rotascale
Sign in See it live

Solutions — sector

Three regimes, one agent, one afternoon.

The sector where an agent's actions move money, where three supervisors can have a view of the same workload, and where the question after an incident is not what the model scored but who authorised the transfer.

EU AI Act · SR 11-7 · MAS FEAT · DORA Multiple, simultaneously clause map
Status
The common case, not the edge case
Applies to
Banks, payments, capital markets

What a refusal looks like here

trj_01KZKKCVZP settlement-bot · prod refused
Requested
settle_payment · 600,000.00 EUR
Authority
grt_01KZKKBQ82 · delegated, depth 2
Refused at
gate 8 · budget
Because
ancestor grant exhausted

The interesting part is ancestor. An orchestrator delegated to a specialist, the specialist stayed inside its own ceiling, and the tree had not. Spending against a child debits every ancestor, so a delegation tree cannot sum to more than its root — which is the property that makes multi-agent workflows bounded rather than multiplicative.

Why one enum will not do

A Singapore bank with European customers is under PDPA and GDPR and the AI Act simultaneously, possibly on a Canadian host. The market profile resolves per decision — narrowest wins — and is sealed into the record, so a pack states which laws the deployment believed applied at the moment the decision was made.

Model risk, with a real inventory

SR 11-7 wants a model inventory. The column that matters is whether the entry was observed from a runtime or typed into a form by a person.

observed →

Maker-checker where the regime asks

Authority above the threshold the regime sets is issued pending and does nothing until a second named person signs it.

observed →

The clock, when it starts

Article 73 counts from awareness. A provider who learns of an incident weeks later has a deadline from that day, not from the event.

observed →

The agents your teams are about to ship

None of these is a pilot. Each is an agent a bank is scoping now, and each turns on one action that a named person has to be able to defend to a supervisor eighteen months later.

  1. 1 authority Is there any authority for this?
  2. 2 status Is the grant active?
  3. 3 window Is now inside the grant's window?
  4. 4 scope Does the grant cover this action?
  5. 5 clean_context Was the context clean, where that is required?
  6. 6 bounds Do the per-action limits hold?
  7. 7 policy Does the policy on the grant permit it?
  8. 8 budget Is there room under the ceiling?
  9. 9 review Does this need a person?
Nine gates, evaluated in this order before the action. The lit ones are the gates that hold the four agents below — which is what differs between one industry and the next. The order does not.

One of these is already running, and here is what it recorded

invoice-triage:INV-2206:p2 invoice-triage · prod · approve_payment exhausted
  1. authoritypassed
  2. statuspassed
  3. windowpassed
  4. scopepassed
  5. contextpassed
  6. boundspassed
  7. policypassed
  8. budgetrefused
  9. reviewnot reached

The call allowance on the grant was spent. Exhausted is a different outcome from deny on purpose: the action was permitted, there was simply no room left — so retrying cannot help, and the agent is told that rather than being left to loop.

Both of this agent's retrieval sources are marked unverified in the record — the accounts-payable document it was asked about, and a LangChain supplier index it consulted at step 1. observed →

Treasury liquidity agent budget

Watches intraday positions across nostro accounts and moves funds to cover shortfalls before the cut-off, without waiting for a human to notice.

Consequential action
Initiates a payment instruction on a settlement rail
What goes wrong
It is correct nine hundred times and then funds a counterparty during a name crisis, because nothing capped what the whole day could move.
What is recorded
Every instruction with the grant it drew on, the remaining ceiling at the moment of the call, and the refusal when the ceiling ran out.
Credit decisioning assistant authority

Assembles the file, runs the scorecard, and drafts the adverse-action reasoning for a lender who signs it.

Consequential action
Declines an application, or approves one inside a limit
What goes wrong
Annex III makes creditworthiness high-risk. If nobody can say which human authorised the model version behind a decline, the decline is indefensible.
What is recorded
Which accountable human signed the grant, which model version was in the inventory, and what the applicant was told.
AML alert triage clean_context

Reads case files and transaction narratives, clears the obvious false positives, and escalates the rest with a summary.

Consequential action
Closes an alert without human review
What goes wrong
It reads an attacker-authored payment reference and treats the instruction inside it as guidance. A closed alert is the one nobody looks at again.
What is recorded
Which retrieved content was untrusted, at which step it entered, and whether the decision after it was allowed to stand.
Model risk documentation agent scope

Keeps SR 11-7 documentation current as models change, rather than reconstructing it the month before an exam.

Consequential action
Writes to the model inventory of record
What goes wrong
An agent with write access to the inventory can quietly make the inventory agree with reality instead of the other way round.
What is recorded
Every write, what it changed, and the authority that permitted it.

Ambition is the point of these: none of them is a chatbot. Each is an agent taking an action with a consequence somebody has to answer for — which is exactly the moment a bounded authority stops being paperwork and starts being the reason the project is allowed to ship.

What your examiner will ask

Not hypothetical questions. These are the ones that arrive in writing, with a deadline, and the honest answer to most of them is a query rather than a project.

Which models are in production, and who owns each one?
The agent inventory is the answer, and it is a query rather than a spreadsheet somebody maintains. Where an agent has no named owner the readiness screen says so, and names it as a gap rather than scoring around it.
Show me the decisions this model made last quarter, and the ones it refused.
Refusals are recorded with the same weight as allowances — an agent that was stopped 40 times is evidence the control works, and it is the half most systems never keep.
How do you know the control was on?
Enforcement is a mode on the grant — observe, shadow, canary, enforce — and it is sealed into each record. A pack states the mode at the moment of the decision, not the mode configured today.
What happens when the control plane is unreachable?
Capture fails open and enforcement fails closed: a recording problem must not cause an outage, an unreachable control plane must not silently permit an ungoverned action. Firms that cannot accept that set a flag and own it explicitly.

Identifiers this deployment verifies here

Every one of these is a checksum, not a shape. The claim is “this is a valid IBAN and the check digits agree”, not “this looks like one” — which is why the count on a screen can be cited rather than caveated.

FamilyHow it is verified
Bank account (IBAN) — mod-97 over the rearranged string
US bank routing number — ABA weighted checksum
US Employer Identification Number — issued prefix set
EU VAT number — per-state check digit where the state publishes one
US Social Security Number — structural rules only — asserted, not observed
National identifier (PL, BE, NO) — scheme-specific weighted checksum

And what it does not look for. Names, addresses and dates of birth in free text carry no checksum, and finding them needs a model this deployment does not run. Neither are card numbers, medical record numbers, or national schemes beyond the three above. A clean screen means no verified identifier was found — never that the payload holds no personal data.

Written for this sector

21 posts touch this sector — the five most recent are above.

See it on your own problem

Bring the agent your first line is most nervous about — the treasury mover, the credit assistant, the alert triage. We will put it behind a grant, run it until it refuses, and show you the record your examiner would be handed.

A walkthrough is a working deployment with your model risk and first-line teams in the room, not a slide deck — bring the agent you are most nervous about and we will put it behind a grant while you watch. If you would rather look first, the demo needs a work address and one click.

Financial services walkthrough See the live demoOr talk to sales →