Finance Risk Agent: Evidence Assembly, Adversarial Review, and Model Risk Management

Enterprise Agent Mesh · Engineering Guide 06 / 12

A Finance Risk Agent assembles evidence, explains calculations and challenges the explanation before a human makes a decision. It is not a quantitative engine, a dealer or an autonomous treasury function.

Source: Article 6 of The Enterprise Agent Mesh — Building Twelve Production AI Agents on Claude Code, September 2026, physical pages 125–145. This web edition preserves the chapter’s twelve-section structure. Explicitly labelled web-edition qualifications distinguish current documentation checks and implementation hardening from the handbook. Reference deployment figures and policy thresholds are illustrative, not verified Infinity client results or universal operating limits. The cover is shared agent-platform artwork, not a screenshot of a treasury deployment.

1. What this agent is actually for

Treasury teams assemble daily cash commentary, hedge-coverage exceptions, counterparty watchlists, covenant cover memoranda and stress-test explanations from several systems. The bottleneck is often not calculating the number. It is finding the right run, interpreting it against the right agreement and producing a reviewable account of what changed. The Finance Risk Agent addresses that assembly problem.

This is distinct from the Finance Agent and its record-to-report workflows. The two may read related financial evidence, but a closed ledger and a risk interpretation have different owners, assumptions and approval paths. Neither agent should inherit the other’s tools merely because both work with money.

Risk-register maintenance sits beside these workflows. Each refreshed entry points to the relevant exposure run, clause, bureau report and committee minute. A new paragraph without updated evidence is not a refreshed risk assessment.

Autonomy is specific to a workflow

The handbook places gap prompts at L0; liquidity commentary, stress narration and covenant cover memoranda at L1; credit-limit proposals, hedge recommendations and risk-register changes at L2 with approval. It reserves L3 for narrow, low-materiality supplier-watchlist changes after second-line validation. L4 is deliberately empty. Its EUR 250,000 materiality example, promotion periods and acceptance thresholds belong to a reference policy, not a default for another enterprise.

The agent must never execute, amend, confirm or cancel a trade, payment, deal ticket or bank instruction. The prohibited verbs are absent from its tool surface and credentials—not merely discouraged in its prompt.

A proposal’s lifecycle does not weaken that prohibition. Approval may release a proposal into an established human workflow; it must not quietly turn this agent into the identity that can operate a dealing platform. The boundary holds in test environments as well as production.

2. Architecture: calculation, uncertainty, interpretation, decision

The chapter separates four stages. Deterministic tools calculate positions, exposures, sensitivities, cashflow ladders, covenant ratios and stress revaluations. The engine also quantifies uncertainty using a stated method. The model interprets these outputs and assembles their evidence. A named human makes the consequential decision and leaves an approval record. Moving a calculation or a decision into the interpretation stage is an architectural change, not prompt tuning.

NATS events: daily_open | ageing_posted | camt053_loaded
                         |
                         v
            risk-orchestrator (Sonnet)
             /                     \
    deterministic tools       governed retrieval
    compute_exposure          facility clauses
    compute_covenant          defined-term resolution
    TMS cash_position         policy and committee evidence
             \                     /
               draft + exact evidence bundle
                         |
                         v
            challenge-assumptions (Opus)
                         |
                         v
       exposure table + lineage + narrative + findings
                         |
                  evidence ledger
                         |
                 named human reviewer
                         |
              approved proposal / review packet
              NO trade or payment execution

The orchestrator uses the handbook’s Sonnet worker role; counterparty screening uses its Haiku classification role; adversarial review uses Opus with higher reasoning effort. The roles matter more than hard-coded model names. A deployable release must pin a model that is actually available in the chosen environment, its runtime, prompt version and evaluation results. The handbook’s model IDs and cost estimates are reference configuration, not a current pricing commitment.

Business-agent handoffs remain events. A Finance period-close event can trigger covenant recalculation without putting the Finance Agent inside the risk session. The deliberate exception is challenge-assumptions: it belongs inside this decision boundary and must challenge the exact draft, retrieved clauses and calculation lineage—not a later summary or a freshly queried market snapshot.

Model-risk governance without a false regulatory claim

The handbook requires MODEL_CARD.md, VALIDATION.md, documented purpose and limitations, input lineage, monitoring, version control and a named owner. Those are sound design requirements for this reference system. Its regulatory justification needs a dated qualification rather than an unqualified claim that every narrative agent is automatically a regulated internal model.

