A language model placed directly between raw data and a credit decision is not an intelligent shortcut. It is an uncontrolled calculation and decision boundary.
This architecture asks a probabilistic reasoning system to infer methodology, perform arithmetic and exercise authority in one opaque step. Inputs may be incomplete; assumptions are not versioned; generated values can be mistaken for calculated values; and identical cases may produce inconsistent decisions. The problem is not that language models are incapable of arithmetic. The problem is that the calculation has no stable computational contract, evidence lineage or independently testable control surface.
The resulting output is difficult to reproduce and audit. A reviewer cannot reliably separate sourced values from inferred assumptions, verify the model and policy versions used, or replay the decision against the same data snapshot. In a controlled financial workflow, those are architecture defects—not stylistic imperfections.
The calculation may be automated while the reasoning workflow remains manual
Financial institutions already possess substantial analytical intelligence: PD, LGD and EAD models; ECL engines; scorecards; migration matrices; vintage analytics; monitoring systems; policy rules; and validation tests. These systems can produce a technically correct output at portfolio scale.
Yet expert time is still consumed running analyses, comparing outputs, locating exceptions, tracing drivers, reconciling results, investigating change, assembling evidence, writing commentary and coordinating follow-up. The analytical calculation may already be automated. The reasoning workflow around it often is not.
The Agent reasons about the workflow. Deterministic tools calculate the risk.
This boundary transforms the question from “Can AI calculate credit risk?” to “How can a controlled reasoning layer reduce the friction between calculation, interpretation, investigation, decision and action?”
A controlled architecture separates calculation, reasoning and authority
The compact pattern is Data → Deterministic Engine → Structured Evidence → Agent → Controlled Action. Its extended form makes validation, tools, decision gates and feedback explicit. The Agent sits after and around analytical computation rather than replacing it.
Deterministic Layer
Agent Layer
Decision Layer
Feedback records outcomes and unresolved issues; it does not silently alter approved models or policy. Any learning mechanism must itself pass a controlled change process.
The deterministic layer owns the financial result
PD, LGD, EAD and ECL calculations belong here, as do scorecard execution, migration matrices, vintage metrics, validation metrics, affordability calculations, policy rules and cut-offs. Their common property is a reproducibility contract:
For the same controlled inputs X and calculation/model version V, the expected output Y is reproducible.
This layer may use R, Python, SQL, APIs, model services, rules engines or existing banking systems. R is one implementation technology, not the architecture. Language choice matters less than typed inputs, controlled versions, tested logic, reconciliation and stable outputs.
A deterministic result is not automatically a correct result: data, methodology and implementation can still be wrong. Determinism makes the result inspectable, testable and repeatable so those risks can be controlled.
The Agent owns investigation—not the approved calculation
Investigate
What changed, when did it emerge and which evidence is missing?
Compare
How does the current result differ from baseline, prior period or benchmark?
Explain
Which measured factors account for the difference, and what remains inferred?
Prioritise
Which exceptions are persistent, material and decision-relevant?
Coordinate
Which approved tool or workflow should run next?
Summarise and track
What must the analyst know, decide or resolve next?
These functions reason across structured evidence. They are fundamentally different from calculating a provision, assigning a score or executing a cut-off.
- Chatbot — primarily responds to messages. An analytical Agent can invoke tools, investigate and maintain workflow state. Its interface may be conversational; its architecture is not.
- Predictive model — transforms X into PD or another prediction. An Agent transforms a goal, context, approved tools and evidence into a workflow.
- Decision engine — applies controlled rules. An Agent may investigate falling approvals across distributions, cut-offs, policy and mix; it should not rewrite decision logic.
Controlled tools bound what the Agent can know and do
calculate_ecl()get_vintage_matrix()get_transition_matrix()calculate_pd_monitoring()run_validation_tests()get_decision_trace()compare_periods()get_reconciliation_exceptions()These interfaces are conceptual, not claims about currently implemented Entimema products. In a production system, every tool has a defined input schema, output schema, permissions, owner, version, timeout, failure state and test suite. Controlled tools create bounded capabilities, reproducibility, traceability, structured output, permission control and a clean separation between reasoning and calculation.
