unknown is resolved.\n\nBut while working on this case, I started asking a different question:\n\n**Can any remaining uncertainty still change the action?**\n\nFor Ravi's case, the answer is no.\n\nEvery remaining possible duration that matches the admitted evidence leads to the same result.\n\nSo MUSTER does not need to collect the exact duration just for completeness.\n\nThe result is:\n\n**PAY RAVI INR 5,100.00**\n\nThis is the corrected weekly payroll instruction for the worked example.\n\nMUSTER is not claiming that it independently proved Ravi worked.\n\nIt is saying that under the pinned policy and the authorized facts admitted into the case, the consequence is now the same across the remaining possibilities.\n\nIn simpler words:\n\n**If more private data cannot change the result, stop asking for it.**\n\nEvidence is only half the problem.\n\nThe other problem appears after an agent decides to do something irreversible.\n\nImagine MUSTER sends an external payment-like sandbox action.\n\nThe external system accepts it.\n\nBut before MUSTER receives the answer, the response is lost.\n\nNow the system has a dangerous question:\n\n**Did the action happen or not?**\n\nThis was one of the parts I spent the most time thinking about.\n\nRetrying feels like the natural thing to do.\n\nBut if the first request actually succeeded, the retry itself can create the problem.\n\nSo MUSTER records this situation as **UNCERTAIN**.\n\nIt does not pretend to know what happened.\n\nIn the verified Google Cloud sandbox proof, the sequence is:\n\nNo real funds are involved. This is a sandbox proof.\n\nThe important idea is:\n\n**MUSTER does not retry an irreversible action just because it lost the answer.**\n\nIt checks first.\n\nOr more simply:\n\n**Reconcile — don't retry.**\n\nLLMs are very useful in MUSTER, but I deliberately do not let them make the final authorization decision.\n\nGemini and Gemma help with interpretation.\n\nBut once structured evidence reaches the decision boundary, MUSTER uses deterministic code for things such as:\n\nThis separation lets the models do what they are good at without making the model the final authority.\n\nThe architecture can be summarized simply:\n\n**Models interpret → sources attest → deterministic controls authorize.**\n\nMUSTER uses Google technologies across the agent and cloud layers.\n\nThe project includes:\n\nThe hosted judge experience is a read-only verified replay, not live telemetry.\n\nThat replay exists so the important cloud proofs can be inspected reliably, including the IAM isolation and the uncertain-action reconciliation sequence.\n\nThe project also includes a live local agent path for the worked Ravi case.\n\nThe biggest lesson for me was that making safer AI agents is not only about making the model smarter or more accurate.\n\nSome of the important problems have to be solved around the model.\n\nWhen I first started building MUSTER, I was mostly thinking about authorization.\n\nBut while working through the Ravi case, I noticed another question:\n\nWhy should the system keep collecting evidence after that evidence can no longer change the result?\n\nThe same thing happened with execution retries.\n\nAt first, retrying an action after a timeout sounds reasonable.\n\nBut if the first request already succeeded, retrying is exactly what can create a duplicate action.\n\nThat led to the two ideas at the center of MUSTER.\n\n**Ask only for evidence that can still change the consequence.**\n\n**If the result is uncertain, reconcile before retrying.**\n\nI think these ideas can apply beyond payroll too.\n\nThey can be useful in procurement, approvals, financial operations, compliance workflows, and other enterprise agent systems where sensitive evidence is distributed across different institutions.\n\nGitHub:\n\n[https://github.com/satish9177/muster](https://github.com/satish9177/muster)\n\nHosted Google Cloud replay:\n\n[https://muster-judge-replay-867434431401.asia-south1.run.app](https://muster-judge-replay-867434431401.asia-south1.run.app)\n\n**I created this article for the purpose of entering MUSTER in the Google All Things Agentic Hackathon.**", "url": "https://wpnews.pro/news/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less", "canonical_source": "https://dev.to/satish_9177/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less-2m0f", "published_at": "2026-08-31 14:06:47+00:00", "updated_at": "2026-08-31 14:23:12.114690+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "ai-research"], "entities": ["MUSTER", "Google Cloud", "Gemini", "Gemma 4", "Ravi"], "alternates": {"html": "https://wpnews.pro/news/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less", "markdown": "https://wpnews.pro/news/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less.md", "text": "https://wpnews.pro/news/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less.txt", "jsonld": "https://wpnews.pro/news/muster-building-safer-enterprise-ai-agents-that-ask-less-and-retry-less.jsonld"}}