Web-edition regulatory qualification, checked September 2026. Federal Reserve SR 26-2, issued April 17, 2026, supersedes SR 11-7. The accompanying OCC bulletin 2026-13 expressly places generative and agentic AI outside that revised guidance’s scope. Do not present the handbook’s SR 11-7 statement as the current legal classification of this agent. In the UK, PRA SS1/23 has its own defined institutional scope; the ECB internal-model framework concerns applicable supervisory and capital-model requirements. None is a blanket rule for every corporate treasury. Determine the applicable framework with the responsible risk and legal owners. Retaining independent validation and change control as enterprise policy does not depend on mislabelling their statutory source.

Keep the quantitative engine’s validation distinct from validation of the narrative layer. A correctly validated exposure engine does not prove that a language model interpreted a covenant correctly. Conversely, a faithful narrative cannot validate an unsound quantitative method.

3. Repository layout and CLAUDE.md

finance-risk-agent/
  CLAUDE.md
  MODEL_CARD.md
  VALIDATION.md
  .mcp.json
  .claude/
    agents/
      challenge-assumptions.md
      covenant-analyst.md
      counterparty-screener.md
      liquidity-narrator.md
    skills/
      daily-liquidity-commentary/SKILL.md
      covenant-headroom/{SKILL.md,reference.md}
    hooks/
      hooks.json
      risk-policy-gate.py
      redistribution-gate.py
  prompts/
    registry.yaml
    orchestrator/v7.md
  mcp/
    risk/server.py
    tms/server.py
  evals/
    golden/{covenants.jsonl,defined_terms.jsonl,seeded_flaws.jsonl}
    rubrics/challenge_quality.md
  .github/workflows/model-change-control.yml

The prompt register binds each prompt version to its content hash, owner, approver and effective date. The ledger records the version actually executed. Changes to prompts, subagents or calculation adapters trigger evaluation and a reviewed model-card revision. Merely editing a version string is not evidence that a validator accepted a changed behaviour.

CLAUDE.md holds inexpensive invariants that apply on every turn. Skills hold procedures; retrieval holds changing facility text, counterparty files and policy evidence. The following is a condensed rendition of the chapter’s invariants, not an organisation-independent treasury policy.

# Finance Risk Agent — operating invariants
- Never execute, amend, confirm or cancel trades, payments or bank instructions.
- Never state a financial figure that is absent from this run's tool evidence.
- Do not calculate ratios, cash movements or uncertainty in prose.
- Every amount carries its currency; every rate carries its rate-set reference.
- Echo instrument day-count and business-day conventions from lineage.
- Notional is not exposure. Exposure is not a generic measure of risk.
- Do not perform netting or aggregation yourself; preserve engine netting-set scope.
- A defined term means the definition in the applicable executed facility.
- Uncertainty comes from a named engine method, not an invented confidence adjective.
- Escalation bands, certificate dates and distribution rules are reviewed policy.
- Missing or contradictory evidence produces an explicit gap, not a proxy number.

The source’s quarterly test dates, 45-day certificate deadline, 15% headroom escalation band and 25% single-bank cash threshold are illustrative configuration. Carry their policy or agreement version into the run manifest. Do not silently reuse them for a different facility, reporting calendar or risk appetite.

Web-edition hardening. Prompt invariants express intent; they do not make a model incapable of arithmetic or execution. The enforceable property is that unsupported figures and prohibited actions cannot pass the publishing and execution boundaries. Make runtime configuration read-only to the agent and test that the discovered tool catalog matches the approved capability set.

4. Subagents: challenge the exact evidence, not the tone

challenge-assumptions

The centrepiece is an adversarial reviewer, not a copy editor. Preserve its separate context and read-only verification surface. These frontmatter examples retain the handbook’s role boundaries; verify the installed subagent configuration before deployment.

---
name: challenge-assumptions
description: Adversarial reviewer for risk narratives and their exact evidence bundle.
tools: Read, Grep, mcp__risk__compute_exposure, mcp__risk__compute_covenant, mcp__corpus__search, mcp__corpus__resolve_defined_term, mcp__ledger__read_decision
model: opus
effort: high
maxTurns: 25
disallowedTools: Write, Edit, Bash
memory: project
color: red
---
Attack the draft; do not rewrite it.
1. Trace every financial number to the exact tool result.
2. Challenge position cutoff, rate freshness, curve and engine lineage.
3. Resolve contractual defined terms in the same facility and amendment version.
4. Check notional/exposure confusion and unsupported netting or aggregation.
5. State the strongest competing explanation and the check that distinguishes it.
6. Emit concrete, testable falsifiers.
Return a structured challenge register, not a better-sounding narrative.
If no flaw is found, name the checks performed; absence of findings is not approval.

