Inside the agent stack: full architecture deep dive

Our agents are the part of the stack that surfaces signal continuously, without human prompting. They are also the part most often misunderstood — agents in 2026 are either over-anthropomorphised (treated as junior analysts that can be trusted with arbitrary judgement) or dismissed as glorified RSS readers (treated as crawlers with sentiment scoring stapled on).

Neither is right. This post is the architectural truth of the three agents that power Risk Heartbeat at DF Analytics: what each one watches, how the outputs combine, the guardrails, and the integration points with the rest of the stack.

If you are evaluating agentic AI for institutional finance — ours or someone else's — this is the level of detail that should be standard.

13-minute read · Updated 16 May 2026

Key takeaways

• An agent is a tuple of seven elements: source perimeter, purpose, control loop, reasoning stack, guardrails, challenger, and audit interface. Missing any of them disqualifies a system as an 'agent'.
• Three production agents — Issuer Scout (filings, transcripts, news, alt data), Microstructure Watcher (liquidity, order flow), Regulatory Crawler (rule changes, enforcement).
• The Risk Heartbeat composite applies the two-of-three coherence rule across the three agents and surfaces the top-decile entities as a ranked stream.
• Agents feed the Quant Core through three integration points: feature inputs, regime re-estimation triggers, and PortIQ scenario calibration. Agents never trade or change positions.

The three agents in one sentence each

• Issuer Scout — monitors filings, transcripts, news, and alternative data for issuer-specific signals across the investable universe.
• Microstructure Watcher — tracks liquidity, order-flow anomalies, and market-impact indicators across instruments.
• Regulatory Crawler — ingests rule changes, enforcement actions, and informal supervisory communications across jurisdictions.

Each runs 24/7 against its own source perimeter, writes into the shared Knowledge & Features store (layer 2 of the architecture), and contributes to a unified output stream we call Risk Heartbeat — a continuous, prioritised feed of structured signals.

Architecture — how an agent is actually built

We define an agent as a tuple of seven elements. This is what we mean when we say "agent":

1. A source perimeter — the specific data sources the agent is allowed to read.
2. A purpose — the structured outputs it is designed to produce.
3. A control loop — the scheduling logic that determines when it runs.
4. A reasoning stack — the combination of LLM(s), retrieval index, and classical components used to produce outputs.
5. A guardrail layer — rate limits, cost caps, hallucination controls, escalation triggers, allowlists.
6. A challenger — a parallel implementation against which outputs are continuously compared.
7. An audit interface — the surface through which the agent's actions, inputs, and outputs are inspectable.

A "feature" with an LLM in it is missing several of these. A serious agent has all seven.

Issuer Scout in detail

Source perimeter

• SEC filings (10-K, 10-Q, 8-K, proxy statements, S-1/S-3, Schedule 13G/13D).
• ESMA filings and regulated disclosures across EU national exchanges.
• DIFC and GCC issuer disclosures.
• Public earnings call transcripts.
• Aggregated news (curated source list, ~800 sources).
• Selected alternative data feeds (jobs postings, supply-chain indicators, satellite-derived where licensed).

Purpose

Produce structured signals at the issuer level: capex revisions, language shifts, disclosure changes, sentiment composite, peer-relative anomalies. Each signal carries a confidence score and an evidence chain.

Control loop

Scheduled by source type. Filings are picked up on submission. Transcripts are processed on publication. News runs on a rolling 15-minute cycle for top-priority issuers, hourly for the broader universe. Alternative data runs at the cadence of the underlying provider.

Reasoning stack

A two-tier design (more on this in next week's post): a cheap "scout" classifier triages every input for relevance, and a deeper LLM-driven extractor processes only the inputs that pass triage. The deeper extractor produces structured output validated against a schema; failed schemas are retried with a refined prompt or escalated.

Guardrails

• Rate limits on source providers (negotiated per provider).
• Cost cap per issuer per day; alerts on approach.
• Hallucination control: structured outputs are validated against the source text; outputs where the evidence chain does not support the structured claim are rejected.
• Allowlist of source domains; agent cannot fetch from non-allowlisted sources.
• Human-escalation trigger: confidence below threshold on a top-decile signal escalates to a human reviewer.

Challenger

A rules-based extractor running on the same inputs. Disagreement events are logged and reviewed in the weekly agent stand-up.

Audit interface

Every action — every fetch, every model invocation, every output — is logged with input, output, cost, latency, and confidence. Exportable per agent, per source, per time window.

Microstructure Watcher in detail

Source perimeter

Market-data feeds for equities, fixed income, FX, listed derivatives, and selected OTC venues. Order book depth where available, trade prints, bid-ask spread series, cross-market correlations.

Purpose

Detect microstructural anomalies that often precede price moves: bid-ask widening without yield/price change, order book depth withdrawal, unusual trade clustering, cross-market decoupling.

Control loop

Near-real-time on top-priority instruments; 5-minute cycles on the broader universe. Anomaly detection runs continuously; thresholding and clustering run in 15-minute windows.

Reasoning stack

Largely classical: statistical anomaly detection (rolling z-scores, regime-conditional thresholds, Bayesian change-point detection) combined with cross-asset correlation analysis. LLM components are limited to producing the natural-language explanation of detected anomalies for downstream consumption.

Guardrails

• Rate limits on data feeds.
• Throttling on alert production to prevent floods during volatile periods.
• Suppression rules during known event windows (e.g. economic data releases) to reduce false positives.
• Human-escalation trigger on composite anomaly score crossing a configured magnitude.

