Most conversations about finance agents still put the model at the centre of the system. That is understandable, because the model is the visible new thing. It reads, writes, searches, reasons, and gives the demo its sense of motion. But in regulated work, the model is rarely the control point. The control point is the transformation of evidence.
A finance agent does not begin with a prompt. It begins with a document, or more often with a pile of documents that were never designed for machines. PDFs, scans, statements, filings, transcripts, invoices, loan packs, board papers, policy documents, emails, and spreadsheets all arrive with different structure, history, permissions, and failure modes. Before an agent can do useful work, those materials have to become claims the institution is willing to rely on.
That transformation is where the real product lives. The institution needs to know which source produced a number, whether the table was read correctly, which version of the document was used, who was entitled to see it, what assumptions were applied, what changed since the last run, and where the human reviewer intervened. A convincing answer without that chain is not a controlled answer. It is just fluent exposure to an unmanaged source.
This is why the usual split between back office and front office is less important than it looks. Operational workflows such as invoice processing, KYC, loan origination, reconciliation, and covenant checking need deterministic correctness. Research workflows such as diligence, underwriting, equity research, and report drafting can tolerate more judgment. But both depend on the same custody layer. The difference is not whether provenance matters. The difference is how much ambiguity the downstream decision can absorb.
The phrase “context engineering” is useful, but it can make the problem sound softer than it is. In finance, context is not just material placed near a model. Context is evidence under control. It needs lineage, entitlement, extraction quality, numerical fidelity, exception routing, and review state. It also needs a user interface that makes verification cheaper than blind trust. Human review is not a decorative checkbox. It is part of the control surface.
The hard part is that many failures look small at the point of extraction and large at the point of decision. A misplaced decimal, a stale covenant, a missing footnote, a table row read under the wrong header, or a figure taken from a superseded version can flow through a system with perfect linguistic confidence. The model may behave exactly as designed while the institution loses the evidence trail that would make the output defensible.
That suggests a different design order. Start with the evidence lifecycle, then place the agent inside it. What are the source classes? Which claims can be extracted deterministically? Which ones require judgment? What gets reconciled against another source? What must be quoted verbatim? What must be blocked by entitlement? What needs reviewer signoff? What should never be generated at all? Once those questions are answered, the agent becomes one component in a governed workflow rather than the workflow pretending to be a chatbot.
This does not make the model unimportant. It makes the model less sovereign. The valuable system is not the one that can produce the most polished answer from a document set. The valuable system is the one that can show why the answer is allowed to exist, where it came from, how it was checked, and what level of reliance it deserves.
Finance will adopt agents fastest where the evidence path is already legible. The rest will not be solved by larger context windows alone. It will be solved by treating every useful answer as the end of a custody chain, not the beginning of a conversation.