Context Is Not Authority: Structured Runtime Governance for Financial Market Agents

SAGE-Fin is a finance-specific authority-handoff contract that addresses the context-to-authority failure in financial market agents, where natural-language context can be relevant, fluent, and factually correct while still lacking runtime authority for the current claim, recommendation, policy, or execution adapter. The paper's central research object is an authorization unit that joins a re-derived typed candidate, institutional witness/debt state, exact artifact, current state, and nominal receipt accepted by the consuming adapter. The paper makes four contributions: (1) identifying the context-to-authority failure mode; (2) introducing SAGE-Fin, a finance-specific effect-boundary authority contract whose authorization unit joins a typed candidate, institutional witness/debt state, exact artifact, current state, and nominal adapter receipt, yielding receipt non-substitution, consumption-time revocation, and typed recovery under complete mediation; (3) formalizing typed, non-substitutable, state-contingent receipts and proving trace-level authority non-amplification—non-consumption events cannot create governed effects, each effect requires a prior exact-artifact adapter receipt valid under current state, and progress or wrong-adapter receipts cannot substitute for effect authority; and (4) evaluating the mechanism with 616 authored cases and 3,080 diagnostic outputs, achieving 616/616 catalog-wide parity including 3/3 named prototype response-gate fixtures, and 22 tests, while separately distinguishing this public conformance evidence from later production deployment, a strongly positive formal review independent of implementers, strongly positive end-user feedback, and three distinct predecessor failures with independently confirmed 0/3 interception.

The paper identifies six recurring failure patterns: signal hardening (a soft signal becomes a stronger claim than evidence permits), evidence staleness (a quote or snapshot used after its validity window), coverage debt hiding (required witnesses absent but masked by confident prose), receipt misuse (a budget reservation or progress receipt treated as execution permission), dialogue-to-policy deployment (ambiguous verbal risk-control intent compiled into deployable policy), and authority drift across turns (a candidate compiled with valid authority at turn t1 re-emitted at turn tk without recompilation). These failures are organized into four NL-driven adversaries: (A) signal-hardening adversary, (B) stale-context adversary, (C) receipt type confusion and cross-artifact reuse, and (D) dialogue-policy injection adversary, each mapped to a SAGE-Fin defense.

The SAGE-Fin architecture includes a deterministic compiler Γ that produces typed candidates, witness and validator registries that determine coverage debt, a dynamic authority controller that contracts permissible authority under current market, account, policy, and dialogue state, and type-restricted adapters that require exact-artifact receipts whose nominal type matches the consuming response, execution, or policy adapter. The financial execution lifecycle is: market signal / model analysis / dialogue intent → typed candidate → witness binding → coverage diagnostic → dynamic authority controller → quote → reserve → confirm reservation hold → final authorize → authorize execution → execute or block → reconcile → update future authority. The risk-control policy lifecycle is: dialogue → policy intent → policy candidate → deterministic policy IR → validation → fixtures → shadow mode → deployment receipt → runtime enforcement → rollback / reconciliation.

Coverage debt is the set of required witnesses or validators that are missing, stale, unpromoted, or invalid for a candidate, and it can downgrade commitment level, block execution authorization, or require clarification, repair, escalation, or human approval. Receipts are scoped artifacts binding a candidate, exact artifact, subject, evidence and policy state, cap, and validity window, with non-substitutable types: evidence, budget, validation, fixture-test, and shadow-mode receipts support audit or promotion but grant no effect authority, while adapter receipts include scoped commitment for response emission, execAuth for execution, and deploy for policy enforcement. The paper formalizes the consumption-time gate requiring that a receipt is valid for adapter g only if its nominal type is in the adapter's acceptance set, the issuer is trusted, time bounds hold, candidate and exact-artifact hashes match, subject/scope/policy bindings match, and state predicates hold.

The formalization includes Theorem 1 (trace-level authority non-amplification), Theorem 2 (receipt non-substitutability), Proposition 2 (upstream-validation non-escalation), Theorem 3 (soundness of the execution gate), Theorem 4 (soundness of the policy enforcement gate), and Proposition 3 (conditional authority contraction). The paper also instantiates an optional latent-regime witness using a Hidden Markov Model (HMM) with filtered posterior b t, normalized entropy H(b t), and freshness indicator, where the regime witness can contract execution authority but is not an alpha model. Theorem 5 gives state-contingent revocation: if any bound condition fails at consumption, the execution gate rejects the receipt. The paper also details the dialogue-to-policy path requiring deterministic policy IR, validation, fixture replay, shadow evaluation, registry promotion, and owner-approved deployment before a deploy receipt can authorize enforcement.