Challenger

A second anomaly-detection family (deep autoencoder reconstruction) runs in parallel. Disagreement events are tracked.

Audit interface

Standard agent audit, plus the underlying statistical reasoning is fully reconstructible (anomaly score with the input series and the model parameters preserved).

Regulatory Crawler in detail

Source perimeter

• Public supervisory communications (ESMA, EBA, ECB, FCA, BaFin, FINMA, DIFC DFSA, US Fed, SEC, OCC, FINRA).
• Enforcement action databases.
• Public consultation papers, technical standards, and guidelines.
• Trade-press sources for enforcement reporting.
• Selected national gazettes for regulatory publications.

Purpose

Surface regulatory changes that affect specific firms, sectors, or activities. Produce structured signal entries tied to the affected entities and the regulatory perimeter.

Control loop

Polled per source on the source's natural cadence. Critical sources are monitored at sub-hour intervals; less critical sources are hourly or daily.

Reasoning stack

RAG-grounded LLM extraction against the curated source set. Structured outputs (entity, jurisdiction, regulatory perimeter, action type, severity, affected firms) validated against a schema. Severity classification is calibrated against a historical labelled set of regulatory actions.

Guardrails

• Strict source allowlist (regulatory feeds only).
• Output rejection if no source citation is produced.
• Hallucination control via cross-source consistency (where two regulators issue communications on the same topic, both citations must be present).
• Human-escalation trigger on high-severity classifications.

Challenger

A rules-based classifier on the same inputs, focused on perimeter classification.

Audit interface

Standard agent audit. Every published Risk Heartbeat regulatory signal links to the source documents.

How the outputs combine — the Risk Heartbeat composite

Each agent writes its outputs into the shared Knowledge & Features store with a common schema: entity (issuer or instrument), signal type, confidence, timestamp, evidence chain, source agent.

The Risk Heartbeat composite is the layer that combines these into the prioritised stream we publish in our monthly notes and surface inside PortIQ and CyronOS.

The composite logic is:

• For each entity, aggregate all open signals from each agent.
• Apply the two-of-three coherence rule — a signal is promoted to the Risk Heartbeat output only if at least two of the three agents have flagged the entity within a defined window.
• Score the composite by combining signal magnitudes with persistence (the longer a signal stays open across multiple agents, the higher the composite).
• Rank entities by composite score; the top decile is the Risk Heartbeat output.

This is the same logic Epsilon uses for idiosyncratic risk scoring. The Risk Heartbeat output is a strict superset — Epsilon is one of the layers that consume it.

Integration with the Quant Core

The agent outputs do not act on portfolios directly. They feed the Quant Core (layer 4 of the architecture) and the Risk Brain (layer 3) through three specific integration points:

• Feature inputs to Time-Series Forecasting. Agent-derived sentiment and microstructure features enter the feature store and are available as inputs to the forecasting engines.
• Triggers for regime-aware factor re-estimation. Composite agent coherence above threshold can trigger the Quant Core's factor model to switch to a shorter, regime-aware estimation window (with the governance gates described in the governance post).
• Inputs to PortIQ scenario interpretation. When a PM types a scenario into PortIQ, the Risk Brain consults current agent state to calibrate the factor shocks; current liquidity stress from Microstructure Watcher influences the liquidity-profile output.

The agents do not place trades. They do not change portfolio positions. They produce structured signal that informs human and model decisions further down the stack.

What this means for the buyer

Three implications if you are thinking about agent-based AI for risk and analytics:

• Architecture matters more than the model. Foundation models will change; the architecture that bounds and audits the agents will not. Buy the architecture.
• The audit interface is the test. If an agent cannot reproduce its action trail in detail on demand, the agent is not deployable in an institutional environment.
• Coherence is what makes agent output useful. A single agent producing single-source signal is a flood of noise. Multiple agents with composite coherence rules are a manageable, ranked stream.

Coming next

14 April — Two-tier agents: why we run cheap scouts before deep ones. The cost and quality argument for the two-tier design that appears across all three agents.

Frequently asked questions

What is an AI agent stack?

A coordinated set of autonomous AI components — each with a defined source perimeter, purpose, control loop, reasoning stack, guardrails, challenger model, and audit interface — that work against a shared knowledge layer to produce structured signal for downstream consumption.

How many agents does DF Analytics run?

Three production agents: Issuer Scout, Microstructure Watcher, and Regulatory Crawler. Each runs 24/7 against its own source perimeter and contributes to the Risk Heartbeat composite.

What is the Risk Heartbeat composite?

A unified output stream that combines signals from all three agents. Entities are flagged when at least two of three agents have raised signals within a defined window (the two-of-three coherence rule) and the composite ranks in the top decile.

How do agents stay safe?

Each agent runs inside a configured guardrail layer: rate limits, cost caps, source allowlists, hallucination controls, human-escalation triggers. The bounds are part of the agent's definition, not external wrappers.

Do agents place trades or change portfolio positions?

No. Agents produce structured signal that informs human and model decisions further down the stack. They are not autonomous trading systems.

Related reading

• AI-native risk intelligence: 5 tests for 2026
• Two-tier agents: why we run cheap scouts before deep ones
• Governance by default: 9 principles for AI in finance

External references

• Deep Finance Analytics — technology architecture
• Deep Finance Analytics — AI agent systems products
• NIST AI Risk Management Framework

About the author — CTO Office — Deep Finance Analytics. The CTO Office owns the platform architecture, the agent stack, and the governance substrate across the product portfolio. See the Insights hub for the full archive, or book a discovery call to discuss this post with the team.