What finance looks like when software becomes an actor
Financial systems assume a person behind every action. Agents that hold keys and move money break that assumption. Notes on identity, mandates and audit.
Most financial infrastructure is built on a simple assumption.
Behind every action there is a person.
A person opens the account. A person passes KYC. A person approves the payment, signs the transaction, accepts the terms and carries the responsibility when something goes wrong. Software sits in between, but it is plumbing. It carries instructions. It does not have intentions.
That assumption is starting to wear thin.
Agents can now read a situation, decide what to do and act on it, including actions that move money. Not in a science-fiction sense. In a mundane, already-possible sense: a process with credentials, a budget and a goal.
I work on financial infrastructure, and I spend a lot of time building with agents. The overlap between those two things raises questions I don’t think the industry has good answers to yet.
Identity was always about people
Regulated finance is organised around knowing who you are dealing with.
KYC for individuals. KYB for companies. Beneficial ownership. Sanctions screening. Transaction monitoring that compares behaviour to what is expected of that customer.
All of it assumes the actor is a legal person, or a structure that resolves to legal persons.
An agent is neither. It acts on behalf of someone, but not in the way a bank transfer acts on behalf of someone. It makes choices within a range. Run the same agent twice with the same instructions and it may not do the same thing.
So the question isn’t only who is this? It becomes:
- who does this agent act for?
- what was it allowed to do?
- who set those limits, and when?
- did this specific action fall inside them?
Those are different questions. Current identity systems mostly answer the first one.
Keys are already becoming mandates
Interestingly, wallet infrastructure is further along here than most of traditional finance.
At Agio our public docs describe 3 kinds of wallet. Custodial wallets use multi-signature approval policies and address whitelists: funds can only move to known places, with the right people signing. Hot wallets leave the encryption key with the client. Smart wallets built on ERC-4337 support session keys for delegated signing.
A session key is an interesting primitive. It separates ownership from authority to act. The owner keeps control of the account. Something else, possibly a piece of software, gets a narrow, revocable permission to do specific things for a while.
That is very close to what an agent needs. Not the keys to everything. A mandate.
The financial world has used mandates for a long time: powers of attorney, trading authorities, standing orders, investment guidelines. What is new is that they can be expressed in code, enforced at the point of signing, and granted to something that isn’t a person.
The model decides, the code enforces
When I’ve built experiments where a model makes decisions with financial consequences, one pattern kept proving useful.
The model proposes. Deterministic code disposes.
In a small trading lab I built, the model only ever emits a market signal: buy, sell or hold, with probabilities. It never sees the portfolio and never places an order itself. Ordinary code decides whether the signal clears the thresholds, applies the position rules, computes the costs and records everything. Real trading is deliberately annoying to switch on: it needs an explicit environment flag that reads LIVE_TRADING=YES_I_UNDERSTAND.
That last detail is a joke, but only slightly.
The general shape is what I think matters for finance:
- the model’s output is a typed, bounded proposal, not free text,
- the space of possible actions is defined by code, not by the model,
- limits are enforced where the action happens, not in the prompt,
- every decision is logged with what the model saw and what it chose,
- switching from simulation to real money is an explicit human act.
A prompt that says never spend more than $100 is a request. A signing policy that rejects transactions above $100 is a control. Regulators, auditors and customers will eventually want to see the second kind.
Audit becomes about reasoning, not just records
Financial systems are good at recording what happened. Ledgers, transaction logs, approval trails.
When software acts, why becomes much more important.
If a person makes a bad trade, you can ask them. If an agent does, you need to reconstruct what it knew at the time, which instructions it was following, which limits applied, and whether the outcome was a bug, a bad instruction or a reasonable decision that turned out badly.
That means logging inputs and outputs, not just effects. The prompt, the state, the model version, the probabilities, the policy that approved or rejected the action.
It also means being able to replay a decision. In my own experiments, caching every model answer against exactly what the model was shown turned out to be essential. Without it, you can’t tell whether a change in behaviour came from the model, the prompt or the market.
For compliance, that kind of replayability may become as important as the ledger itself.
Liability doesn’t disappear
A tempting mistake is to treat an agent as a new kind of party. It isn’t, at least not legally. Someone deployed it. Someone gave it authority. Someone benefits from what it does.
So responsibility will keep resolving to people and companies. What changes is how clearly that chain has to be documented.
Today, if a payment goes wrong, the chain is usually short: customer, bank, maybe an intermediary. With agents it can get long quickly: the user, the application, the agent framework, the model provider, the wallet, the policy that approved it.
Financial infrastructure that makes that chain explicit, who granted what authority to which software under which limits, will be much easier to trust than infrastructure that treats agent activity as just another API call.
The open questions
I don’t know how most of this plays out.
Does an agent need its own identity? Or is it always an extension of its principal, with a mandate attached? The second feels more honest to me, but the first may be more practical at scale.
How do you monitor behaviour that is meant to vary? Transaction monitoring looks for deviations from expected patterns. An agent that adapts will deviate by design.
What does consent look like? A user clicking allow on a broad permission once is not meaningfully informed consent for 1,000 future decisions.
Where does the model sit in a regulatory sense? A tool, a service provider, or something new?
What I’m fairly confident about is the direction. Software is moving from carrying instructions to making decisions. Finance is one of the places where that shift matters most, because the consequences are measured in money and the rules were written for people.
The interesting infrastructure work is in the gap between the two.