上下文并非权威：面向金融市场智能体的结构化运行时治理
Context Is Not Authority: Structured Runtime Governance for Financial Market Agents
浏览论文内容
中文总结 AI 辅助
针对金融智能体可能将正确上下文转化为未经授权影响的问题，提出SAGE-Fin金融领域权限交接合约，通过运行时控制影响保障合规，经测试和实际部署验证了其有效性。
中文摘要 AI 辅助
金融智能体可能将正确的上下文转化为未经授权的影响，比如面向客户的承诺、交易或已部署的策略。我们提出SAGE-Fin，一种金融领域专用的权限交接合约，它将拟产生的影响而非仅其文本作为运行时控制的对象。SAGE-Fin将提案编译为类型化、适配器绑定的候选方案；将缺失或过时的机构义务记录为覆盖债务；根据当前市场、账户、策略和对话状态约束权限；并要求其标称类型与消费响应、执行或策略适配器匹配的精确工件收据。证据和工作流进展无法替代影响权限，且状态变更后会重新检查预先授权。在一份包含616个案例的已编写目录中，5种确定性规范产生3080个输出；标签隔离的测试工具实现了616/616的二元参考原型一致性，其中包括3/3命名的响应门夹具，另有22项测试覆盖选定路径。这些结果确立了可执行的一致性，而非独立的安全准确性。此外，SAGE-Fin的响应门在一个保密数字资产平台处理了真实的面向客户的生产请求。独立于实施团队的运营团队对其实用性和工作流适配性给出了非常积极的部署后结论，最终用户反馈也同样非常积极。披露仅允许审查的独立性、利益相关者类别、评估维度和方向性结论，因此这是定性的现场佐证而非总体效应估计。3个不同的去标识化的先前故障，经独立确认的拦截率为0/3，其原因包括重复发射漂移、过时的账户证据以及缺失的升级状态，且未估算流行率或处理效应。
英文摘要
Financial agents can turn correct context into an unauthorized effect: a customer-facing commitment, trade, or deployed policy. We present SAGE-Fin, a finance-specific authority-handoff contract that makes the proposed effect, not merely its text, the object of runtime control. SAGE-Fin compiles proposals into typed, adapter-bound candidates; records missing or stale institutional obligations as coverage debt; contracts authority under current market, account, policy, and dialogue state; and requires an exact-artifact receipt whose nominal type matches the consuming response, execution, or policy adapter. Evidence and workflow progress cannot substitute for effect authority, and prior authorization is rechecked after state changes. Across an authored 616-case catalog, five deterministic specifications yield 3,080 outputs; a label-isolated harness obtains 616/616 binary reference-prototype parity, including 3/3 named response-gate fixtures, while 22 tests cover selected paths. These results establish executable conformance, not independent safety accuracy. Separately, SAGE-Fin's response gate processed real customer-facing production requests at a confidential digital-asset platform. An operational team independent of the implementation team reached a strongly positive post-deployment conclusion on practical usefulness and workflow fit, and end-user feedback was also strongly positive. Disclosure permits only the review's independence, stakeholder classes, assessed dimensions, and directional conclusion, so this is qualitative field corroboration rather than an aggregate effect estimate. Three distinct de-identified predecessor failures, with independently confirmed 0/3 interception, ground repeated-emission drift, stale account evidence, and missing escalation state without estimating prevalence or treatment effect.
发表机构
- OpenAsk
- Binance（币安）
- New York University（纽约大学）
- Xiamen University（厦门大学）
- Bank of Hebei（河北银行）
机构由 AI 辅助整理，请以论文原文为准。