The reviewer receives the draft, exposure table, lineage and retrieved chunk IDs. Recalculation must use the same pinned run. Querying today’s latest rates while challenging yesterday’s draft produces a disagreement without identifying whether the draft was wrong when issued.

Findings use the chapter’s categories: fabrication, lineage, definition, aggregation and counter_narrative. Each names the claim, severity and evidence reference. “The forecast may be wrong” is not a useful falsifier. A useful falsifier identifies the forecast version, settlement event or amended definition that would invalidate the explanation and the query that would settle it.

covenant-analyst

---
name: covenant-analyst
description: Resolve facility-specific definitions and prepare covenant headroom analysis.
tools: Read, Grep, mcp__corpus__search, mcp__corpus__resolve_defined_term, mcp__risk__compute_covenant, mcp__dwh__query
model: sonnet
effort: medium
maxTurns: 18
disallowedTools: Write, Edit, Bash
skills: covenant-headroom
memory: project
color: blue
---
Identify the facility and operative covenant clause.
Resolve every capitalised definition recursively within that facility.
At the reference depth limit of four, unresolved dependencies must be flagged.
Read warehouse components through governed queries and retain their references.
Call compute_covenant; do not calculate the ratio.
Return threshold, value, absolute and percentage headroom, and applied add-backs
with clause references. If facilities differ, present separate results.
If an input is unavailable, name it and stop; do not substitute a proxy.

“Consolidated EBITDA” is not necessarily the management EBITDA in the board pack. It can include facility-specific add-backs, caps and pro-forma treatment. The analyst’s job is to bind the calculation to that definition, not to make the reporting number sound contractual.

counterparty-screener and liquidity-narrator

---
name: counterparty-screener
description: Triage bureau, ageing and bank-concentration signals.
tools: mcp__bureau__fetch_report, mcp__erp__ar_ageing, mcp__risk__compute_exposure
model: haiku
effort: low
maxTurns: 8
disallowedTools: Write, Edit, Bash
background: true
color: yellow
---
Classify each row as no_action, watch or escalate with the triggering signal.
Apply the reviewed threshold version; do not invent discretion below a limit.
Borderline cases move upward for review, not downward to reduce the queue.
Do not write commentary or change a limit.

The reference screening policy escalates a two-band bureau-score drop, an insolvency indicator, a payment-behaviour flag or an exposure-limit breach. It watches a single-band drop, DSO deterioration above ten days or material migration into the 90-plus ageing bucket. These thresholds require deterministic confirmation before a downstream action. They are not recommendations for every credit portfolio.

The repository also names liquidity-narrator. The chapter specifies its output through the daily-commentary skill rather than providing another complete definition. Keep it bounded to the approved cash evidence; do not invent additional authority merely to fill out a symmetric agent diagram.

Web-edition control distinction. An adversarial LLM is not the independent second-line validator and cannot approve its own programme. Project memory must not retain licensed prices, customer-level credit files or another facility’s confidential terms. Broad filesystem reads require a sandboxed mount layout, not only a narrow MCP tool list.

5. Skills: a repeatable evidence packet

daily-liquidity-commentary encodes the order and evidence requirements of the morning artefact. The reference skill loads a small current snapshot and a five-business-day trend instead of embedding a changing cash position into the permanent prompt.

---
name: daily-liquidity-commentary
description: Draft morning liquidity commentary from a pinned cash-position run.
allowed-tools: mcp__tms__cash_position, mcp__risk__compute_exposure, mcp__corpus__search, Read
disallowed-tools: Write, Edit
context: fork
arguments: [as_of]
paths: "treasury/**"
---
# Daily liquidity commentary
1. Group closing cash: available, restricted and trapped, with entity and currency.
2. Movement: operating receipts, disbursements, intercompany and FX translation.
3. Concentration: name banks that breach the approved concentration policy.
4. Headroom: use the engine's committed-undrawn calculation and deductions.
5. Exceptions: entity-level forecast variances outside the approved band.
Maximum 400 words in this reference format.
Attach a source reference to every financial figure.
Never derive the cash movement or facility headroom yourself.

Read trapped-cash detail only when the snapshot contains a trapped balance. Keep per-facility covenant mechanics in the covenant-headroom/reference.md companion and load the applicable facility, not the full treasury legal library. This preserves the handbook’s progressive-disclosure design: a skill teaches a procedure; evidence supplies the current facts.

