Five layers, not four boxes
Channel: the customer app, the employee suite, the merchant plugin, or an MCP server. This is where identity is proven.
Orchestrator: the planner that decomposes a job (“dispute this card transaction”, “assemble a credit memo”) and routes steps. If this layer also holds the money-moving tool, you have a confused deputy.
Specialists: credit, KYC, disputes, inventory, portfolio, legal. Narrow, testable, versioned.
Tools: cores, card processors, document stores, market data, wallets. Every tool call is an audit event.
Governance: limits, allow-lists, human gates, model registry, prompt/version pin, kill switch. This is not a footer. It is a runtime.
Patterns that survive a risk committee
Maker-checker: the agent proposes, a human or a second model with a different prompt/tool set disposes above a threshold.
Read-then-write: retrieval and drafting are cheap; posting to a core is expensive and gated.
Bounded autonomy: refunds under a cap, disputes of a known reason code, KYC field extraction — not “do banking.”
Typed traces: every hop has an actor, a tool, a payload hash, and a duration. If you cannot replay a case, you cannot defend it.
What to measure
Containment, handoff quality, time-to-resolution, override rate, loss given error, cost per resolved intent, and — for money-moving agents — unauthorized-action rate. Accuracy of a demo prompt is not an operating metric.