Case Study: Agent Governance & Audit Trail for Trading Operations

Capital Markets

Agent Governance & Audit Trail for Trading Operations

The Challenge: Working Pilots With No Path to Production

Several teams at a broker-dealer had built AI agents for trade support and surveillance alert triage, among other uses. The pilots worked and none could go live. Each team had made its own choices about permissions and human oversight, and model risk and compliance had no consistent way to assess them. The largest gap was the record, because nobody could show after the fact what an agent had seen or done and who had approved the outcome. Without that record the firm could not meet its supervisory and recordkeeping obligations, and each approval was taking more than three months.

Our Solution: One Control Framework and One Record for Every Agent

Lydatum worked with the firm's technology team and its model risk and compliance functions to put a common foundation under every agentic use case:

• Agent Inventory & Risk Tiering: Catalogued every agent in development and classified each by the actions it could take and the data it could reach, so the depth of review matched the risk.
• Control Standards: Defined what agents in each tier may do on their own and where human approval is required, along with how tool and data permissions are granted and revoked.
• Central Audit Trail: A shared service that records every prompt, model response, tool call and human approval as a time-stamped, immutable entry that can be searched and replayed step by step.
• Evaluation Gates & Monitoring: Each agent had to pass a defined evaluation suite before release, and production monitoring watched for quality drift and policy breaches.

The audit trail feeds the firm's existing retention and surveillance systems, so agent records are kept and supervised alongside its other regulated activity. Teams now build on the shared services, which means a new agent arrives at review with its controls and evidence already in place.

The Impact: From Stalled Pilots to a Repeatable Approval Path

With one framework and a complete record, the firm's control functions could assess each agent the same way.

Twelve use cases reached production within six months, against none in the year before. Approval time fell from 14 weeks to under 6 because reviewers received evidence in a standard form. When compliance needs to understand a specific decision, it can replay the full sequence of agent and human actions in minutes.

Services Delivered: Agent Governance & Controls, AI Governance & Model Risk, Agent Evaluation & Observability, Real-time Streaming & Events

Technologies Used: OpenTelemetry, Apache Kafka, Databricks, LangGraph, Model Context Protocol (MCP), Amazon Bedrock, Python