A.K. (FDE) · R.M. (IAM)Identity
Mapped advisor directory groups to FinDesk workspaces and agent scopes. Two legacy groups don’t map cleanly; IAM is deciding whether to retire them.
Next: decision from IAM before scope freeze
Services · Forward Deployed Engineering
The demo was the easy part.
Between a working demo and governed production sits the groundwork: identity, data access, your ontology and knowledge graph, policy, audit, model access and the people who will run it. Our Forward Deployed Engineers do that work inside your environment, alongside your teams, and then hand it over. FinAI OS, the managed agent platform, runs as cloud-native containers, on-prem or in your private cloud.
Schematic, not to scale. Blockers and their order vary by institution.
What ‘groundwork’ means
Nine things that have to be true before an agent goes live
We work through each with your teams. For every area, the right-hand column is what stays with you when we leave.
| Area | FinAI OS | What we do | What you keep |
|---|---|---|---|
| 01Environment & perimeter | All layers | Map where models, data and agents will run; agree network boundaries and the container platform with your infrastructure team. | A reference deployment architecture for your infrastructure |
| 02Identity & entitlements | FinDeskFinHubFinClawFinGuard | Connect your identity provider; map roles and entitlements to workspaces, tenants and agent scopes. | Role mappings your IAM team owns and maintains |
| 03Data & knowledge | FinLore | Connect your data sources, then clean and resolve the data into an ontology and knowledge graph of your business, in your own environment, by design. Our engineers use agents to help with the work, and your experts sign off. Set up knowledge bases that agents can cite, scoped to who may see them. | An ontology and knowledge graph in your own environment, by design, with named owners, knowledge bases agents cite, and the rules for what each agent can read |
| 04Policy & controls | FinSAFEFinGuard | Start FinSAFE in audit mode to record what agents do, then draft policies with compliance: what agents may do alone, what needs approval, what is never allowed. | Versioned policies your teams can review and change |
| 05Sandboxing | FinSAFE | Isolate tool and code execution; agree what each agent can reach; prove the boundaries hold. | Execution boundaries that are documented and that you can re-test |
| 06Agent runtime | FinHubFinClaw | Stand up the agent platform and tenant isolation on your infrastructure; connect tools to your systems. | A runtime your platform team operates |
| 07Surfaces | FinDesk | Brand the desktop; configure workspaces and plugins for each role. | A branded desktop, plus the plugin SDK for your own tools |
| 08Evaluation & monitoring | Cross-cutting | Build evaluation sets with your subject experts; test how agents fail; connect agent telemetry to your monitoring. | Evaluation sets you can re-run on every change, and alerts in the tools you already use |
| 09People & runbooks | Cross-cutting | Train operators, advisors and supervisors; write runbooks with the people who will use them. | Runbooks, trained owners and an escalation path |
Fintology, in design, is our product for the rules, schema and ontology of enterprise knowledge. Today our engineers build your ontology with you.
The engagement
Assess, ground, deploy, hand over
Four phases. Each ends in a gate your institution signs off, and we move on only when it’s met.
Phase 1
Assess
Know the environment
Activities
- Use-case and risk review
- Environment, data and identity mapping
- Regulatory perimeter with compliance
In the room
YouBusiness owner, CISO delegate, compliance, platform lead
OutputsDeployment blueprint; groundwork backlog; risk register
Exit gate
GateBlueprint approved by business, risk and technology owners
Phase 2
Ground
Lay the foundations
Activities
- Install the FinAI OS products in scope, on-prem or in your private cloud
- Identity, data and knowledge connections; build your ontology and knowledge graph
- FinSAFE in audit mode, then first policies drafted with compliance
In the room
YouPlatform, IAM, data owners, compliance
FDEEngineers working alongside your teams
OutputsA governed staging environment; a first ontology and knowledge graph in your own environment, by design; first policies; evaluation sets
Exit gate
GateSecurity review passed; red-team findings closed or accepted
Phase 3
Deploy
First workload, for real
Activities
- Release to a first user group
- Supervision and escalation live
- Monitor, tune, re-evaluate
In the room
YouFirst users, supervisors, operations
OutputsProduction workload; audit trail; tuned policies
Exit gate
GateOwners sign off on supervision and audit reviews
Phase 4
Hand over
Your team runs it
Activities
- Runbooks and training
- Your team runs operations with us watching, then without us
- Plan for the next use case
In the room
YouPlatform team, operators, product owner
FDEThe lead engineer, stepping back
OutputsRunbooks; trained owners; roadmap
Exit gate
GateYour team deploys and operates it unaided
Typical sequence · scope varies by institutionPace is set by your governance gates, not by a fixed schedule.