The source demonstrates dynamic command injection using cash-snapshot --as-of $as_of and a separate trend command. Web-edition qualification: validate the date before invoking a fixed, reviewed wrapper, and bind both outputs to one immutable run manifest. Do not interpolate arbitrary user text into a shell, or let two “latest” reads capture different snapshots. The skills documentation describes dynamic context execution; tool permissions alone are not a sandbox for an external preprocessing script.

The narrative has a fixed order because reviewers must compare days without searching for missing sections. A missing source is an explicit exception, not an empty table interpreted as zero cash. Trend evidence may explain a movement; it cannot silently replace the valuation basis of the current position.

6. Integrations and MCP contracts

All systems of record in the chapter’s integration table are read-only to this agent. Proposal records belong to the platform’s proposal store, not to the TMS. A connector that happens to expose write methods is not permission to make them available to the model.

The handbook’s approximate requests-per-second and concurrency figures describe its reference environment. They are not vendor guarantees. Bound concurrency, honour retry responses and reconcile file-feed completeness separately from API availability. Use the relevant message version and bank implementation guide from the ISO 20022 message catalogue; a generic XML parser is not a validated bank-statement adapter.

Reference MCP layout

{
  "mcpServers": {
    "tms": {
      "type": "http",
      "url": "${GATEWAY_URL}/tms/mcp",
      "headersHelper": "/opt/bin/get-mcp-auth-headers.sh"
    },
    "marketdata": {
      "type": "http",
      "url": "${GATEWAY_URL}/marketdata/mcp",
      "headersHelper": "/opt/bin/get-mcp-auth-headers.sh"
    },
    "risk": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "--directory", "${CLAUDE_PROJECT_DIR}/mcp/risk", "server.py"],
      "env": {"RISK_DSN": "${RISK_DSN}", "ENGINE_VERSION": "${ENGINE_VERSION}"}
    },
    "erp": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "--directory", "${CLAUDE_PROJECT_DIR}/mcp/erp", "readonly.py"],
      "env": {"ERP_DSN": "${ERP_DSN_RO}"}
    }
  }
}

These are reference adapter paths, not public vendor endpoints. The wrappers and token helper must be implemented, authenticated and tested. Per the current Claude Code MCP documentation, headersHelper runs on connection and reconnection, and can refresh after an authentication failure; it is not a guarantee of a new token on every tool call. Authorisation still belongs on every downstream request. Inspect the actual namespaced tool catalog, including plugin prefixes, when testing hook matchers.

compute_exposure: the lineage is part of the result

The source tool accepts a valuation date, dimension, scenario and cursor; validates the dimension; resolves the position snapshot and rate set; refuses stale rates; then returns rows, numeric uncertainty and lineage. Each row distinguishes notional, gross and net measures and retains currency and netting-set identity. Lineage includes the position cutoff, rate source and capture time, curve and bootstrap version, day-count and business-day convention, legal-opinion references, engine version and model version.

Web-edition adapter excerpt. The following makes the pinned-run and pagination contracts explicit. ctx, the manifest store, cursor signer and engine DTO are application components, not SDK functions. It is an interface excerpt, not a drop-in deployment.

async def exposure_page(request, ctx, engine):
    # Adapter excerpt: the named helpers are required application code.
    manifest = await ctx.require_authorized_manifest(request["run_id"])
    dimension = request["dimension"]
    if dimension not in {"currency", "tenor", "counterparty", "entity", "netting_set"}:
        raise ValueError("unsupported aggregation dimension")

    cursor = ctx.verify_cursor(
        request.get("cursor"), manifest.digest, dimension
    )
    page = await engine.aggregate(
        snapshot=manifest.position_snapshot_id,
        rate_set=manifest.rate_set_id,
        scenario=manifest.scenario_id,
        dimension=dimension,
        cursor=cursor,
        limit=500,
    )
    # This DTO has separate rows and metadata; it is not a bare Python list.
    payload = {
        "run_id": manifest.run_id,
        "manifest_sha256": manifest.digest,
        "as_of": manifest.valuation_at,
        "dimension": dimension,
        "scenario_id": manifest.scenario_id,
        "rows": page.serializable_rows,
        "uncertainty": page.uncertainty,
        "lineage": manifest.public_lineage,
        "completeness": page.completeness,
        "next_cursor": ctx.sign_cursor(page.next_cursor, manifest.digest, dimension),
    }
    return ctx.enforce_result_budget(payload)

A run manifest must resolve to immutable artefacts, not merely contain convincing IDs. Include tenant and entity scope, position and rate content hashes, scenario, valuation instant, calculation configuration and applicable definitions. The source’s hash of lineage metadata is useful for identification but does not, by itself, prove the complete input dataset is unchanged.

