Enterprise Agentic AI System for Financial Services

By Amar Kumar

This brief proposes a production enterprise agentic AI system for financial services: role-specific LangGraph agents that reason over governed enterprise data via a credential-isolated access layer, integrate Snowflake Cortex and MCP tool servers, and ship with eval gates on every agent before production release.

Proposed outcome: A multi-agent platform where business users interact with specialist agents — research, operations, compliance — that retrieve answers and take approved actions through API-mediated data access, never raw database credentials, with CI eval regression, full audit traces, and deployment on AWS Bedrock or Azure AI Foundry.

Scenario

This is a proposed solution for an enterprise financial services client with an existing architecture and design spec — an execution-focused build where a senior agentic AI developer ships against clear requirements, not open-ended strategy.

• Users: Business analysts, relationship managers, and operations staff — non-technical consumers of agent outputs and actions
• Data estate: Governed Snowflake warehouse, CRM (Salesforce), internal REST APIs, document repositories, and an optional semantic/knowledge layer
• Agent types: Role-specific agents — portfolio research, client onboarding assist, compliance Q&A — orchestrated by a LangGraph supervisor with A2A handoffs
• Constraints: Regulated industry — audit logs, PII redaction, tool allowlists, human approval for write actions
• Delivery model: Fixed-scope agent implementation against defined design; iterative eval expansion as new roles are added
• Cloud: AWS Bedrock and/or Azure AI Foundry for model inference; Snowflake Cortex for governed SQL and enterprise search

Problem

Enterprise financial services teams cannot deploy agent prototypes that embed warehouse credentials, bypass row-level security, or ship without regression tests. The gap between a LangGraph demo and a SOC-ready production system is governance, eval discipline, and standardized tool access — not more prompt tweaking.

• Credential sprawl risk — agent runtimes that hold database connection strings create leak paths via prompts, logs, or tool misuse
• Ungoverned retrieval — RAG over raw tables bypasses entitlements and licensed data usage terms
• Demo vs production gap — notebook agents fail multi-agent edge cases, approval flows, and model version changes
• Tool chaos — each agent reimplements API clients with inconsistent auth, error handling, and versioning
• No eval discipline — agents promoted on manual spot checks; regressions discovered by business users in production
• Role blur — a single generalist bot hallucinates on domain tasks that specialist agents would handle with narrower, tested tools
• Multi-cloud friction — Bedrock, Azure Foundry, and Snowflake Cortex each expose different SDKs without a unified trace or model routing layer

Requirements

Functional

• Role-specific agents: Distinct LangGraph graphs per business role with scoped tools, prompts, and eval packages
• Supervisor orchestration: Route user intent to the correct agent; support A2A delegation and context handoff
• Governed RAG: Retrieval via Cortex Search and semantic layer — queries respect user entitlements
• Tool/function calling: MCP servers exposing approved internal APIs; read-first, write behind human approval
• Snowflake Cortex: Analyst for natural-language-to-governed-SQL; Search for document and chunk retrieval
• Human-in-the-loop: LangGraph interrupt nodes before irreversible actions (CRM writes, report submission, ticket creation)
• Eval suite per agent: Golden tasks covering expected tool calls, citation patterns, and refusal cases
• Audit trail: Immutable log of prompts, retrieved sources, tool invocations, model ID, and user identity

Non-functional

• Security: Zero raw DB credentials in agent pods; session-scoped tokens issued by governed access layer only
• Latency: Interactive turns p95 < 8 s; long research workflows run async with streaming partial results
• Availability: 99.9% on agent API tier; graceful fallback when Cortex or an MCP server is degraded
• Eval gate: No agent promotes to production without ≥90% task success on offline golden set
• Observability: OpenTelemetry spans correlated across LangGraph nodes, MCP calls, and Cortex queries
• Portability: Model router abstracts Bedrock, Azure Foundry, and Cortex LLM functions behind one interface

Architecture

The design separates orchestration (LangGraph supervisor and role agents), tooling (MCP servers), and data access (governed gateway to Snowflake Cortex and internal APIs). Agents hold no warehouse passwords — they receive short-lived scoped tokens and call MCP tools that enforce policy server-side.

