Canonical Lending Platform on Go.Abacus

Credit agentic architecture

AI-driven credit underwriting,
with the decision still deterministic.

An end-to-end origination platform built on top of the Go.Abacus substrate: a vendor-neutral model layer so any LLM can serve any task, a context and knowledge plane in the middle that every piece of evidence passes through, eight specialized credit agents, a deterministic risk engine — and a human at the final gate.

8 agentsKYC to policy, one contract
5 model backendsswappable by config
0 runtime depsships as one signed appliance package
1 audit chainrouting, models, decision, sign-off

The layers

Evidence flows down the left. Every arrow that crosses into the model layer passes through the context plane first — that is where redaction, provenance and the content fingerprint are applied.

CHANNELS & INTAKE Web · Mobile Branch · Partner Pre-screening eligibility, not credit Document intake DIG extraction (existing) Orchestrator 4 stages · gates first External data sources bureau · income/tax · banking · market · registry · lists CONTEXT & KNOWLEDGE PLANE — every fact passes through here Application view one canonical read model Knowledge retrieval policy · regulation · playbook PII redaction pseudonymize on egress Token budget bounded, drops recorded Fingerprint reproducible context hash MODEL LAYER — one contract, any vendor LlmRouter posture-gated · per-task routing · every call audited with model id and token usage goabacus (on-appliance, the floor) anthropic · openai · openai-compatible · google AI AGENT LAYER — produces findings, never decisions KYC / AMLsanctions · PEP · ID Fraudlayering · circular Financialratios · leverage Cashflowstability · quality Bank statementNSF · balances BureauDPD · stacking Collaterallien · LTV Policylimits DETERMINISTIC CORE — versioned and fingerprinted Risk engine PD · LGD · EAD · grade model findings excluded Credit decision engine approve / refer / decline pure rules, no LLM Credit memo narrates, cannot alter skeleton is the fallback Explainability reasons · sources · versions full decision trail Human authorization final sign-off POST-DISBURSEMENT early-warning signals · repayment behavior · limit utilization · equity erosion · risk reassessment on the same model that priced it Data & infrastructure: Go.Abacus appliance · keyed hash-chained audit · posture profiles (airgapped / VPC / hybrid) · bearer auth · fail-closed secrets

Any LLM, by configuration

No module outside the model package may import a vendor. Everything speaks one contract, so changing which model answers which task is an edit to tenant.json and a restart — not a code change, not a rebuild, not a new dependency.

// tenant.json — the whole model layer is data
"agentic": {
  "llm": {
    "providers": [
      { "provider": "anthropic",
        "model": "claude-opus-5",
        "apiKeyRef": "secret://anthropic" },
      { "provider": "openai-compatible",
        "baseUrl": "https://llm.internal.cu",
        "model": "llama-3.3-70b-instruct" }
    ],
    // cheap model for volume, frontier for the memo
    "routing": {
      "agent-reasoning": ["openai-compatible", "goabacus"],
      "memo-narration": ["anthropic", "goabacus"]
    }
  }
}

Why it holds

  • The on-appliance model is the floor. Go.Abacus is registered unconditionally and is always the last-resort fallback, so routing can always resolve something. An air-gapped credit union still has a model; a vendor outage degrades on-appliance rather than failing.
  • Routing is per task, not per system — extraction, agent reasoning, memo narration, early-warning summary, adverse-action phrasing.
  • The posture gates egress. The same switch that governs document vendors governs models. Under airgapped, every external provider in the config above is inert, and the CLI says so per model at validation time.
  • Model ids are pinned. An unpinned model silently changes decision-adjacent behavior the day a vendor rolls its default.
  • Raw HTTP, no vendor SDKs. The platform ships as one signed air-gapped package with zero runtime dependencies; three npm dependency trees inside an appliance a credit union cannot patch is not a trade worth making.

The context plane in the middle

Nothing reaches a model raw. An agent asks for a context pack; the assembler flattens the read model into cited facts, retrieves the governing policy text, redacts, budgets, and fingerprints — in that order.

Deterministic retrieval

TF-IDF, not embeddings: no model, no vector store, no network. Retrieval therefore works identically air-gapped, and identical inputs always produce identical hits — which is what makes the fingerprint mean anything. A vector-backed store is a drop-in replacement.

Pseudonymization, not deletion

Bound for an external model, a name becomes [NAME_1] — consistently within a pack, independently numbered across packs. The model can still reason about "the applicant"; the identity never crosses. The token map never leaves the appliance. Financial magnitudes pass through untouched.