The reference result uses a 500-row page and a 60,000-character annotation. Web-edition clarification: in the current Python Agent SDK reference, maxResultSizeChars controls inline-result handling and file spill behaviour; it is not a substitute for a server-enforced response limit. Apply bounded pages before serialisation and govern spilled files as data stores. MCP tool annotations are descriptive hints, not access-control enforcement.

Freshness and historical replay need different clocks

The handbook’s 90-minute staleness refusal protects live commentary. Its example compares a rate’s capture time with the current clock. Reusing that predicate for a historical certificate replay would reject valid historical evidence simply because it is old today. Conversely, allowing every old snapshot through would defeat the live control.

from datetime import datetime, timezone

def require_fresh(
    captured_at: datetime,
    reference_at: datetime,
    max_age_minutes: int,
) -> None:
    """Pure policy predicate; caller chooses the approved live/replay clock."""
    if captured_at.utcoffset() is None or reference_at.utcoffset() is None:
        raise ValueError("timezone-aware timestamps required")
    if max_age_minutes < 0:
        raise ValueError("negative freshness limit")
    age = (reference_at.astimezone(timezone.utc)
           - captured_at.astimezone(timezone.utc)).total_seconds()
    if age < 0 or age > max_age_minutes * 60:
        raise ValueError("rate set outside the approved freshness window")

This web-edition predicate requires the host to supply an approved live or replay reference instant and a market/calendar-specific freshness policy. The model may not choose a permissive clock. Reject future-dated captures, missing time zones and incomplete snapshots; label replay output as historical. Validate Decimal-to-JSON representations and units separately rather than allowing binary floating-point formatting to become the reporting convention.

7. Retrieval: contractual definitions are exact keys

The risk corpus contains executed facility agreements and amendments, covenant-definition schedules, hedge policies, risk-appetite statements, internal credit memoranda, committee minutes and permitted counterparty evidence. It is not a warehouse for every market-data payload returned by a connector.

Defined-term resolution

A capitalised contractual term is a pointer. Retrieving a leverage clause without resolving its definition of Consolidated EBITDA can produce a perfectly calculated ratio against the wrong denominator. The RCF and USPP may define the same words differently. Similarity is suitable for finding candidate clauses; it is not the authority for choosing between those definitions.

At ingest, extract each defined term, its full text and capitalised dependencies into a facility-scoped index. Annotate operative clauses with defined_terms[]. At query time, retrieve the operative clause and resolve its terms by exact (facility_id, term) lookup. Follow dependencies to the source’s reference depth limit of four. If the graph remains unresolved or cycles, report the unresolved path and stop rather than silently dropping a definition.

Web-edition temporal qualification: a production key also needs the applicable definition version or effective-time constraint. Amendments are supersessions, not simply additional semantically similar documents. Record the original clause, amending clause, effective interval, scope and document hash. Pin the borrower, facility and test date before choosing definitions. Mixed-facility or mixed-version operands invalidate the calculation request.

Clause-level chunks preserve numbered headings and exceptions. ACL, tenant, entity, facility and effective-date restrictions are enforced in the retrieval service. The chapter’s platform combines lexical and dense retrieval with fusion and reranking; native PostgreSQL ts_rank/ts_rank_cd is full-text ranking, not native BM25. A BM25 implementation requires a separately identified component.

Licensing is a data-flow constraint

The source distinguishes public, internal_derived, vendor_licensed_no_store and vendor_licensed_store_ok. Query-time licensed data stays behind entitled access. Persist allowed references and permitted derived evidence rather than embedding a vendor curve into a broadly accessible corpus. A service account does not inherit every human subscriber’s licence.

Web-edition licensing qualification. Storage, derived-data use, non-display processing, summaries and onward distribution depend on the actual contract and recipients. “Not reversible into the original price” is not automatically permission to store or redistribute. For example, the January 2026 ICE Exchange Quote Vendor Agreement defines derived data using additional conditions, including whether it substitutes for pricing data. Implement reviewed rights, not a model’s interpretation of a licence label.