flowchart TB classDef user fill:#fef3c7,stroke:#d97706,color:#92400e classDef orch fill:#ede9fe,stroke:#7c3aed,color:#5b21b6 classDef tool fill:#dbeafe,stroke:#2563eb,color:#1e3a8a classDef gov fill:#dcfce7,stroke:#16a34a,color:#14532d classDef data fill:#f1f5f9,stroke:#64748b,color:#334155 classDef cloud fill:#fce7f3,stroke:#db2777,color:#9d174d BU["Business user\nweb / Teams embed"]:::user API["Agent API\nFastAPI + auth"]:::orch SUP["LangGraph supervisor\nintent router + A2A"]:::orch R1["Research agent\nCortex tools"]:::orch R2["Operations agent\nworkflow MCP"]:::orch R3["Compliance agent\npolicy RAG only"]:::orch BU --> API --> SUP SUP --> R1 SUP --> R2 SUP --> R3 MCP1["MCP: snowflake-governed\nAnalyst + Search"]:::tool MCP2["MCP: salesforce-read\nCRM lookup"]:::tool MCP3["MCP: internal-workflows\nticket / report APIs"]:::tool R1 --> MCP1 R2 --> MCP2 R2 --> MCP3 R3 --> MCP1 GAL["Governed access layer\nentitlements + audit"]:::gov MCP1 --> GAL MCP2 --> GAL MCP3 --> GAL SF["Snowflake\nCortex + warehouse RLS"]:::data CRM["Salesforce\nOAuth API"]:::data INT["Internal APIs\nservice accounts"]:::data GAL --> SF GAL --> CRM GAL --> INT BR["AWS Bedrock /\nAzure AI Foundry"]:::cloud R1 --> BR R2 --> BR R3 --> BR EV["Eval CI + Langfuse\ntraces + datasets"]:::gov API --> EV

Enterprise architecture — LangGraph role agents invoke MCP tool servers through a governed access layer; LLM inference routes to Bedrock or Azure; eval CI gates every deploy

sequenceDiagram autonumber participant User as Business user participant Agent as Research agent participant MCP as MCP snowflake-governed participant GAL as Governed access layer participant Cortex as Snowflake Cortex Analyst participant Eval as Audit + Langfuse User->>Agent: "AUM trend for mandate X?" Agent->>MCP: cortex_analyst(query, session_token) MCP->>GAL: validate token + entitlements GAL->>Cortex: governed NL to SQL Cortex->>GAL: result rows (RLS applied) GAL->>MCP: redacted response + query_id MCP->>Agent: structured JSON + lineage Agent->>User: answer with citation Agent->>Eval: log tools, sources, model_id alt policy denial GAL->>MCP: 403 entitlement_denied MCP->>Agent: refusal payload Agent->>User: cannot access this dataset end

Governed tool-call sequence — MCP server validates session token; access layer enforces entitlements before Cortex executes; denials produce agent refusals, not credential errors

End-to-end flow

Production request path — write actions pause at human approval; every path emits an auditable trace for compliance review

Recommended stack

Recommendation: LangGraph for orchestration, MCP for tool standardization, Snowflake Cortex for governed retrieval and SQL, a custom governed access layer (FastAPI) for entitlements, and AWS Bedrock / Azure AI Foundry for model hosting — with Langfuse and pytest eval packages gating every deploy.

Why MCP over bespoke tool JSON schemas? In a multi-team enterprise, CRM, warehouse, and workflow APIs are owned by different groups. MCP lets each team publish a versioned server; agent developers consume a stable protocol instead of merging API clients into every graph.

Why a governed access layer? Regulated finance requires entitlements enforced outside the LLM. An agent that receives a user session token can only invoke MCP tools the access layer validates — warehouse service accounts never appear in agent environment variables.

Why LangGraph over CrewAI or AutoGen? Explicit graph edges, checkpoint persistence, and interrupt() for HITL map directly to approval workflows auditors expect. Crew-style role play is harder to eval deterministically.

Bedrock vs Azure Foundry? Use whichever matches the client’s existing cloud contract; a thin model router abstracts provider SDKs so agents reference model_id not vendor-specific clients.