A week in the field
What the work actually looks like
A sample engagement log and board from the Ground phase. Most of the work is unglamorous: mappings, policies, findings and fixes, done with your people in the room.
Engagement log · Larchmont Mutual WealthPhase: GroundWorkload: Personal Wealth AgentsEnvironment: on-prem, staging
MonDay 1
J.S. (FDE) · CompliancePolicy
Drafted FinGuard policy WM-ADV-07: product recommendations are held for licensed advisor review; cash holds and fact-finding are allowed. Compliance edits accepted into v0.3.
TueDay 2
Red team · J.S.Red-team
Finding RT-014: the agent could be led into paraphrasing a draft house view not yet approved for clients. Fix: FinLore scope limited to published documents; regression case added.
Status: fixed, re-tested, closed
WedDay 3
Eval lead · Investment officeEval
Ran the advice-scenario evaluation set against the agent and policy v0.4. Flagged cases reviewed line by line with two senior advisors; two rules tightened, one test case rewritten as ambiguous.
ThuDay 4
A.K. · Data ownerData
Mapped households to accounts from the portfolio system for FinLore and the agent’s tools. Reconciliation shows joint accounts double-counted; fixed at the source mapping, not in the agent.
FriDay 5
Platform team · A.K. observingHandover
Platform team ran the staging deploy runbook unaided. Two gaps found in the rollback steps; runbook updated by the platform team, not by us.
Donethis week
Role → scope mapping v1IAM
RT-014 fix + regression caseFDE
Staging runbook dry-runPLAT
In progress
WM-ADV-07 policy v0.4 sign-offCOMPWaiting on legal wording for escalation notice
Household mapping: trusts & joint accountsDATA
Blocked
Model host firewall ruleINFRAChange ticket raised; next change window
Next
Security review prep (Ground exit gate)FDE
Engagement models
Three ways to start
Scope is agreed after the assessment. These are starting shapes, not packages.
Starting small? The 8-week visibility pilot is the lowest-commitment way in. →
| Compare | Model AGroundwork firstGet the environment ready before choosing a workload | Model BSolution deploymentOne solution, such as Personal Wealth Agents, taken to production | Model CPlatform rolloutFinAI OS as a shared platform for many teams |
|---|---|---|---|
| Best for | Institutions with demos but no production path | A business line with a clear first use case | A platform team serving several business lines |
| Phases | Assess · Ground | Assess · Ground · Deploy · Hand over | All four, repeated per workload |
| In scope |
|
|
|
| Typically involves | FinGuardFinSAFEFinLore | FinDeskFinHubFinClawFinGuardFinSAFEFinLore | The FinAI OS products your teams need, shared across business lines |
| You end with | A governed environment ready for a first workload | A supervised workload in production, run by your team | A shared managed agent platform your platform team runs |
Scope and commercial terms are agreed in a written proposal after the first working session.Discuss which fits →
The 8-week visibility pilot
Start by seeing what your agents already do
Before you block anything, find out what’s happening. For eight weeks, FinSAFE’s desktop build runs in audit mode on one department’s desktops, recording what agents do before any policy is tightened. Nobody changes how they work.
- An agent activity baseline: what agents run, where they connect, and which file and network access falls outside policy.
- A list of high-risk activity, so you know where to start.
- A draft policy your security and compliance teams can review, which the same sandbox can enforce when you’re ready.
Run by our Forward Deployed Engineering team. After the pilot, a natural next step is to switch the policy on and bring agents onto the platform.
What you’ll need to decide: a notice to employees about the endpoint sandbox, and how long audit data is kept and masked.
Start with the 8-week pilotHandover principles
We plan our exit from the first day
The goal of an FDE engagement is that you need us less at the end of it.
- 1
Your infrastructure
Everything we build runs in your environment, as cloud-native containers, on-prem or in your private cloud, under your change control. We work through your processes rather than around them.
- 2
Your keys
Credentials, policies and configuration belong to your teams. We work under your access controls, and you can revoke our access when we’re done.
- 3
Your runbooks
Runbooks are written with, and then by, the people who will use them. Your platform team runs the final deploy unaided before we step back.
- 4
Honest about what’s left
At handover you get a written list of open risks, known limits and recommended next steps, including the ones that aren’t ours to fix.
- 5
Support after we leave
Product support continues under your FinAI OS agreement. Further FDE time is optional, not assumed.
Talk to FDE
Request an FDE conversation
Tell us what you’re trying to deploy and where. An engineer, not a sales script, will reply.
Next step
Request an FDE conversation
Talk with a Forward Deployed Engineer about FinAI OS, a single product or the wealth solution. Or start by seeing what your agents already do, with the 8-week visibility pilot.