The source migration defaults new rows to internal_derived. For new or unclassified feeds, a safer web-edition design is quarantine until classification is approved. Do not make an unknown vendor source permissive by default. The same rule covers tool logs, session transcripts, caches, memory, result-spill files and exported review packets—not only vector-store ingestion.

The chapter’s reference retrieval targets are recall@8 of 0.92, nDCG@8 of 0.80 and defined-term accuracy of 0.95. Its no-ship threshold for covenant workflows below 0.90 defined-term accuracy expresses a useful principle: launch a narrower liquidity workflow rather than compensate for broken legal retrieval with a more fluent model. Calibrate actual thresholds against the enterprise’s error costs and independently labelled evidence.

8. Guardrails: model findings do not confer authority

The source layers absent execution tools, read-scoped credentials and a PreToolUse risk-policy hook. Keep all three. Its execution-name matcher blocks trade, deal, payment, instruction and settlement verbs; its proposal checks require four-eyes control; its distribution check escalates low covenant headroom; hedge recommendations remain drafts.

Web-edition permission clarification. The current Agent SDK permissions documentation distinguishes tool availability from automatic approval. allowed_tools is not an exclusive capability boundary, and automatically approved calls need not reach can_use_tool. Remove prohibited tools from the actual catalog, deny them explicitly and enforce downstream scopes. A PreToolUse hook is a further control, not a replacement for backend authorisation.

Four-eyes means authenticated humans, not two strings

The handbook’s small hook compares preparer_principal and approver_principal. That illustrates separation of duties but is insufficient if a model can supply both values. The backend must resolve the preparer and approver from authenticated records, validate entitlements and bind approval to the exact proposal digest, amount, currency, counterparty, evidence version and expiry. A changed proposal requires a fresh approval.

Credit-limit changes, hedge recommendations before dealer handoff, covenant certificates and L2 risk-register changes require the appropriate human signature. A proposal store must not accept a fabricated acting-on-behalf-of header as proof. The authenticated gateway is responsible for establishing that delegation and the receiving service for enforcing it.

Fail closed on missing controls

The source denies normal distribution below its illustrative 15% headroom band. The production distribution service should obtain the headroom from the sealed calculation result, not trust a model-authored min_covenant_headroom_pct argument. Missing or null headroom is not an escape from the check. Equally, a stress narrative without its scenario assumption card must not reach the normal committee pack.

A challenger’s publish verdict means that its review found no blocking issue under its rubric. It is not the human’s approval, the policy gate’s result or a licence check. Critical unsupported figures must block distribution regardless of a permissive model verdict. Escalation notifications remain possible through a separate, bounded channel.

Bank instructions hidden inside a facility PDF, bureau report or committee minute remain untrusted document content. A claimed “treasurer approval” inside a retrieved paragraph cannot create authority. Restrict sole-trader credit records to the appropriate credit-team principals in SQL and avoid copying personal data into general model memory.

9. Production deployment: bind the draft, challenge and decision

The reference headless worker receives a risk event, gathers evidence, generates commentary, invokes the challenger and writes the narrative, findings and provenance to the evidence ledger. It deliberately avoids restarting the entire run against a changing snapshot after a partial failure. Retries belong at explicit tool and workflow boundaries.

A challenge register is a typed artefact

The following web-edition schema retains the chapter’s categories and verdicts while closing object shapes. It is a contract for validation; a parser receiving this schema does not itself constrain model generation.

{
  "type": "object",
  "additionalProperties": false,
  "required": ["findings", "falsifiers", "verdict"],
  "properties": {
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["category", "severity", "claim", "evidence_ref"],
        "properties": {
          "category": {"type": "string", "enum": ["fabrication", "lineage", "definition", "aggregation", "counter_narrative"]},
          "severity": {"type": "string", "enum": ["critical", "high", "medium", "low"]},
          "claim": {"type": "string"},
          "evidence_ref": {"type": "string"}
        }
      }
    },
    "falsifiers": {"type": "array", "items": {"type": "string"}},
    "verdict": {"type": "string", "enum": ["publish", "revise", "block"]}
  }
}

Configure the relevant generation endpoint’s structured-output mechanism and independently validate the result. The Agent SDK structured-output interface uses Python output_format; do not confuse it with the Messages API’s output_config.format. Missing structured output, schema errors, unknown evidence references and failed validation must produce a non-publishable state. Well-formed JSON still does not prove a claim is true.