The Agent should ask a controlled system “What is the ECL?” rather than inventing the ECL itself.
Tool results should expose fields such as:
metric current_value baseline_value deviation population exposure as_of_date source_period model_version calculation_version status evidence_reference
No result, zero and successful calculation are different states. A timeout, empty payload or failed validation must never be coerced into a valid financial value. Results also require freshness controls: EvidenceAge = T_current − T_evidence.
Context must retain its source and authority
General knowledge
Credit-risk concepts and broadly applicable analytical patterns.
Controlled institutional context
Approved methodology, policy, definitions and operating procedures.
Current analytical evidence
Live or period-specific outputs from controlled tools and snapshots.
Workflow state
Investigations performed, approvals given, cases open and actions completed.
The Agent must not treat these sources as interchangeable. General knowledge cannot override institutional policy; a retrieved methodology is not a freshly calculated metric; and conversational history is not an approved analytical input.
Retrieval finds existing methodology or evidence. Calculation produces a deterministic result. Reasoning interprets evidence. Action changes workflow or system state. Each transition requires different validation and authority.
Useful memory can preserve prior investigations, unresolved cases, analyst decisions, explanations and workflow state. Critical financial calculations should not depend on vague conversational memory; controlled systems remain the source of approved inputs.
Analytical capability does not imply decision authority
These permissions should not automatically be identical. An Agent may be analytically capable while having no authority to approve credit, change staging, post provisions or modify model parameters. Separating analytical authority from decision authority is intentional system design.
Begin with the safest architecture that creates real value
Read-only Agent
A read-only Agent can inspect outputs, compare periods, identify exceptions, explain movements and prepare evidence while remaining unable to change a model, policy, parameter, accounting entry or credit decision. This already reduces analytical handling and gives reviewers a consistent evidence pack.
Human-in-the-loop
Human review is not an embarrassment or temporary limitation. It is a deliberate control layer that allocates accountability while the Agent improves the quality, consistency and speed of review.
Human-on-the-loop
Where a process, permissions and exception boundaries are sufficiently mature, automation may execute approved actions while humans supervise outcomes and exceptions. This is not universally suitable: authority, reversibility, materiality, legal obligations and operational risk determine where it is appropriate.
The same boundary supports multiple credit-risk workflows
Provisioning Agent
A deterministic ECL engine calculates ECL. The Agent investigates month-on-month movement, stage migration, scenarios, parameters and reconciliation exceptions, then prepares analyst evidence.
AI Portfolio Analyst
A vintage engine calculates cohorts, MOB, default rates and baseline deviations. The Agent investigates deteriorating vintages, divergence timing, segment concentration and EAD materiality.
AI Collections Analyst
A migration engine calculates transitions, roll-forward, cure and EAD-weighted migration. The Agent investigates worsening transitions, deteriorating cure, concentrations and priority exposures.
Model Validation Agent
A validation engine runs discrimination, calibration, stability, parity and benchmark tests. The Agent compares runs, investigates exceptions, drafts findings and tracks remediation.
Model Monitoring Agent
A monitoring engine calculates population, score and PD drift, discrimination, calibration and implementation parity. The Agent asks what changed, where, whether it persists and which controlled review is required.
An Agent does not require a separate public R article for every workflow. It requires approved analytical services and well-governed evidence interfaces, whatever their implementation language.
Agentic value emerges in evidence-led, multi-step investigation
A user asks: Why did ECL increase 18%? The Agent plans an investigation, retrieves portfolio movement, stage migration, exposure movement, parameter changes and scenario impact, then identifies the largest contributors. Each new result determines the next approved tool—not a predetermined narrative.
Hypothetical investigation
Portfolio ECL increased 14% month-on-month. Controlled outputs show exposure +2%, Stage 2 EAD +11%, PD effect +3%, LGD effect approximately flat, downside scenario contribution +1%, with concentration in two recent vintages. The defensible conclusion is: the increase is primarily associated with Stage 2 migration rather than broad LGD deterioration. These figures are illustrative, not benchmark results.
If portfolio PD rises while realised defaults remain stable and early-stage migration worsens, evidence is mixed. A disciplined output says deterioration is visible in leading indicators but has not yet appeared in realised defaults. It does not force certainty.