Agent & component design

1 — LangGraph supervisor (router)

• Input: Authenticated user message + profile (role, entitlements, active mandate)
• Logic: Intent classifier → route to research / operations / compliance agent; manage A2A handoff with compressed context packet
• Output: Streaming tokens from selected agent; trace ID for audit
• QA gate: Routing accuracy ≥95% on 50-intent eval set before prod

2 — Research analyst agent

• Tools (MCP): cortex_analyst, cortex_search, get_semantic_metric
• Behavior: Always cite query_id or chunk source; refuse when entitlement denied; no write tools
• Eval focus: Numerical accuracy on golden SQL questions; citation presence; refusal on out-of-scope datasets

3 — Operations agent

• Tools (MCP): salesforce_read, create_service_ticket, submit_draft_report
• HITL node: LangGraph interrupt() before any write; user approves in UI; checkpoint resumes on confirm
• Eval focus: Correct tool selection; never write without approval flag; idempotent retries

4 — Compliance Q&A agent

• Tools: Cortex Search over policy corpus only — no Analyst SQL, no CRM
• Behavior: High refusal precision; answer only from retrieved policy chunks; escalate ambiguous queries
• Eval focus: Zero hallucinated policy citations; 100% refusal on out-of-corpus questions in test set

5 — MCP server: snowflake-governed (illustrative)

from mcp.server import Server
from mcp.types import Tool, TextContent

server = Server("snowflake-governed")

@server.tool()
async def cortex_analyst(query: str, session_token: str) -> list[TextContent]:
    claims = access_layer.validate(session_token)
    if "analyst" not in claims.allowed_tools:
        raise PermissionError("entitlement_denied")
    result = await cortex_client.analyst(
        query=query,
        role=claims.snowflake_role,
        warehouse=claims.warehouse,
    )
    access_layer.audit(user=claims.user_id, tool="cortex_analyst", query_id=result.id)
    return [TextContent(type="text", text=result.to_json())]

6 — Per-agent eval package (CI gate)

@pytest.mark.agent("research_analyst")
@pytest.mark.parametrize("case", load_golden_cases("research_analyst"))
async def test_research_agent(case, agent_runner):
    result = await agent_runner.run(case.user_message, context=case.context)
    assert result.tools_called == case.expected_tools
    assert citation_present(result.answer)
    if case.expect_refusal:
        assert result.refused and not result.tools_called
    else:
        score = await llm_judge relevance(case.expected_facts, result.answer)
        assert score >= 0.85

7 — Model router

Implementation plan

Reporting & ops

Ops cadence would include daily failed-tool review, weekly eval dataset curation from production samples, and monthly security review of MCP server permissions. The senior agent developer would own eval standards — no agent merges without a green CI eval run and signed checklist.

Proposed deliverables

Following the phased plan, a build would ship these artifacts:

• Governed access layer API — session tokens, entitlement middleware, SQL allowlist, immutable audit log
• MCP server suite: snowflake-governed, salesforce-read, internal-workflows
• LangGraph supervisor graph with A2A handoff protocol
• Three role agent graphs: research analyst, operations, compliance Q&A
• Snowflake Cortex Analyst and Search integration aligned to dbt semantic layer
• Per-agent eval packages (30+ golden tasks each) running in CI as deploy gate
• Model router configuration for AWS Bedrock and Azure AI Foundry
• HITL approval checkpoint pattern with LangGraph interrupt/resume
• Langfuse dashboards — traces, eval trends, tool failure breakdown, cost by agent
• Terraform modules for AWS/Azure deployment with secrets management
• Security and ops runbooks — credential rotation, agent version rollback, Cortex outage mode

Effort estimate

Indicative effort for platform foundation plus three role agents through production hardening (assumes existing architecture spec, Snowflake Cortex enabled, and client SSO available):

The $15K fixed-price signal in the sourcing context would realistically scope Phase 1–2 (foundation + first research agent with evals) or a time-boxed MVP milestone — not the full six-phase platform. A production system with three governed role agents, HITL writes, and compliance audit typically lands in the 400+ hour range above.

Glossary