The host owns the release state

def distribution_state(
    verdict: str,
    binding_valid: bool,
    controls_pass: bool,
    human_approved: bool,
) -> str:
    if not binding_valid or not controls_pass:
        return "BLOCKED"
    if verdict == "block":
        return "BLOCKED"
    if verdict == "revise":
        return "REVISION_REQUIRED"
    if verdict != "publish":
        return "BLOCKED"
    return "READY" if human_approved else "HUMAN_REVIEW"

This is a web-edition policy predicate, not a complete authorisation service. Its Boolean inputs come from trusted verification of the current evidence bundle, current approvals, rights and deterministic controls—not from model JSON. The source’s verdict != 'block' notification branch may notify a review queue about a revision; it must not be implemented as permission to distribute an unresolved draft.

Bind the challenge to draft_sha256, manifest_sha256, retrieved clause versions and the reviewer configuration. Any revision invalidates the old challenge. The host either asks the same approved challenger to review the new bound draft or keeps the packet out of the distribution path. The reviewer cannot erase its own findings by rewriting the draft.

Idempotency is a persisted state machine

The source hashes a daily-workflow name and date before checking whether a ledger entry exists. That is an event key, not a complete input identity or a concurrency lock. In this web edition, use a durable unique claim over tenant, workflow and event revision, then freeze the input manifest. Persist stages such as evidence sealed, draft sealed, challenge completed, human review and distribution receipt. Include prompt, model, calculation and policy versions in replay evidence.

A second worker must not pass a read-before-write existence check while the first is still running. Use an atomic claim, leases and reconciliation of interrupted stages. An approved correction creates a new revision with a supersession link; it does not overwrite what the committee previously received. Delivery uses a stable idempotency key and a recorded receipt or outbox state, rather than an assumption that a successful model turn means an email was sent once.

Read-only tool retries can use the frozen run. A tool timeout after a possible write to the proposal store requires authoritative readback before another attempt. Budget and turn caps are circuit breakers; the handbook’s USD 3 cap and daily-cycle estimates are illustrative rather than promises of current cost.

Verification boundary. The JSON and YAML examples were syntax-checked; the Python excerpts were parsed, and the freshness and distribution predicates were exercised with positive and negative cases. They are not an end-to-end tested SDK/TMS integration. Production still requires the named adapters, immutable stores, identity verification, installed-version tests and a controlled deployment environment.

10. Evaluation: detection, not agreement

The handbook separates four evidence sets: 180 labelled facility-quarters based on signed certificates, 240 term/facility pairs, 60 seeded-flaw scenarios and 300 historical calibration statements. These sizes describe its reference evaluation design, not datasets supplied with this article or measured Infinity results.

Seed a stale rate set, notional presented as exposure, illegal cross-netting-set treatment, accounting EBITDA substituted for the contractual definition, or a stress result missing its assumptions. Ask whether the challenger names the planted flaw in the right category and cites the field or clause that proves it. Keep clean cases—the source specifies 15—to measure false positives. A reviewer that always finds a problem is not a robust reviewer.

Web-edition evaluation qualification: the Brier score requires a specified event, horizon, probability and resolved outcome. Do not score an uncalibrated adjective or an LLM judge’s confidence as though it were a forecast probability. Certificate agreement also needs the facility’s rounding and add-back policy; it is not sufficient to compare two formatted strings while ignoring a changed definition.

The challenge-quality rubric asks whether the flaw is named, categorised, supported by a real evidence reference and accompanied by checkable falsifiers. Calibrate the judge against treasury reviewers rather than treating a higher model score as proof. The source’s reported agreement values are reference observations, not assurance for a new deployment.

Independent validation is not developer CI

CI evaluates each prompt, skill, tool-schema and model change against the developer’s regression sets. Under the handbook’s governance design, an independent validation function separately owns a held-out set, evaluates deployed versions and records findings with owners and due dates in VALIDATION.md. Treat that as an explicit enterprise control and establish the applicable regulatory basis separately, as explained in Section 2.

Add negative cases at the system boundaries: unknown facility, amended definition omitted, incomplete cash feed, forged approver, null headroom, stale challenge binding, missing assumption card, expired data entitlement and duplicate worker delivery. Test that a clean challenge cannot override any deterministic failure. Production metrics should include untraceable figures, unresolved-definition escapes, stale-input refusals, reviewer overrides, unclosed validation findings and the age of pending material escalations—not only narrative throughput.

11. Failure modes and their controls

Day-count conventions silently substituted

The chapter describes an apparent accrual discrepancy caused by using ACT/360 for an instrument on 30E/360. The agent must echo the instrument convention returned in lineage, not select a familiar one. The calculator owns the convention and tests; the narrative owns an accurate explanation of what was used.

