The Model Drafts, the Human Signs (An Agentic Banking Harness)
I put a language model at a fraud analyst’s desk, wrapped it in bank-grade controls, and ran it forty times
This is a follow-up to Automation Risk, Measurement & the Shape of Work and Kind Work, Wicked Work. The short version of those two: jobs with fast, honest feedback build human masters, and the same conditions are exactly what train AI. This time I stopped theorizing and built the thing.
The demo
Before I say anything else, open this and click through. It takes about ninety seconds. The rest of this article is commentary on what you just saw.
What you clicked through is a six-scene dashboard sitting on top of a fully synthetic retail bank. Two thousand transactions across forty accounts, deterministic fraud detectors firing four alerts, and a language model doing the work a fraud analyst does: opening cases, pulling the relevant policy, drafting suspicious-transaction reports, proposing account freezes. Between the model and the bank’s ledger sits a rules gate that cannot be skipped, and behind the gate sits a human approval card, where your click lands in an audit log that nobody, including me, can edit afterward. A second-line auditor reviews everything after the fact and catches a trap I planted. An evaluation round scores the whole run against ground truth. The final scene compares two models across forty runs.
Why a fraud desk
In the earlier articles I argued that the best single predictor of automation risk is whether a task’s quality can be measured cheaply and honestly, and that the desks where feedback is fast and truthful, the kind environments, are the same desks where a model can rehearse a career’s worth of Mondays before breakfast. I was looking for high sensitivity roles in highly regulated domains, the fraud analyst was an obvious choice. An alert fires, an analyst investigates, an account gets frozen or it does not, and the policy corpus says which answer was right. The thresholds are written down. The circulars are numbered. The patterns repeat. By the logic of my own framework, this desk should be almost entirely automatable.
So I built a bank. A synthetic one, with seeded customers, seeded transactions, and two fraud schemes planted where the detectors would find them: a structuring case, where deposits are broken up to duck under reporting thresholds, and an account takeover, where a compromised account starts firing transfers at counterparties it has never paid before. Then I sat a model at the analyst’s desk and let it work the alerts.
The parts I built on purpose
In banks some design decision that matter include high observability. The model cannot touch the ledger. It can read, search, and draft, and at the end of all that reading and drafting it can only propose. Every proposal passes through a deterministic rules gate that checks the structure of the request: a freeze needs a case number, a report needs citations, an action has to have actually been proposed before it can be committed. Approved actions reach the database through a single function, and every propose, decide, and commit lands as its own row in an append-only log enforced by database triggers, instead of code review or good intentions. You cannot switch the triggers off by accident.
I built it this way because central bank regulation in most jurisdictions requires a human in or on the loop (HITL/HOTL), holds a licensed person liable for the decision, and has no appetite for autonomous agents moving money. Anyone selling you a fully autonomous compliance floor is selling something your regulator will not let you plug in. The architecture takes that constraint and makes it load-bearing: the human queue is not a leftover from the old process, it is the interface where accountability lives, and the audit log underneath it is stronger evidence than most banks can produce about their human analysts today.
The result is a system where the boring, repetitive, careful work happens at machine speed and the signature still belongs to a person. One command reproduces the entire run offline, on a laptop, in under a minute.
The dashboard you clicked through is a replay of that command’s output. The code is not public yet, but if you want to see it, ask me.
What forty runs showed
A single impressive run is a screenshot, and screenshots are how AI gets sold. So I took one alert and ran it twenty times through a small model and twenty times through a large one, with same bank, seed, and sampling settings.
| Nemotron 3 Nano (31.6B) | Nemotron 3 Super (120B) | |
|---|---|---|
| Correct diagnosis | 3/20 | 16/20 |
| Proposed the freeze | 8/20 | 19/20 |
| Reported a freeze it never proposed | 10/20 | 1/20 |
| Distinct citation sets across 20 runs | 10 | 10 |
The diagnosis gap is expected. The third row is not. In half of the small model’s runs, the written report describes an account freeze that the model never actually proposed. The citations check out, the ledger numbers are right, the prose reads like a competent analyst on a good day, and the freeze exists only in the narrative. A reviewer reading that report would believe a dangerous account had been locked when nothing had happened to it.
I call this the say-do gap. No amount of reading reports will ever surface it. It only shows up when you keep a log of what was proposed and a log of what was claimed, and diff them, which is what a harness does and what almost no review process anywhere does the same way, for models or for people.
The fourth row is quieter but it follows you around. Both models justified their decisions with a different set of policy citations nearly every time, even when the decision itself was stable. The big model got the right answer nineteen times out of twenty and explained itself differently in ten of them. If your regulator expects the reasoning behind a freeze to be consistent, you now have a measurement problem you did not know you had, and it does not go away by buying a bigger model.
The money
I will keep this short because the arithmetic does its own talking. The model works an alert end to end, research, drafting, citations, proposal, in about a minute, at a marginal cost near zero. The large model lands the right diagnosis eighty percent of the time, which is comfortably good enough to triage. A floor of ten analysts becomes two or three reviewers working an approval queue, and the reviewers spend their day on the cases the gate could not resolve, which is where their judgment was always supposed to go. Meanwhile every decision they make is recorded in a form the second line can actually inspect, which tends to make the next regulatory exam shorter rather than longer.
The reviewers who remain are not doing a diminished job. The reading, the searching, the formatting, the parts of the work nobody went to school for, move to the model. What stays is the part the license is for: judgment on the hard cases, the signature, the conversation with the client whose account got frozen, the ability to notice that something looks wrong in a way no detector was programmed to catch. In the language of the earlier articles, the kind work moves to the machine and the wicked work stays with the person, and the person’s time gets a great deal more expensive per hour and a great deal better spent.
Where this goes
Nothing in the harness knows it is about money laundering. Swap the seeded bank for a claims generator and the circulars for a benefits manual and you are looking at prior authorization in healthcare. Swap in contracts and case law and you are looking at legal review. The gate, the auditor, the append-only log, the say-do measurement, all of it carries over to any desk where a person reads documents, applies written rules, and produces a recommendation that someone else relies on. Most regulated industries have already done the hard work of writing their rules down. That is what regulation is.
I ended the last article by saying that every kind environment is simultaneously a good place to become excellent and a good place to be replaced. The fraud desk turned out to be kinder than I guessed, and the replacement is further along than the people staffing it tend to believe.
I did not expect to find how much of the value sits in the harness rather than the model. The model is a commodity that improves on someone else’s schedule. The controls, the measurement, the log that lets you prove what happened, that is the part you own, and it is the part your regulator will ask about.
My advice to every enterprise out there is “Own the commodity, build the control layer”, because your data, inference, and yes model are no longer a moat. Your harness might be though..