Production agents need infrastructure around them, including identity, policy boundaries, verification, audit logs, and human approval for risky actions.
2
Financial AI becomes useful when it is grounded in firm-specific data, deterministic calculations, repeatable workflows, and evidence that people can inspect.
3
Compute is becoming a market with its own financing, operating, pricing, and trading problems because hardware alone does not determine useful intelligence.
Summary
This is a full-day compilation from AI Engineer New York 2026, covering how financial and enterprise teams are putting agents into production. Speakers describe systems for policy-driven workflows, specialist models, agent swarms, verification, memory, MCP gateways, context optimization, and secure credentials. Several talks argue that agents should operate inside deterministic controls, with humans retaining authority over high-risk decisions. Financial-services speakers focus on proprietary data, portfolio construction, accounting, security masters, institutional memory, and evidence-backed analysis. Other sessions examine GPU operations, compute financing, physically settled markets, futures, and the difference between chip capacity and usable intelligence. The event also includes views on continual learning, accessibility, software-factory design, and world models. The recurring practical concern is trust. Agents need clear boundaries, measurable outcomes, source-level evidence, and a way to improve without losing control of the workflow.
Applied research can ship alongside frontier models
Alexander Shifchenko argues that Ramp should not wait for future frontier models. Ramp Sheets exposed slow spreadsheet and financial-question-answering tasks, so Ramp Labs post-trained a Qwen 3.5 35B model with Prime Intellect and used it alongside a frontier model as an orchestrator. He also describes cartridges, which compress prepared context for recurring work such as month-end close, and a swarm of 10,000 agents used to penetration-test Ramp. The goal across these examples is to reduce latency and token cost while preserving the quality of the overall system.
Software factories need confidence engineered into the process
Tarik Shocket compares agentic software development with Toyota-style manufacturing. More code and commits do not automatically produce more releases, and human review does not scale when people often accept both correct and incorrect AI judgments. He proposes a code-confidence formula based on clear intent, guide rails, independent verification, and evidence. Verification should be separate from the generation process, while evidence should show what happened and support repeatable review. His examples include large codebases where navigation consumes tokens and long sequences compound errors.
Policy workflows should remain deterministic outside and adaptive inside
Evan Cormos models enterprise work as directed acyclic graphs, with loops inside individual nodes for drafting, checking, and revision. Agents can run independent reviews in parallel, but policy boundaries and required checks remain in place. He recommends defining what good output means, evaluating repeated runs statistically, and using traces as runtime evidence. Teams can move from supervised operation to sampling and then exception handling as measured confidence reaches a policy threshold. His concise design rule is to keep the outer process deterministic while allowing the inner work to adapt.
Financial products close the gap between model capability and usable work
Joseph Kim describes OpenAI's ChatGPT product for financial services, built with Morgan Stanley and Evercore. The product combines financial data, finance-specific interfaces, firm templates, charts, and citation viewers. Kim says MCP connectors alone did not provide sufficient latency, search quality, or reliability, so OpenAI licensed data, hosted it, built its own indices, and used MCP to expose it to models. He presents product design as the layer that turns model capability into work a financial professional can inspect, revise, and share.
Andre Ripka presents incidents involving prompt injection, exposed tokens, DNS exfiltration, privilege escalation, malicious packages, and destructive commands. His defenses include one identity per agent, short-lived scoped credentials, hostile-input assumptions, default-deny egress including DNS, deterministic brokers for tool calls, tenant isolation, audit trails, budgets, circuit breakers, and human approval for high-value actions. He also recommends delaying package ingestion and including security requirements in specifications. The common thread is that model behavior cannot be the only security boundary.
Compute output depends on the operator, not only the GPU
Oliver Kenan frames compute as a commodity whose economic output is useful intelligence. GPU hours measure an input, while the more meaningful future metric is the price per successfully completed task at the required quality. Two deployments using the same B200 hardware can produce different throughput because of serving software, settings, and request mix. Buyers also need availability, speed, security, and operational support. Kenan argues that better operations can reduce cost per acceptable output, but the advantage is relative to competing operators and must be maintained as workloads change.
Trustworthy financial automation needs firm-specific data and evidence
The Apollo and Rowspace discussion describes portfolio construction and warehouse reconciliation as examples where generic chat models are insufficient. A CLO portfolio can depend on legal documents, trade systems, pricing, and firm-specific rules. Rowspace works directly with the team to identify the correct source among conflicting data and turn workflows into repeatable systems. A portfolio that once took days to assemble can be produced in minutes and then reviewed by the portfolio manager. The value comes from accurate internal data and workflow knowledge, not from a general-purpose chatbot alone.
Verification should prevent unsupported numbers from being generated
Venu Ganesh explains Kepler's approach to financial verification. Wrong outputs can come from retrieving the wrong document, extracting the wrong number from the right document, or asking a model to do arithmetic. Kepler preprocesses data, assigns pointers to facts and numbers, and lets code perform retrieval and calculations. The model plans the work, while deterministic systems resolve the pointers. If a pointer cannot be resolved, the system refuses to print the number. Ganesh also stresses tenant-scoped search, source validation, and security checks around every document query.
Agent training can compound an organization's working knowledge
Will Brown argues that enterprise agents need more than prompts, skills, and retrieved files. Organizations contain preferences, heuristics, friction points, and unwritten practices that employees learn over time. Traces, feedback, and evals can turn those experiences into training data. He describes a path from workflow discovery to skills, evals, routing, and eventually model training that captures durable organizational knowledge. Humans can label decisions through direct interfaces, while overnight training runs use accumulated traces to improve models for the organization's recurring work.
"The model is effectively a smart analyst. It figures out how to go about solving the problem but not actually being the thing to solve the problem itself."Venu Ganesh5:55:53
Who should watch
You are building agents for financial or regulated workflows and need a practical approach to permissions, evidence, evaluation, and human approval.
Your team is deciding whether to buy GPU capacity, operate clusters, or use compute markets, and you need to understand the operational and financing trade-offs.
You are moving from agent demos to production and want examples of data foundations, workflow graphs, verification systems, memory, monitoring, and continual improvement.
