FinAgent RiskOps

The problem

Retrieval-augmented systems become risky when they can use tools, act on incomplete context, or receive untrusted instructions. The design goal was to provide useful, source-grounded assistance while ensuring that uncertain or unsafe situations stopped in a reviewable state.

Architecture

The workflow is modelled as a graph rather than a single prompt. It classifies the request, performs retrieval through pgvector or FAISS, runs prompt-injection and PII checks, chooses an allowed tool when needed, and produces an answer with source context. Kafka handles ingestion, while Redis supports carefully bounded cache and memory layers.

Guardrails

• Retrieval results are treated as data, not instruction authority.
• Prompt-injection checks run before tool selection.
• PII redaction happens before a model provider receives content.
• Human review gates handle high-impact or low-confidence outcomes.
• Provider and tool failures produce an explicit degraded result rather than a fabricated answer.

Evaluation posture

Evaluation datasets capture common questions, adversarial inputs, missing-source cases, and unavailable dependencies. Traces record the graph path, retrieval evidence, tool selection, and safety decision, making it possible to improve behavior without relying on a final answer alone.

Takeaway

Agentic systems should be designed like workflows with evidence and exits. A model is one component in the system, not the place where reliability or policy is delegated.