Assembling frontier technology into an auditable bank agent platform

Every model call is routed through the inference layer and every tool call goes through the tool gateway — otherwise cost, permissions and the audit trail all slip out of control.

This is how read–write asymmetry is built into the architecture (C10), and it gives the audit trail a single anchor.

Candidates are filtered by the relationship manager’s permissions and data classification tags, not masked after generation (see C5).

Security guardrails and the approval center take priority over business logic, and every interception is itself recorded.

Generated centrally by the channel (a sufficiently long UUID is recommended), bound to customer, channel and employee numbers and passed end to end as the primary key for observability and audit.

Code-execution and browser sandboxes must have outbound access disabled or go through an allow-listed proxy; shell, file-system, browser and email tools must never share one unconstrained flow (C16).

Three kinds of break point — waiting for approval, external-interface timeouts and crossing a business day — must be checkpointed; on resume, check whether someone else has changed the business state.

Plan capacity from peak traffic and concurrency limits; when the ceiling is hit, protect customer-facing channels first and queue internal batch work automatically.

Isolation granularity, session lifetime and idle timeout decide how a process is split — design the business steps around these three from the start instead of bending them at implementation time.

Is there a dedicated microVM per session? Are memory and files wiped when a session ends? Are maximum lifetime and idle timeout configurable? How is session affinity achieved? What are the concurrency and new-session rate limits?

Compress once context utilization reaches about 70%, rather than being truncated passively near the limit.

Session history 3:1–5:1; tool output 10:1–20:1; clear already-consumed tool results first (the safest lightweight form).

The compliance red-line zone, the current task goal, the open-issues list and the granted authorization scope are never compressed.

Every compression records an event marker, token counts before and after, and a summary of what was dropped, feeding observability and audit (see hard judgment six: compression erases safety constraints).

If each application assembles its own context, red lines get left out, cache prefixes diverge and compression cannot be audited — any one of these is a production-incident-level failure.

Export every memory entry for a customer number with its source session, creation time and method; provide a customer-readable view.

A deletion request cascades from original records → derived summaries → vector index → graph nodes → caches; where the vector index cannot prove deletion, fall back on “logical invalidation + retrieval masking + scheduled rebuilds” and issue a deletion certificate.

Every memory carries a provenance chain (source session, tool, original record ID, generating model version); memories without provenance may not enter the decision path.

Check source credibility on every write; mark external content as untrusted so it cannot drive decisions directly; run regular poisoning checks (a handful of malicious documents can noticeably contaminate retrieval).

Use the namespace directly as an authorization condition, so the identity system — not application code — decides who may read or write which memories. This is what lets multi-tenant isolation pass an audit.

If you retrieve everything and mask at generation time, the model has already “seen” content it should not, and its reasoning and wording may leak it — after-the-fact masking is false security.

Supervisory inspections, credit-committee questioning and complaint handling all need to trace back to the original basis. In a bank, a conclusion without a source is no conclusion.

When a conclusion is wrong, you must tell “the material was not found” apart from “it was found but misused” — the fixes go in completely different directions.

A change to a policy clause must trigger targeted rebuilds of the related vectors and graph, and frequently cited clauses get version checks so agents do not keep citing repealed rules.

The gateway must never forward an upstream token to a downstream system as is; it must exchange it and bind it to an audience, or the permission boundary means nothing.

A tool description is part of the model’s behavior — change the description and you change the behavior. This is the most overlooked attack surface (see the C16 incident list).

Applications may not bypass the gateway to reach business systems; bypassing it means no rate limits, no audit trail and no tiered control.

The approval level is tool metadata enforced by the gateway, not left to the prompt — prompts can be bypassed, metadata cannot.

Agents receive least-privilege permissions by role; when a role changes, the old permissions must be removed from running instances immediately so that permissions do not pile up.

Each time an agent is allowed one more level of action (for example from Notify to Approve, then to Dual control), three documents are required: a pass^k report that meets the bar, shadow-run comparison results and a red-team report.

The first line embeds guardrails and approval gates in the business process; the second runs red-team exercises, the policy engine and risk measurement; the third checks the completeness of behavior logs and the effectiveness of controls — agent security is not a new system, it is a new subject for the existing one.

Adding instrumentation after go-live means history cannot be traced; design the trace structure and audit fields together, once.

Raw prompts and outputs are sensitive; they need their own compliance switch and masking — observability does not mean keeping every original text.

Inspections and complaint handling need to reconstruct what the agent saw, what it relied on and who approved it — not just the outcome.

NFRA guidance Jinfa [2026] No. 8 requires a complete record of the input, decision basis and result of every agent tool call; the Measures for Labeling AI-Generated and Synthetic Content (effective 2025-09-01) require explicit and implicit labels on generated content released externally — both must be built into the instrumentation design, not patched in after launch.

If a supervisor asks “why did the agent decide this case this way?”, can you reconstruct within five minutes the material it saw, the rules it applied and the approvals it went through? If yes, it passes; if not, it cannot go into production.

With 100 samples and an 80% pass rate, the confidence interval is roughly 72%–88% — a small set cannot support a claim of “a few points better”.

A paired design (the same samples before and after) cuts the sample requirement by about an order of magnitude.

Report by query type so the overall number cannot hide a sharp deterioration in one kind of scenario.

The evaluation set is an asset as important as code — built per scenario, versioned, owned by named people, and re-run as a mandatory regression after every model or harness change.

An agent’s behavior is jointly determined by the model, harness, prompts, tools and knowledge — change any one and you have a different system. That is why every “must re-test” change has to pass offline evaluation and a shadow run before staged rollout.

Human corrections and rejection reasons must be captured as structured tags, not free-text notes. This single choice decides whether continuous improvement is data-driven or gut-driven.

① Low confidence or unclear intent → hand over to a human agent, counted in the human-escalation rate; ② high-risk product recommendations → mandatory human handover, the agent may not perform suitability matching; ③ external output → explicit and implicit AI-generated-content labels as required.

① The session ID runs through the whole chain as the audit key; ② every model call records tokens and cache reads for costing; ③ every tool call records its call ID and downstream receipt; ④ compression events are tagged separately to diagnose “the rule got summarized away” problems.

The gold cells are not there to slow things down — they are what lets this chain go into production and pass an audit.

Let the relationship manager approve “what to check and how deep” once before execution — far cheaper than rework afterwards.

The five sub-agents only read; one writer produces the report, so the audit trail has a single anchor.

Cross-validation is valuable because it exposes disagreements; the reviewer keeps the power to decide.

Credit approval is the highest risk level; the agent supplies only the basis and the draft.

Due diligence must combine on-site and off-site work and produce a written report; loan origination and review are separated with tiered approval; key points of high-risk applications need human oversight — these three requirements land on plan confirmation, the single writer and final sign-off, in line with the Measures for the Administration of Working Capital Loans (NFRA Order No. 2 of 2024) and NFRA guidance Jinfa [2026] No. 8.