A new runtime authority contract, SAGE-Fin, stops financial AI agents from turning correct context into unauthorized trades or commitments by requiring exact typed receipts before any effect is executed. The design is formally proved and validated on a 616-case test catalog and a confidential crypto-platform deployment that received a positive independent operational review, though quantitative impact metrics are not disclosed.

Main Finding

SAGE-Fin introduces a finance-specific runtime authority contract that separates context (retrieved documents, model outputs, dialogue, signals) from authority (the runtime permission to make a claim, issue a recommendation, execute an order, or deploy a policy). By compiling proposed effects into typed, adapter-bound candidates, tracking missing or stale institutional obligations as explicit coverage debt, and requiring an exact-artifact receipt (of a nominal type matching the consuming adapter) at consumption time, SAGE-Fin prevents unauthorized or stale context from becoming actionable. The authors formally prove trace-level authority non-amplification and demonstrate executable conformance across a 616-case catalog and a production response-gate deployment in a confidential digital-asset platform.

Key Points

• Problem identified: context-to-authority failure — fluent, factually-correct natural language or retrieved context can still lack runtime authority to cause a financial effect.
• Core construct: a typed authority object that joins
  • a re-derived typed candidate (the proposed effect),
  • institutional witness/debt state (explicit missing or stale obligations = coverage debt),
  • the exact artifact (the concrete proposal object),
  • current market/account/policy/dialogue state,
  • a nominal adapter receipt (commit / execAuth / deploy) accepted by the consuming adapter.
• Runtime guarantees (formal):
  • Typed, non-substitutable, state-contingent receipts.
  • Trace-level authority non-amplification: non-consumption events cannot create governed effects; every effect requires a prior exact-artifact adapter receipt valid under current state; progress receipts or wrong-adapter receipts cannot substitute for effect authority.
• Failure taxonomy (illustrative patterns):
  • Signal hardening (soft signal becomes unauthorized hard command),
  • Evidence staleness (using out-of-window data),
  • Coverage-debt hiding (omitted required witnesses masked by fluent prose),
  • Receipt misuse (treating progress/reservation receipts as execution permission),
  • Dialogue-to-policy deployment (ambiguous conversational instructions becoming deployed policies),
  • Authority drift across turns (reusing prior-authority candidate after intervening state change).
• Relationship to prior work:
  • Complements upstream validators (e.g., CBEA+LCV) and general authorization models (ABAC, UCON, macaroons, AgentSpec) by specifying the finance-domain handoff and exact-artifact lifecycle required at consumption points.
• Implementation & evaluation summary:
  • Authored 616-case catalog; five deterministic specifications produce 3,080 diagnostic outputs.
  • Label-isolated test harness achieved 616/616 binary parity between reference and prototype, including 3/3 named response-gate fixtures; 22 additional tests cover selected paths.
  • Formal proofs of the receipt and non-amplification properties (paper).
  • Separate production deployment: a customer-response gate processed real requests at a confidential digital-asset platform; an organizationally independent formal review and end-user feedback were strongly positive. The authors report three prior de-identified failures that motivated the design; an independent analyst confirmed those failures were not intercepted before SAGE-Fin (0/3).
• Scope limitations (explicit):
  • SAGE-Fin is about runtime authorization correctness and auditability; it does not guarantee profitability, causal alpha, comprehensive validator discovery, or cross-jurisdiction compliance.
  • The evaluation establishes executable conformance, not independent safety accuracy or prevalence/impact estimates.

Data & Methods

• Mechanism design:
  • Formal definitions of candidate compilation, coverage debt, receipt types, and adapter consumption semantics; state revalidation on consumption.
  • Proofs for typed, non-substitutable, state-contingent receipts and trace-level authority non-amplification.
• Test corpus:
  • 616 authored cases representing finance-oriented proposals and consumption scenarios (catalog publicly described in paper).
  • Five deterministic specification variants generate 3,080 outputs to exercise different branches.
  • A label-isolated harness compares a reference implementation to prototype; binary parity (correct/wrong) across all 616 cases achieved.
  • 22 unit/integration tests target selected paths and edge cases.
• Deployment evidence:
  • A response-gate implementing SAGE-Fin processed live customer-facing requests at a confidential digital-asset platform (details redacted).
  • An organizationally independent operational-team post-deployment review and end-user feedback provided qualitative corroboration (strongly positive). Only the review’s independence, stakeholder classes, assessed dimensions, and directional conclusion are disclosed.
• Threat model:
  • NL-driven adversaries that cause overcommitment, stale consumption, receipt misuse, or ambiguous policy deployment; SAGE-Fin maps defenses to these adversaries.
• Evaluation stance:
  • The empirical results are conformance and workflow-fit evidence (executable behavior and deployment fit), not statistical estimates of incidence or reductions in adverse outcomes.

Implications for AI Economics

• Runtime governance is distinct from model validation:
  • In market-facing AI systems, correctness of context/facts is insufficient — explicit runtime authorization and exact-artifact receipts are necessary to prevent unauthorized commitments that can have economic consequences.
• Risk management and model-use governance:
  • SAGE-Fin provides a practical construction for model-risk controls, audit trails, and accountable actions; it operationalizes “complete mediation” and ongoing attribute checks (UCON/ABAC-like behavior) for financial agents.
• Regulatory alignment and auditability:
  • The approach helps satisfy transparency, oversight, and incident-reporting expectations in regimes like the EU AI Act, NIST generative-AI guidance, and finance conduct rules (e.g., suitability and promise/representation constraints), especially for fast-moving crypto-asset contexts requiring determinism and freshness.
• Operational trade-offs:
  • Benefits: reduces accidental issuance of unauthorized recommendations, orders, or policy deploys; makes missing or stale evidence explicit (coverage debt); supports post-hoc reconciliation and auditable receipts.
  • Costs: requires instrumentation (typed candidates, witness registries, freshness windows), additional runtime checks and recomputation per turn (potential latency/complexity), and organizational processes for defining witness types, adapter receipt semantics, and rollback/reconciliation policies.
• Measurement suggestions for practice and research:
  • Key monitoring metrics: frequency of receipt mismatches, coverage-debt backlogs, intercepted unauthorized-emission attempts, latency impacts of per-consumption revalidation, and end-user trust/complaint rates.
  • Research directions: quantify how runtime authority enforcement alters downstream economic outcomes (trade execution errors avoided, mis-selling reduced), model the prevalence and welfare impact of context-to-authority failures, and integrate SAGE-Fin with upstream validators to measure joint effectiveness.
• Broader economic significance:
  • As financial AI moves from advisory to agentic execution, governance primitives like SAGE-Fin are likely necessary infrastructure for maintaining market integrity, protecting retail investors, and limiting systemic risk caused by automated mis-authorizations — especially in low-latency, high-value domains (trading, custody, crypto markets).

If you want, I can (a) extract the paper’s formal definitions and theorem statements into a concise technical appendix, (b) produce a short checklist for implementing SAGE-Fin in a production trading or customer-support pipeline, or (c) draft suggested monitoring metrics and dashboards to evaluate a deployed SAGE-Fin gate. Which would be most useful?