An AI agent can propose a payment. It can never authorise one.
AI models are probabilistic and can generate different outputs given identical inputs. Direct write-access to a core ledger introduces risk of transaction hallucinations, unauthorised cash movements, or reconciliation failures. That single sentence is the entire architectural constraint this page works through, not a policy position, a hard requirement of running a ledger at all.
Last reviewed: 2026-07-24
Two identical inputs, two different outputs.
A double-entry ledger is only trustworthy if the same input always produces the same output: that's what makes it auditable and reconcilable. AI models are the opposite by construction: probabilistic, and capable of producing a different answer to the exact same prompt twice. Give a model direct write-access to a ledger or a payment engine and you've imported that non-determinism into the one system that can least tolerate it: with transaction hallucinations, unauthorised cash movements, or silent reconciliation failures as the failure modes, not edge cases.
The agent proposes. A deterministic gate decides.
Bifurcate the architecture: decouple the stochastic intelligence layer from the deterministic execution engine using a middleware gateway that requires a cryptographically signed, single-use Decision Token for every transactional action. The agent never touches the ledger directly: it can only ever construct a request and ask.
Sentinel (decision authority) and Nexus (orchestration) are named, per the source material, as parts of Backbase's Banking OS[14]: treat the product names as illustrative of the pattern rather than confirmed current terminology; see "What's Still Open" below.
This is a model-risk control, not just an engineering choice.
The Decision Token gate is what lets a CRO sign off on model risk under the discipline of the PRA's SS1/23 standard: without it, there's no deterministic boundary between "the model had an idea" and "money moved." (SS1/23 formally applies only to firms with PRA-approved internal models for regulatory capital purposes; it's cited here as design discipline, not asserted as a universal legal requirement for every AI-native bank.) See the minimum viable org structure for the full reasoning on why that sign-off can't be automated away.
What this page doesn't yet know.
- Whether "Sentinel" and "Nexus" are Backbase's actual current product names or a paraphrase from the source research brief: not independently confirmed.
- Whether any live UK-regulated bank runs this exact pattern in production, versus in a sandbox or pilot.
- What the Decision Token scheme's own failure rate looks like under adversarial testing: no audited data cited yet.
Sources
[14] AI compliance in banking: build governance into architecture, Backbase. Not independently re-confirmed by Axiom Verity this session. See the hub's What's Still Open section.
This is one of four blocker pages.
The Advice Gap, Financial Crime Latency, and Third-Party Concentration blockers each get the same treatment as research progresses.