Stale rates called current

A Friday rate set can produce a fluent Monday cash explanation about a move that has already reversed. Refuse a live run outside its approved freshness window. For replay, preserve the historical reference clock and label the result. A caveat placed only in a low-level tool log is not enough if summarisation removes it.

Notional described as exposure or risk

A swap-book notional is not interchangeable with its valuation, exposure or a risk statistic. Require typed metric names and units in every row and test dedicated confusion cases. The model may explain an engine-provided measure but may not invent an equivalence between differently defined quantities.

Netting without legal scope

The source warns against combining exposures under incompatible agreements or without the relevant legal opinion. Preserve netting-set IDs and legal-opinion references. Do not let the model infer offsets. Web-edition precision: gross portfolio aggregation and legally enforceable netting are different operations; this warning is not a blanket mathematical claim that gross exposures can never be aggregated. The approved engine determines the intended metric and permitted treatment.

The wrong EBITDA survives a correct calculation

An amendment can restate the definitions section while the retrieval index still points at the original. Store supersession and effective dates, test the amended facility explicitly and show the definition chain beside the calculation. A higher general retrieval score cannot repair an absent amendment.

A stress scenario becomes a forecast

The handbook’s example is a parallel rate shift under static balances and no management action. Without its assumption card, a committee may read the output as a forecast. Put the engine’s scenario, assumptions, horizon and exclusions before the narrative. A missing card blocks normal distribution.

The narrative replaces the evidence in practice

The most important governance failure may have no software exception: the committee reads only the first page of polished prose while the exposure table disappears into an appendix. Keep the table, lineage, narrative and challenge register together, with the table first. The chapter proposes periodic read-back of selected figures to their engine source; the purpose is to test actual reviewability, not stage a compliance ritual.

These are failure patterns described by the handbook and engineering acceptance cases for this reference design. They are not presented as incidents at Infinity clients. The release should remain safe when both generator and challenger share the same blind spot, because neither owns the final policy or human approval gate.

12. Build order: evidence before autonomy

Week 1: implement the read-only risk adapter with complete calculation lineage, the TMS and statement inputs, and L1 daily commentary reviewed by a treasurer. No covenant retrieval, no credit changes and no execution. Prove that every figure traces and that missing evidence remains visible.

Month 1: ingest one set of executed facilities at clause level, build the defined-term index and run covenant analysis against historical signed certificates. Introduce challenge-assumptions when the first risk narrative leaves the immediate build team, not as a later optional improvement. Establish the model card, prompt register and change-control gate before production use.

Quarter 1: add counterparty screening with four-eyes proposal controls, seeded-flaw tests, redistribution enforcement and independent validation. Close material findings before considering the narrow L3 watchlist workflow. These are sequencing milestones from the reference chapter, not delivery-time guarantees.

The permanent ceiling remains unchanged: more successful commentary does not earn trade or payment authority. The useful product is a defensible decision packet—calculation, uncertainty, interpretation, challenge and human decision—with each responsibility observable and independently testable.

Primary sources and web-edition notes

The structural source is Article 6 of the supplied Enterprise Agent Mesh handbook, with the shared platform from Part 0. The official sources below support the explicitly marked regulatory and implementation qualifications. Endpoint paths, deployment identities and engine helpers in the examples remain reference interfaces.

• Federal Reserve: SR 26-2, revised model-risk guidance and supersession of SR 11-7.
• OCC Bulletin 2026-13: applicability and generative/agentic AI scope qualification.
• Bank of England / PRA: SS1/23 model-risk-management principles.
• ECB Banking Supervision: internal-model framework and current guidance.
• Anthropic: subagents, skills and MCP configuration and authentication.
• Anthropic: Agent SDK permissions, hooks, Python SDK reference and structured outputs.
• Model Context Protocol: tool semantics and annotation limitations.
• PostgreSQL: full-text search controls and ranking.
• ISO 20022: message definitions catalogue.
• ICE: Exchange Quote Vendor Agreement, January 2026 version.

Continue the Enterprise Agent Mesh series

← Previous: 05 Finance Agent — Numbers From Tools, Never From the Model

Start the series: 01 Recruitment Agent · 02 HR Agent · 03 Supply Chain Agent · 04 Procurement Agent

Next: 07 Operations Agent — Durable Execution, Process Conformance, and the Connective Tissue of the Mesh. Forthcoming.