The question with financial agents is not model capability but where the approval boundary sits.
Key facts
| Fact | Detail |
|---|---|
| Question answered | Financial Agents: Where OpenAI, Anthropic and Two Sigma Put the Human |
| Short answer | At AI Engineer New York, OpenAI described a threshold of usefulness for financial agents, Anthropic laid out an identity, sandbox and approval layer, Two Sigma warned about approval fatigue, and Bloomberg argu… |
| Reading time | ~4 min |
| Last updated | 2026-10-24 |
At AI Engineer New York, OpenAI, Anthropic, Two Sigma and Bloomberg converged on one answer: grant autonomy per action, not per model (source).
OpenAI: the threshold is about time saved
Joseph Kim, Head of ChatGPT for Financial Services at OpenAI, framed adoption around a “threshold of usefulness” — the point where a model becomes capable and reliable enough to save you time. His prediction for 2027 is that the industry relies less on Excel and PowerPoint and that agents become good enough for investment idea generation and trading.
Two details in that talk matter more than the forecast:
- Traceability is treated as part of the product, not an audit afterthought. In finance, Kim said, you need to check where a number came from and understand the context around it.
- Human-in-the-loop is a product design decision. The questions he posed were about the interface: what does the user still control, review or approve, and how does the screen change when the agent proposes rather than acts.
That framing moves the work from “pick a safer model” to “design the review step”, which is where most local agent deployments on Windows fall short: the approval prompt exists, but it does not show the number’s provenance or the diff being approved.
Two Sigma: approval fatigue is the failure mode
John Feminella, SVP Architecture at Two Sigma, described five controls built to keep agents in check without limiting model capability. His sharpest point was about approval fatigue: if a person approves everything, innovation slows down, and risk goes up because nobody can pay full attention to every decision.
Their alternative is a set of composable controls, each doing one job. One is an auto-mode classifier that decides routine calls and sends a person only the requests most likely to matter. Classifiers handle ambiguous cases; deterministic rules handle the clear ones. The split matters, because a classifier applied to an unambiguous rule adds variance for no benefit.
The practical version for a desktop agent is the same: do not ask for approval on every read. Ask on writes, spend, outbound sends and anything that changes state outside the workspace.
Anthropic: identity, sandbox, approval
Belinda Neal, Managing Director of Financial Services at Anthropic, described the pattern as a threshold crossing: every so often a model crosses one, and a wave of working changes follows. Anthropic announced Claude for Financial Advisors last month.
Keon Shahab, who works on applied AI at Anthropic, described a three-step trust layer:
- An identity and permissions layer that defines who the agent is acting as.
- A sandbox and approval layer, so someone signs off before the agent acts.
- A way to know the agent still works once variables change over time.
The example was a trade break investigation agent that recommends an order amendment for human approval. The design goal is explicit: it proposes amendments to orders data, it does not make them.
Bloomberg: controls outside the model
Andrey Rybka, Head of Architecture and Emerging Technologies at Bloomberg, described real incidents, including an agent that treated instructions embedded in a marketplace review as a command to stock a product. His recommended defenses: input validation, prompt injection defenses, provenance tracking and human approval for high-value actions.
The control list is concrete: scoped identities and credentials, controls over tool calls, outbound traffic restrictions, audit trails, budgets and kill switches. His summary is the line to keep: deterministic controls outside the model, check every call, log it, keep a kill switch.
What this means for a Windows agent setup
The four talks describe the same architecture from different angles, and none of it depends on the model vendor:
- Put the permission check outside the model. A prompt that says “ask before deleting” is not a control.
- Scope credentials per task, not per install. An agent that can reach every share with one token has no boundary.
- Make the approval prompt informative. Show the command, the path and the diff; an approval dialog with no context trains people to click yes.
- Keep a kill switch that does not require the agent to cooperate.
If you want to run a desktop agent on Windows with that shape, the current build is at agent.aimoogh.com/download. kernel-enforced agent permissions, why agents are treated like insider threats, and the Windows download.
FAQ
Does this apply outside finance? Yes. The finance examples are stricter because the actions are expensive and regulated, but the same boundary applies to any agent that writes files, sends messages or spends money.
Is human approval always the right answer? No. Two Sigma’s point is that blanket approval is its own risk. Approve the consequential calls and automate the routine ones with deterministic rules.
Related reading: