An end-to-end AI branch-audit platform for a 64-branch LATAM retail chain — photographic evidence in, Gemini Vision scoring out, a 6-workflow orchestration state machine in between, and a real nationwide campaign running on top of it.
A 64-branch LATAM retail chain audits every branch, every cycle, across 12 operational areas — storefront condition, service bays, waiting areas, storage, signage, waste handling, and more. The legacy process was paper: an auditor visits, walks the checklist, writes down scores, and the results eventually surface in a spreadsheet.
That process failed in three ways. It was slow — a full national cycle took weeks to consolidate, and by the time leadership saw a low score, the condition that caused it was a month old. It was gameable — a branch that knew the audit date could stage the location for a morning and revert by lunch, and a self-reported score carried no evidence at all. And it was unverifiable — there was no photographic trail, no timestamp, no way to distinguish a genuinely compliant branch from a well-filled form.
The mandate was to replace the entire loop: evidence-based submissions from every branch, machine scoring with a consistent rubric, supervisors watching results in real time — and a system honest enough that a photo taken last week, or a photo borrowed from another branch, gets caught.
Branch managers submit photo and video evidence through a hardened upload form. From there, nothing is manual: a 6-workflow orchestration state machine dispatches audits, scores evidence with Gemini Vision, chases stragglers, reports to zone supervisors, and closes the cycle.
The scoring engine is Gemini Vision, prompted and evaluated entirely in Spanish — the language the field evidence, criteria, and supervisors actually use. Each of the 12 audit areas carries a weighted rubric; the model receives the branch's photographic evidence per area and returns a structured score with written justification, in under 60 seconds per submission.
An AI grader that can be fooled — or that invents what it sees — is worse than no grader. So the intake path is wrapped in seven fraud-detection layers and ten anti-hallucination safeguards. On the fraud side: EXIF metadata validation rejects screenshots, crops, and downloads that carry no camera signature; timestamp freshness checks reject media captured outside the submission window; SHA-256 hashing deduplicates evidence across areas, branches, and cycles — the same photo submitted twice, anywhere, gets flagged. On the AI side: structured output contracts, per-area grounding to the supplied evidence only, score-range clamping, and justification checks that force the model to cite what is visible rather than what is plausible.
Supervisors never touch any of this machinery. They see a React dashboard behind Keycloak SSO with zone-scoped RBAC — a zone supervisor sees exactly their branches; the operations lead sees the national command center, live fraud alerts, cycle analytics, and per-area score evolution.
The platform passed QA. Then it met 64 real branches uploading real evidence on real deadlines — and production immediately taught three lessons. Each one was found in live telemetry, root-caused, fixed, and verified against the running campaign.
One branch submitted a 330 MB evidence payload — a perfectly legitimate set of high-resolution photos and videos. The scoring workflow hit a silent 5-minute execution timeout at exactly 300,011 ms: no error surfaced, the run died mid-flight, and the branch was mis-scored as non-compliant. QA never caught it because QA payloads were small. The fix was structural, not a bigger timeout: the payload path was restructured so heavy media never rides through the workflow execution itself — evidence stays in object storage and the workflow moves references, not bytes. The same submission that died at 300,011 ms completed in 9,012 ms. A 33× reduction, and no payload size can silently kill a score again.
The zone-report workflow assembles each supervisor's cycle digest. Under production retry conditions it could fire repeatedly for the same cycle — the math worked out to roughly 10× duplicate report emails landing in supervisors' inboxes, which would have destroyed trust in the platform in its first week. The fix is a once-per-cycle idempotency guard: before dispatching, the workflow checks a persisted marker for the cycle and skips if the report has already gone out. The guard was verified armed against the live system — re-triggering the workflow on a completed cycle now short-circuits cleanly instead of re-mailing 14 zones.
The audit lifecycle fired its OVERDUE transition while the cycle was still open. A branch that submitted late — but within the cycle — had already been flipped to overdue, and its legitimate, AI-scored submission was hidden behind a failure state. That is a state-machine design bug, not a data bug: "late" and "overdue" are different facts. The fix draws the line where operations actually draws it — overdue is only asserted at cycle end plus a grace window, and a late submission keeps its AI score with a late flag rather than being swallowed by a terminal state. Supervisors now see the true picture: who complied, who complied late, and who never showed up.
In June 2026 the platform went live with a real national audit campaign — rolled out in three phases so each wave of branches onboarded against a system already hardened by the previous one. Supervisors watched submissions, scores, and fraud alerts arrive in real time.
Under the paper process, a national cycle took weeks to consolidate and the results were self-reported. Now a branch manager submits evidence and the AI verdict lands in under 60 seconds — scored against the same weighted 12-area rubric for all 64 branches, with the photographic evidence attached to every score. Zone supervisors see their branches move from pending to completed on a live board instead of waiting for a spreadsheet. The audit stopped being a retrospective report and became an operational control loop.
EXIF validation, timestamp freshness checks, and SHA-256 deduplication run on every submission. A screenshot, a stale photo, or an image borrowed from another branch is flagged before it ever reaches the scoring model — and surfaces in the fraud center with the reason attached.
Every branch is graded by the same model, the same Spanish-language rubric, and the same area weights. Scores are comparable across branches, zones, and cycles — which makes the cycle-over-cycle analytics meaningful instead of anecdotal.
Keycloak authentication with zone-scoped RBAC means each of the 14 zone supervisors sees exactly their territory — live status, scores, and alerts — while national leadership gets the full command center. No shared spreadsheets, no emailed exports.
Dispatch, reminders, reports, close-out, and reset all fire from the 6-workflow state machine on the cycle cadence configured in the dashboard. Changing the audit frequency or score thresholds is a settings change, not an engineering ticket.
I build AI platforms that don't stop at the demo — I take them through live campaigns, harden them against what production reveals, and stand behind the delivery.
Let's Work TogetherThe supervisor-facing dashboard running the live nationwide campaign — command center, analytics, criteria engine, fraud detection, and system configuration.
COMMAND CENTER — LIVE CAMPAIGN VIEW
ANALYTICS — CYCLE-OVER-CYCLE SCORING
CRITERIA ENGINE — 12 WEIGHTED AUDIT AREAS
FRAUD CENTER — DEDUP + DEVICE DISTRIBUTION
SYSTEM CONFIG — CYCLE CADENCE + SCORE THRESHOLDS