Evaluation evidence comes from four separately interpreted sources: a reference catalog (616 authored cases, 3,080 case–specification outputs), prototype tests and catalog-wide cross-implementation parity (616/616 binary reference–prototype parity, 22 tests), three distinct production failures from the predecessor response workflow with second-analyst confirmation of 0/3 interception, and later bounded operation of the SAGE-Fin response gate with a formal implementation-independent operational review reaching a strongly positive conclusion on practical usefulness and workflow fit, with end-user feedback likewise strongly positive. The paper emphasizes that these results establish executable conformance, not independent safety accuracy, and that the field evidence is implementation-independent qualitative corroboration rather than an aggregate effect estimate. The three predecessor failures are: Scenario A (cached authority across dialogue—reused SOP answer after intervening dialogue), Scenario B (stale account-scoped evidence—generic schedule used for account-specific fee response), and Scenario C (terminal workflow with missing routing state—progression without current routing authority). The paper specifies a prospective aggregate replay protocol with six invariant families and falsifiers, contributing no result in the current study.

The paper's scope is intentionally limited: SAGE-Fin does not decide whether a strategy is profitable, does not establish causal alpha, does not discover all validators autonomously, and does not certify regulatory compliance across jurisdictions. Its claim is that the runtime can determine whether a proposed financial action has authority under declared witnesses, validators, policies, receipts, and current state. The principal empirical limitation is self-authored conformance—rules, mappings, and oracles were developed against the same catalog, so 616/616 tests declared semantics rather than independent safety accuracy, generalization, or extraction fidelity. The paper concludes that SAGE-Fin is not a profitable trading agent but an auditable authority mechanism, with the finite-trace result showing that non-consumption progress cannot create a governed effect and that every effect requires a prior exact-artifact adapter receipt valid at consumption.

Improvements to AI systems:

1. Add a runtime authority gate to LLM response generation. Before emitting any claim, recommendation, or action, the system must produce a typed receipt binding the exact output artifact, current state (market, account, policy, dialogue), and a valid witness. This prevents fluent but unauthorized outputs.

2. Implement non-substitutable receipt types for different action classes. Distinguish evidence, budget, validation, and execution receipts. The system rejects using a budget reservation or progress receipt as permission to execute a trade or deploy a policy. This eliminates receipt type confusion.

3. Enforce consumption-time revocation. At the moment of execution or response emission, re-validate all bound conditions (time bounds, state predicates, artifact hashes, policy bindings). If any fail, block the action. This catches stale evidence and expired authority mid-conversation.

4. Track coverage debt explicitly. Maintain a registry of required witnesses/validators per candidate. If any are missing, stale, or invalid, downgrade the commitment level or require clarification/escalation—never silently proceed with confident prose.

5. Prevent authority drift across turns. Recompile the typed candidate and re-issue a fresh receipt at every turn where the candidate is re-emitted. Do not reuse a receipt from an earlier turn without revalidation against current dialogue and market state.

6. Add a dialogue-to-policy compilation barrier. Convert verbal risk-control intent into a deterministic policy IR, then require validation, fixture replay, shadow-mode evaluation, and owner-approved deployment before any deploy receipt grants enforcement authority. This blocks ambiguous intent from becoming live policy.

7. Use a latent-regime witness (e.g., HMM posterior) to contract authority conditionally. When regime uncertainty is high (high entropy), automatically reduce execution authority or require human approval—without treating the regime model as an alpha signal.

8. Provide trace-level auditability for every governed effect. Log each receipt issuance and consumption. Prove that no effect occurs without a prior exact-artifact adapter receipt valid at consumption time. This enables post-hoc verification and rollback.

What the improved AI system can do:

• Generate responses or execute financial actions only when runtime authority is verified against current state and exact artifacts.

• Refuse to substitute a stale quote, generic schedule, or cached answer for a current, account-specific, authorized one.

• Distinguish between I can discuss this and I am authorized to execute this—and never conflate them.

• Detect when required evidence is missing and explicitly ask for clarification or escalate, rather than producing confident but unsupported output.

• Prevent a policy derived from casual dialogue from being deployed without rigorous validation and owner approval.

• Automatically revoke authority mid-execution if market conditions, account state, or policy bindings change.

• Provide a complete audit trail showing exactly which receipt authorized each effect, enabling rollback and reconciliation.

• Operate as an auditable authority mechanism, not a profit-seeking agent, ensuring compliance with declared policies and validators.