The fingerprint

A finding citing contextFingerprint: 9a1c… can be re-derived years later and shown to have come from precisely that evidence. "The model said so" is not an examiner answer. This is.

No LLM decides — and it is enforced, not asserted

Four independent mechanisms, each covered by a test. Model risk guidance expects a model whose logic is documented and whose outputs are reproducible; an LLM in the decision path is neither.

MechanismHowConsequence
Type-level An agent report has no outcome, score or price field. The type cannot express a credit decision.
Severity clamp A model observation is capped at ATTENTION; only deterministic checks assert ADVERSE. A hallucination can raise a human's eyebrow. It cannot assert an adverse fact about a member. The clamp is to the ceiling, not the floor — capping to INFO would hide the loudest thing a model can say.
Risk exclusion The risk engine drops every model-derived finding before computing PD and LGD. An unvalidated model can never move a capital number.
Grounded memo A deterministic skeleton carries every figure; the model pass may replace prose only. With no model at all, the skeleton is the memo, flagged narrated: false.
Gating, not declining. A blocked control — a sanctions hit, an unverified identity, an undisclosed senior lien — does not decline the member. It is handled exactly like an open stipulation: the decision endpoint returns 409 until a human dispositions it, and no adverse-action notice is generated, because no credit evaluation occurred. Screening runs first and gates there, so a file that will be stopped never spends model tokens or a bureau pull on cashflow analysis.

The agent layer

Each agent has a deterministic core — ratios, thresholds, list matches — and an optional qualitative pass over the same context. Only the deterministic half can assert an adverse finding, and a model outage degrades an agent to that half rather than failing it.

KYC / AML
  • ID verification
  • AML screening
  • PEP check
  • Sanctions check
  • Address verify
Fraud detection
  • Anomaly detection
  • Layering check
  • Circular transactions
  • Related parties
  • Risk signals
Financial analysis
  • Financial ratios
  • Trend analysis
  • Income quality
  • Leverage
  • Liquidity
Cashflow analysis
  • Cashflow pattern
  • Inflows / outflows
  • Stability
  • Seasonality
  • Cashflow quality
Bank statement
  • Transaction analysis
  • Bounce detection
  • Cash deposit check
  • Average balance
  • Categorization
Bureau
  • Credit score
  • DPD history
  • Enquiries
  • Loan stacking
  • Utilization
Collateral
  • Property check
  • Valuation
  • Encumbrance
  • LTV calculation
  • Marketability
Policy / rules
  • Policy validation
  • Rule engine
  • Exceptions
  • Limits check
  • Compliance

What happens when something breaks

Every external dependency has an explicit failure mode, and none of them stops an origination.

FailureBehavior
External model unreachable, refuses, or returns garbageThe agent keeps its deterministic findings and records SOFT_SIGNAL_UNAVAILABLE. The router has already audited which of the three it was.
Posture forbids egressExternal providers and data sources are never selected; the on-appliance path runs. The refusal reason is recorded.
A data source times outRecorded as failed; the other sources still contribute. A missing bureau score becomes an honest reason code, not a crash.
A single agent crashes or hangsTimed out and captured as an error report. The run continues — a partial analysis with an explicit gap beats no analysis.
Knowledge store unavailableEmpty knowledge list, visible in the pack and in its fingerprint.
No model configured at allThe memo is the deterministic skeleton, and says so.

What this does not do

Stated plainly, because the value of everything above depends on it.

Commercial data-source wire contracts are assumed. Bureau, income/tax and property-registry APIs are contract-gated. The adapters are real, posture-governed, fail-closed and tested — the request and response shapes are plausible placeholders behind a real boundary. Swapping in a signed vendor contract is an edit to one class.
The risk pack is uncalibrated. The default PD bands, LGD profile and grade cuts are defensible starting parameters, not truths. They must be replaced with the institution's own loss experience before any capital number is relied on. Every one of them is overridable in tenant configuration.
Agent prompts are un-evaluated. There is no eval harness scoring qualitative signals against labeled outcomes yet. Until there is, the soft-signal pass is an underwriter aid — which is why it can be switched off per tenant, and why nothing downstream depends on it.
Go.Abacus integration remains hardware-unvalidated. The SDK boundary is pinned to the published wire contract and fails closed without a live appliance. No call has yet been made against real hardware. Nothing in this architecture changes that.