Agentic AI Foundations for Financial Services

Financial institutions have deployed machine learning for three decades — credit scorecards, fraud models, churn prediction. Agentic AI is not a faster version of that. It is a different operating model, in which software holds a goal, decides its own next step, and acts through the bank's systems. This module establishes what actually changes, why it changes the regulatory conversation, and how to place any given use case on an autonomy ladder before a single line of code is written.

• 1.What Makes an Agent Different from a Model10m
• 2.The Agent Loop, and Where It Breaks in a Bank10m
• 3.Lab: Building an Autonomy Ladder for Your Institution15m

Language models are now the reasoning substrate beneath most financial agents, which turns their failure modes from a research curiosity into an operational risk. This module works through what a transformer actually does to a credit memo, where fluent output stops being trustworthy, and how to specify extraction work so that a second line of defence can test it rather than take it on faith.

• 1.Tokens, Attention and What the Model Does With a Number10m
• 2.Hallucination, Sycophancy and the Grounding Discipline10m
• 3.Lab: A Grounded Extraction Specification for Credit Memos20m

A second agent is a cost before it is a capability: it adds a boundary, a message format, and a place where accountability can go missing. This module sets out when decomposition genuinely pays in banking operations, which topologies survive contact with origination and investigation work, and how to write the handoff contracts that make a multi-agent pipeline reconstructable.

• 1.The Decomposition Decision: When a Second Agent Earns Its Keep10m
• 2.Orchestrators, Peers and Hierarchies: Topologies That Survive Operations10m
• 3.Lab: A Handoff Contract for a Multi-Agent Loan Origination Pipeline20m

Tool use is the point at which an agent stops producing text and starts moving money. This module covers how function calling actually works, how to write schemas a model uses correctly under pressure, and how to bound authorisation, retries and blast radius when the systems on the other side are core banking, market data and payment rails.

• 1.How Function Calling Works, and How to Write a Schema a Model Can Use10m
• 2.Authorisation, Idempotency and Blast Radius in Financial Tool Design10m
• 3.Lab: A Tool Manifest and Privilege Audit for an FX Hedging Agent20m

Agent frameworks are usually compared on features. The property that matters in a regulated institution is the shape of control flow each one makes natural, because that determines whether a run can be reconstructed. This module examines what LangGraph, AutoGen and CrewAI actually do, how to choose under supervisory constraint, and how to design so that changing framework later is a port rather than a rewrite.

• 1.Three Shapes of Orchestration: Graph, Conversation and Crew10m
• 2.Selecting a Framework Under Supervisory Constraint10m
• 3.Lab: A Framework Selection Record for a Credit Pre-Approval Workflow25m

Agent memory is usually built as one undifferentiated store, which is why it fails in ways its designers cannot diagnose. Separating episodic, semantic and procedural memory gives each a distinct owner, retention rule and failure mode. This module covers that separation, why embeddings are personal data under UAE, DIFC and Saudi law, and how to prove that a deletion request actually empties every derived store.

• 1.Episodic, Semantic and Procedural Memory: Why the Split Is Operational10m
• 2.Vector Stores, Embeddings as Personal Data, and the Deletion Problem15m
• 3.Lab: An Agent Memory Register and Erasure Test for a Private Banking Agent25m

Planning is where agent demonstrations are most persuasive and the published evidence is least flattering. This module separates what language models genuinely contribute to planning from what must come from external verifiers, sets out when an agent should replan and when it must escalate, and treats the plan itself as the audit artefact a supervisor will ask to see.

• 1.Planning Architectures and What the Published Evidence Supports10m
• 2.Replanning, Self-Critique and When the Agent Must Escalate Instead15m
• 3.Lab: A Plan Contract and Trace Audit for an SME Credit Review20m

Regulatory corpora are the worst-behaved documents a bank owns: amended in place, thick with defined terms and cross-references, and in the Gulf frequently authoritative only in Arabic. Module 1 argued that agent reasoning must be grounded in citable sources. This module turns that argument into an engineering and evidence problem — retrieval that surfaces the governing clause, at the right version, and abstains when it cannot.