Evidence first. Narrative second. Retrieve or calculate → verify → interpret → explain.
Every conclusion needs inspectable evidence lineage
An Agent Run ID connects the investigation to its operational record:
agent_run_id agent_version user_request tools_called tool_versions evidence_refs outputs human_review action timestamp
Calculation replay means the same inputs and version return the same analytical output. Agent investigation replay reconstructs the tools invoked, evidence received and conclusions produced. Exact wording may differ across probabilistic runs; evidence lineage, permissions and action history must remain inspectable.
Guardrails must control tools, data, calculations and actions
Tool guardrails
Allow-list functions, validate arguments, bound retries and expose explicit errors.
Data guardrails
Enforce identity, portfolio scope, field-level access, retention and trusted-source boundaries.
Calculation guardrails
Keep approved formulae, parameters, versions and reconciliation deterministic.
Action guardrails
Constrain state changes, require idempotency and provide reversal or compensating controls.
Human approval
Route material or irreversible actions to named decision owners.
| Failure | Control breakdown / financial risk | Mitigation |
|---|---|---|
| Uncontrolled arithmetic or hallucinated explanation | Generated value or narrative is mistaken for approved evidence. | Require calculation tools, evidence references and claim verification. |
| Stale data or wrong model version | Decision uses an invalid period or methodology. | Return as-of date, source period and versions; enforce freshness and compatibility. |
| Unsupported causal inference | Association becomes an unjustified driver claim. | Label inference; test alternatives; constrain causal language. |
| Tool output misunderstood or missing evidence | Units, grain or population are misrepresented. | Typed schemas, semantic metadata, validation and escalation. |
| Silent tool failure | No result becomes zero or a plausible value. | Explicit status union; fail closed; prohibit numeric coercion. |
| Duplicate or unauthorised action | Entries, communications or decisions execute twice or without authority. | Idempotency keys, permission checks, approval gates and action ledger. |
| Prompt injection in untrusted content | Retrieved text attempts to redirect tools or exfiltrate data. | Treat content as data, isolate instructions, restrict tools and validate destinations. |
| Workflow state loss | Cases are repeated, skipped or falsely closed. | Durable state store, transitions, checkpoints and reconciliation. |
Other material failures include incorrect permissions, contradictory evidence being suppressed and an action executing without the appropriate authority. Controls must be tested against failure—not merely documented.
Evaluate investigation quality, not conversational polish
- Tool selection: Were the appropriate tools called in a defensible order?
- Evidence accuracy: Were values, populations, units and versions represented faithfully?
- Reasoning discipline: Did conclusions follow evidence without unsupported causality?
- Completeness: Were material alternative explanations investigated?
- Escalation: Did the Agent expose uncertainty and failure?
- Action safety: Did it remain within permissions and approval boundaries?
Golden investigations
A — Stage migration
ECL increase follows the expected migration drill-down.
B — Channel concentration
Vintage deterioration is isolated to one channel and tested for materiality.
C — Calibration
Calibration deteriorates with stable ranking; recalibration investigation is proposed, not automatic redevelopment.
D — Tool failure
Failure is surfaced and escalated; no answer is invented.
E — Insufficient evidence
Unknowns and the evidence needed next are explicit.
F — Outside authority
The Agent refuses execution and routes to the controlled workflow.
Production observability should monitor Agent runs, tools called, tool latency and failures, evidence freshness, permission denials, human overrides, escalation rate, unsupported-claim rate, duplicate-action prevention and downstream outcomes. Review samples by risk and materiality, not only at random.
Implement control before expanding autonomy
AI belongs around controlled analytical systems
The financial model remains the authority for controlled calculation. The Agent reduces the operational distance between that calculation and an informed, governed response: it finds evidence, chooses approved tools, tests explanations, exposes uncertainty, prepares review and coordinates the next controlled step.
That is the transformation: calculation → interpretation → investigation → decision → action, connected without collapsing their controls. The result is neither an LLM tutorial nor a claim that AI replaces analysts. It is a system architecture in which deterministic computation, bounded reasoning, explicit authority and human judgement work together.