Home ยท Research

Research

Production architecture and research synthesis for governed AI systems in regulated financial services.

Architecture papers

AI systems research

Deterministic-First Agents

Where should autonomy stop? A certainty-gradient architecture for placing rules, calibrated models and bounded reasoning inside a deterministic control envelope.

Model-Risk Evidence for Agentic Systems

What evidence proves safe behaviour? A trajectory-assurance model spanning evidence, tools, order, policy, recovery, approval and observed effect.

Governed Context Architecture

What context can a bank stand behind? Reconstruction, authorization, evidence coverage, temporal provenance and governed active memory.

Research synthesis
28 references, 2022-2026, multi-agent orchestration / topologies / failure taxonomies / evaluation / governance

What would it take to run a multi-agent language model system inside a global financial institution, where every action is subject to audit and every decision must be attributable to an accountable party?

Research programme 2023-2026 Regulated production needs Reasoning + acting (ReAct) Reflection + self-critique Orchestration frameworks Communication topologies Failure taxonomies (MAST) Evaluation benchmarks Attributable delegation Topology change control Independent verification Adversarial + version evals Human approval gates GOVERNED AUTONOMY Certainty gradient Autonomy ledger Topology governance Adversarial twin verification Autonomy as a graduated, auditable privilege rather than a default capability
Position

I argue that the distance between multi-agent research demonstrations and regulated production deployment is primarily a governance gap, not a capability gap. Synthesising the 2023-2026 literature on orchestration frameworks, communication topologies, failure taxonomies and evaluation, I propose a four-part reference architecture, a certainty gradient, an autonomy ledger, topology governance and adversarial twin verification, offered as synthesis and position rather than novel empirical result.

Findings
  • Topology shape, not raw agent count, is the dominant predictor of task success, with returns diminishing beyond roughly a dozen agents (Qian et al., 2024)
  • MAST's fourteen failure modes fall into three categories, specification, inter-agent misalignment and verification, each carrying a distinct governance implication
  • Cost-controlled comparisons often narrow or eliminate the apparent advantage of complex multi-agent designs over simpler pipelines (Kapoor et al., 2024)
  • Practitioner-observed authority creep: individually reasonable delegation decisions accumulate into actions no single human reviewer would have approved, motivating the autonomy ledger
Open questions
  • Topology governance stands in direct tension with self-optimising graph research (GPTSwarm, Automated Design of Agentic Systems), which treats autonomous rewiring of the communication graph as a desirable capability
  • None of the four proposed mechanisms has been evaluated in a controlled, published sense, and a well-instrumented autonomy ledger is useless without a governance body with an explicit mandate to act on what it reveals
Design implications

A four-part reference architecture for regulated multi-agent deployment: certainty gradient, autonomy ledger, topology governance and adversarial twin verification

Read the paper
28 references, 2019-2025, long-context degradation / compression and streaming / structured agent memory / retrieval and GraphRAG / memory security

How should a long-horizon agent's memory be architected for regulated operation, given that unbounded context accumulation demonstrably degrades performance and cannot answer what is currently true?

Drift mechanisms Context rot + lost in the middle: accumulation degrades use of context Memory poisoning: unverified writes Stale, superseded facts still recalled Agent turn or session Candidate fact or update Provenance gate source required Reconcile + retire superseded facts Markovian reconstruction: working context rebuilt, bounded Reject and log the attempt GOVERNED CASE STATE current, source-attributed no source write rebuild from state, not from raw history next session Solid: the write and rebuild cycle. Dashed: drift mechanism addressed by the element below. Not what the agent ever observed, but what it currently believes and on what evidence
Position

I argue that the dominant ever-growing buffer or memory-stream pattern conflates remembering that something happened with knowing what is currently true, and accumulates unverified content that is both an accuracy risk and a separately exploitable security vulnerability. I propose Markovian case-state reconstruction with provenance-gated writes, in which working memory is periodically rebuilt from a compact, governed, source-attributed case state rather than extended indefinitely, and every write must carry a verifiable source.

Findings
  • Larger context windows do not solve recall: mid-context information is used less reliably (Lost in the Middle), effective context falls short of advertised limits (RULER, BABILong), and accuracy degrades as irrelevant content accumulates even when the needed fact stays in place (context rot)
  • Compression, streaming and structured memory architectures address context management and recall but leave state maintenance, knowing what is currently true, implicit or unaddressed
  • Memory is an attack surface: a small number of poisoned entries can reliably backdoor an agent's future behaviour (AgentPoison), so the write path deserves at least as much security scrutiny as the read path
  • Retrospective provenance tagging of an existing agent's memory typically reveals how large a fraction has no recoverable source, often the single most persuasive evidence for migration
Open questions
  • Periodic reconstruction discards conversational narrative and adds latency and compute at each session boundary, costs that must be weighed against the context rot and unbounded accumulation it avoids
  • Provenance gating depends on a domain-specific taxonomy of acceptable sources, and deciding which business function owns that definition often takes longer than building the gate itself
Design implications

Proposes Markovian case-state reconstruction with provenance-gated writes: a governed, source-attributed case state from which the agent's working context is periodically rebuilt

Read the paper
27 references, 2015-2024, inference serving / routing and cascades / speculative decoding / quantisation / distillation / caching

Should the router or cascade controller that decides which model answers each request be treated as a governed model in its own right, rather than as inert infrastructure?

The cost stack of a production language system Incoming query Semantic cache similarity check Cache hit: answer served, no inference ROUTER a governed model drift monitored tested fallback change-controlled Small tier ~1/20 cost Mid tier ~1/5 cost Frontier tier full cost Monthly cost 210k naive 54k stacked 74% lower Serving levers speculative decoding (exact) | 4-bit quantisation | distillation (narrow tasks) hit, ~8% miss 65% 25% 10% verify fails Savings are only real if the router's decision boundary is monitored and governed
Position

I argue that inference cost is not a single number but the product of separable decisions, which model answers, how tokens are decoded, at what precision weights are stored, and whether a cached answer suffices, and that the component coordinating these decisions is functionally a model with real financial and quality consequences. It should therefore be calibrated, drift-monitored, fallback-tested and change-controlled with the same rigour applied to the language models it selects between; the worked savings are only real if the router is governed.

Findings
  • Speculative decoding is the rare cost technique with a mathematically exact guarantee of no change to output quality, making it the easiest first step to gain model risk approval for
  • In a worked example, semantic caching, cascaded routing and quantised lower tiers compound to roughly a 74 percent cost reduction against a single frontier-model baseline, with routing the largest single lever
  • Similarity thresholds safe for customer-facing traffic yield semantic cache hit rates in the low single digits in practice, well below the double-digit rates quoted in vendor benchmarks
  • Distillation is a capital cost rather than an operating cost: it pays off for high-volume, narrow, stable tasks and is disfavoured where requirements shift frequently
Open questions
  • The routing literature implicitly assumes a fixed per-token cost per model, yet serving-system choices such as batching, paging and caching change those costs, an interaction the published research does not treat as a single governed system
  • A drifting router has no ground truth signal telling it that it has drifted, so headline savings can persist on paper while answer quality quietly degrades on unwatched traffic
Design implications

Reframes the router or cascade controller as a governed model requiring drift monitoring, a tested low-confidence fallback path, change-controlled thresholds and periodically refreshed holdout validation

Read the paper