• 1.Why Regulatory Text Defeats Naive Retrieval10m
• 2.Hybrid Retrieval, Re-ranking and the Citation Contract10m
• 3.Lab: Assembling a Regulatory Retrieval Evidence Pack20m

Banks already govern models. What they do not yet govern is a composition of model, prompt, tools, memory and retrieval corpus that selects its own next step — and SR 26-2, which replaced SR 11-7 in April 2026, expressly declines to cover it. This module sets out what to extend anyway, what the EU AI Act and GDPR Article 22 require of an explanation, and produces an accountability structure a board can approve.

• 1.Governing Agents After SR 26-2 Placed Them Outside Model Risk Scope15m
• 2.Explanation as Evidence: SHAP, Reasoning Traces and Article 2215m
• 3.Lab: Drafting an Agent Accountability Matrix and Agent Card25m

Fairness tooling evaluates a score against outcomes. An agentic credit process makes dozens of decisions before a score exists — which documents to retrieve, which tools to call, when to escalate — and none of them appear in a fairness dashboard. This module covers where bias actually enters, why the standard metrics provably conflict, and how to build a decision record an examiner will accept.

• 1.Where Bias Enters a Credit Agent, and Why It Is Rarely the Model15m
• 2.Fairness Metrics, Impossibility Results and the Adverse Action Sentence10m
• 3.Lab: Building a Fair Lending Evidence File for a Credit Agent25m

Four authorities are pulling four different levers on financial AI: CBUAE through a 2026 guidance note, the DFSA through supervisory judgement, MAS through the most detailed template yet written, and Basel through capital. This module reads each instrument as an engineering constraint rather than a compliance summary, and shows how to attribute one control set across all of them.

• 1.What the CBUAE Guidance Note Actually Requires of an Agent15m
• 2.DFSA, MAS and the Basel Capital Perimeter: Three Different Levers15m
• 3.Lab: Building a Multi-Jurisdiction Control Attribution Matrix25m

An agent is a program whose behaviour is decided at runtime by text, holding credentials provisioned as though it were a person. This module works through what that breaks — the OWASP agentic threat categories, the confused deputy problem, memory as persistent attack surface — and specifies the controls that survive an attacker who fully controls the agent's reasoning.

• 1.The Agentic Attack Surface: Credentials, Not Cleverness15m
• 2.Zero Trust for Non-Human Actors: Scoped Identity and Enforced Boundaries15m
• 3.Lab: Writing the Agent Authorisation Boundary Document25m

Prompt injection is not a defect in a particular model but the consequence of building control flow out of a data channel, and no general fix exists. This module works through direct and indirect injection against banking workflows, the architectural patterns that contain it rather than filter it, and how to red-team an agent so the result is evidence rather than reassurance.

• 1.Direct and Indirect Injection: Why There Is No Clean Fix15m
• 2.Containment by Architecture: Six Patterns and Their Costs15m
• 3.Lab: Red-Teaming a Trade Finance Agent and Writing the Injection Resistance Report25m

Everything so far has been about building an agent and constraining it. This module is about proving it works to a standard someone else will accept. It covers what RAGAS and TruLens genuinely compute rather than what the marketing implies, why LLM-as-judge scoring needs a control of its own, and how to assemble evaluation evidence that survives second-line challenge.

• 1.Three Layers of Evidence: Component, Trajectory and Outcome15m
• 2.What RAGAS and TruLens Actually Measure15m
• 3.Lab: Building the Evaluation Evidence Pack for a Regulatory Q&A Agent25m

The capstone turns fourteen modules of parts into one document a risk committee could actually approve. It takes the autonomy ladder and reversibility classification from Module 1 as its spine, layers the governance and regulatory work of Modules 9 to 11 over it, attaches the evaluation evidence of Module 14, and ends with a defence in front of people whose job is to find the gap.

• 1.Choosing the Use Case and Building the Blueprint Spine10m
• 2.Defending the Design: What the Second Line Will Actually Ask10m
• 3.Lab: Writing and Defending the Agentic AI Blueprint25m