« Track Overview · Warmup · Lab 01

Phase 17 — Capstone: The Bank-Grade Enterprise AI & Agentic Platform

Answers: the whole JD. This is the phase where the five layers stop being separate exercises and become one AIPlatform.handle().

Why this phase exists

Every previous phase built a mechanism in isolation, which is how you learn a mechanism and not how you learn a platform. The capstone exists because the interesting failures live in the seams:

• the identity chain that was correct at hop two and lost the user at hop three;
• the routing rule that was right for classification and wrong for residency once the fallback fired;
• the cache that was tenant-partitioned but whose key was built before the tenant was resolved;
• the audit record that had every field except the one join key that would have linked it to the approval;
• the degradation ladder that shed the reranker and, three months later, quietly shed the guardrail behind it.

None of those is visible from inside one component. The capstone composes all of them and then attacks the composition.

The scenario

A wholesale payment investigation that ends in a release.

A relationship manager asks, through Teams: "Why is PMT-771 held, and can we release it?" The platform must:

1. authenticate the human and open a session (Users & Channels);
2. admit the agent, check KYA posture and evaluation freshness, and compute its authorization-aware capability set (Control Plane, Phase 09);
3. run a bounded, checkpointed agent loop with tiered memory (Agent Kernel, Phase 01);
4. retrieve the payment record, the sanctions policy and the counterparty's ownership graph — authorized, cited, fresh (Knowledge Foundation, Phases 06–07);
5. call the model through the gateway with routing, budget-aware fallback and token accounting (Model Layer, Phases 04–05);
6. delegate a sanctions screening to Group Compliance's agent over A2A, with a verified, depth-bounded delegation chain (Phases 03, 08);
7. run the guardrail chain over input, retrieval and output, and detect the injected instruction planted in one of the retrieved documents (Phase 11);
8. propose payments.release, which the Action Gateway validates against contract and invariants, classifies as irreversible, requires dual control for, mints a JIT credential for, and executes idempotently (Phases 10, 08, 12);
9. emit the evidence pack: identity chain, policy versions, model versions, citations, approvals, audit chain (Phase 15);
10. and record the SLI events, spans and cost that the run consumed (Phase 14).

Then the capstone does the part that matters: it breaks each of those steps in turn and asserts that the platform degrades the way the design says it will.

Concept map

• Composition: one handle() that threads a request through all five layers plus the three cross-cutting ones, with the internal task model (Phase 03) as the spine.
• The seams: identity propagation across hops; tenant resolution before any key is built; classification travelling with the data; join keys on every emitted artifact; the degradation ladder never shedding a control.
• End-to-end budgets: the Phase 00 latency budget and error budget, now measured against a real composed path rather than assumed.
• Defence depth, measured: for each of a suite of malicious and malformed requests, how many distinct layers independently deny — and a hard requirement of ≥ 2 for anything irreversible.
• Chaos: provider 429, retrieval down, delegate agent unavailable, control plane unreachable, core banking breaker open, approval never given — each with a declared expected behaviour.
• The evidence pack as the capstone's actual output: not "it worked", but "here is what an examiner would receive."

The lab

106 tests, all green. Test contract: the injected instruction never reaches payments.release; the delegation chain arriving at Group Compliance contains user, orchestrator and investigator, in order; a release without two distinct authenticated approvers is refused; a retried release with the same idempotency key executes once; the evidence pack is complete or names the missing artifact; with the control plane unreachable the platform serves on the last known-good bundle and raises staleness; with the model provider 429ing the fallback fires only if the budget fits; and the composed latency stays inside the Phase 00 budget with the declared headroom.

Documents

Deliverables checklist

• Lab 01 green, including the chaos suite.
• You can whiteboard the full request path, naming every component and what it denies.
• You can trace an identity from the human's token to the credential presented to core banking.
• You can produce the evidence pack contents from memory.
• You can state the platform's SLOs and show the arithmetic behind them.
• You can describe the degradation ladder and prove no control is on it.
• You can run the defence-depth harness and explain any result of 1.

Key takeaways

• The interesting failures are in the seams, and only composition finds them.
• Defence depth is a number. Measure it; require ≥ 2 for irreversible actions.
• A control is never on the degradation ladder. Quality may degrade; safety may not.
• The output of a run is an evidence pack, not just an answer.
• Predict the degradation, then inject the failure. A design you cannot predict is a design you do not understand.