Intel / article

Agents Prompt People: Using Agents for Long-Horizon Financial Work

Source: latent.space
Author: Richard MacManus
Date: Published Oct 31, 2026

Context

Arca is a wealth management firm that calls itself AI-native, meaning software agents do most of the background work. Its human advisors still make the final calls. In an interview with Latent Space, Aman Singh, Arca's lead AI engineer, said an 's job ends at analysis and proposals. Trading, and any other action that moves a client's money, stays with a human advisor. Singh's phrase for the arrangement is that "agents prompt people more than people prompt agents": the agent prepares the work and asks a person to decide.

What makes that more than a policy statement is where Singh says the line is enforced. "All of our safety restrictions are fully deterministic," he told the interviewer, meaning they are fixed rules in Arca's software, not instructions the model is asked to follow. Some tools and tasks the agent can run by itself, but not ones that carry risk to a client. In principle, that means a model which misreads a situation or is fed a malicious instruction cannot talk its way past a rule that does not depend on its judgment. The post says Arca also runs checks for known attacks such as , where hidden instructions in a document or email try to steer the agent.

The same idea governs how agents read client data. Singh said Arca lets agents write code to query and combine data, which is how they assemble something like a financial plan. That code runs in a sandbox, an isolated computing environment, and before anything reaches Arca's back end, a system translates the agent's code into a strict format the company expects, discards the original code, and applies to the translated version. The agent keeps the flexibility of writing code, while the back end only accepts requests in a shape Arca has defined in advance.

These are Singh's descriptions of Arca's design, and the post gives no incident record or outside audit to show how the rules hold up in practice. Still, the approach answers the obvious worry about agents in finance in a specific way: the safety boundary sits in code the company controls, and the model works inside it. A video of the same conversation covers the other half of the setup, how Arca's agents keep track of client work that runs for days.

Key takeaways · AI-distilled

Singh describes Arca's agent work as long-horizon but not long-running: a single task can take up to ten days because it stops and starts across many actors, decision points and handoffs, which is why Arca built a per-client memory system its agents write to.
Arca's own picks the model for each task from the company's internal benchmarks, with Claude as its primary provider. Owning the harness rather than using a managed one keeps the firm free to change model providers, per the article.
Singh says Arca's safety restrictions are fully deterministic: agents analyze and propose, while trading and any other money movement are handled by a human advisor, taking risky decisions out of the agent's hands.
To let agents query client data with code, Arca translates the code an agent writes into a strict expected format, throws the code away, and applies guardrails to that format before anything reaches the backend.
Arca feeds human advisors' feedback and agent traces to a meta-agent that analyzes them and suggests changes to the harness.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.

Read the source latent.space