The Frontier: Attestation, Knowledge Graphs and the Infrastructure Under Finance AI

For three years the interesting question was capability: could it read the filing, do the arithmetic, write the memo. That is largely settled. What is not settled is everything around the model: what it was permitted to touch, whether the same input produces the same answer next quarter, and whether the record of what happened can be verified by somebody who does not trust you and cannot re-run it.

Four disciplines, none of them modelling

The frontier moved, and it is no longer the model. The work now sits in four disciplines. Harness engineering is what sits between the model and everything it can touch. Loop engineering is what happens next, and when it stops. Context engineering is what enters the window and what it displaces. Knowledge engineering is making the rulebook machine-readable so an agent cites an obligation rather than paraphrasing one. Provenance is not a fifth discipline. It is the property the other four exist to produce. These build on the stack in the AI field guide for regulated finance.

Harness engineering and offline verification

The harness is where every question a regulator will ask gets answered, and four properties matter. Offline verification: a completed run produces an artefact a third party verifies in a fixed sequence of deterministic steps, so an auditor checks your agent's work on a laptop with the wifi off, with no call back to us. Default-deny capabilities fixed at the session boundary, so a prompt injection cannot acquire a tool the session did not start with. Deterministic controller dispatch, so two runs are comparable. And typed, signed handoffs, so an agent reading untrusted documents cannot pass an instruction to one that holds write capability.

A log says what a system claims happened. An evidence bundle is a thing somebody else can check without asking you. A completed run produces a signed bundle carrying the inputs and their hashes, the capability set granted, every dispatch, the computations and the engine that performed them, and every approval with the identity behind it. It excludes credentials and raw untrusted documents. This is the default-deny principle from packaging AI your finance firm can deploy, carried through to execution.

Loop engineering: what happens next, and when it stops

An agent is a loop: gather context, act, check the result, decide whether to go again. Almost every failure in production is a failure of that last clause. Decomposition lets each part hold only what it needs: an orchestrator that dispatches and never reads a counterparty document, a reader that holds no write path, a critic that checks and cannot act. Loop shape is also a choice with a price. A critic loop materially improves drafting but doubles or triples cost and needs a hard iteration cap. A cap that fires is a bad outcome you can see; an uncapped loop is one you find in billing. Measure the workflow on your own cases, not the model.

Context engineering: the window is a budget

More context is not better context. Every token you add competes with every token already there, and the things crowded out are usually the constraints. A model attending to forty documents attends to each of them less. So the discipline is deciding what enters, and when. Procedures, lessons and trajectory live in stores outside the window, loaded when needed, which is exactly the staged loading behind skills in capturing a process that runs the same way every time. A conversation is not a record: if a decision matters, it belongs in the graph, not in the scrollback. Retrieval is where accuracy actually lives, so when an agent gets a document wrong, capture the correction and fix the chunking before you touch the model, which is the expensive lever and rarely the binding one.

Compliance is a graph problem

An obligation is not a paragraph. It is a relationship between an actor, an activity, a condition and a piece of evidence. Store it as a graph and you can ask whether a particular run satisfied it. So a run emits a graph rather than a log, with provenance expressed in PROV-O, the W3C vocabulary an auditor's tooling can read without us shipping a viewer. Checking is done with SHACL shapes that express what a compliant run looks like, mapped to named frameworks such as PRA SS1/23, SR 11-7 and MiFID II. A violated shape is a rejection recorded at the point the constraint was breached. Keep the claims separated by how they came to exist, so an agent can write freely into a proposed space while nothing becomes a business fact until a person promotes it.

Provenance is a chain, not a field

Provenance is an unbroken chain from a figure in a deliverable back to the source it came from, with everything done to it in between, not a note attached at the end saying which system a number came from. The chain almost always breaks at the model boundary, because nothing forces it not to. The fix is mostly about output shape: extraction returns structured fields with source identifiers, computation is referenced rather than reproduced, and a run that cannot cite halts. The capability nobody asks for until they need it is selective retraction: when a source turns out to be wrong, which of your client deliverables depended on it? With the chain intact it is a query, not an estimate. The same discipline appears in connecting AI to the systems you already govern and in the verifiability moves in defensible prompting.

Proactive agentics and the hard problem

The four disciplines become load-bearing when nobody asked. A proactive system holds a standing question and says when the answer changes, such as a covenant now within ten per cent of trigger. Nobody lets a system act unprompted unless all four hold at once: the harness bounds what it can touch, the loop bounds when it stops, context bounds what it knows, and the graph records what it concluded. Remove one and the others stop being sufficient.

There is one problem none of that solves: a system that changes itself cannot be attested like one that does not. Attestation rests on reproducibility, and adaptation breaks it, because the configuration on Tuesday learned from four hundred corrections since March. You can make the change auditable by versioning every adapter and hashing every base. What that does not answer is whether a firm can be accountable for a system whose behaviour changes without a human deciding it should. Everyone in this space has the same gap, and anybody claiming otherwise is describing a roadmap. Our position is to keep adaptation in the extraction and retrieval layer, never in the judgement layer.

This is why forward deployed engineering is a technical choice, not a commercial one. An attestation system encodes a firm's interpretation of its own obligations, and none of that is written down anywhere an outsider could read. You get it by sitting in the room while the work happens, and by proving the system in parallel against the incumbent until every difference is explainable. To read the argument in full, download the five-part finance series or send us a workflow.