Arca keeps people on money moves; its core safety limits do not depend on a model

Aman Singh, head of AI at the wealth management firm Arca, described a design where the agent does not guard itself. On the Latent Space podcast, he said agents analyse, safety limits do not depend on a model, and people handle money movement. This is his account of Arca's own system.

What was said

Singh gave an example. A client emails Arca about a large tax bill and needs about a hundred thousand dollars. Agents work out where the money sits and how best to free up that sum.

The agents stop there. Singh said they cannot move money or sell assets on their own, although Arca's custodian, which holds client assets, offers software links that would allow it. People also approve direct messages to clients. The agent hands the right person a plan to review and adjust. Singh said agents propose trades, and experts decide and execute them.

Singh said: "all of our safety restrictions are, are fully deterministic, and they, they take the decision-making off the, the agent's hands." Deterministic means the same input always gets the same answer, with no model judging. Arca also runs deterministic checks for known personal data leaving the system. Model-based layers sit on top. Fast model calls review every database write, and a group of small models looks for data leaks. Arca also scans incoming emails and documents for prompt injection, which is hidden text meant to hijack an agent.

Singh said every agent action produces a log of what changed, who changed it and when. Staff interface changes that affect a client are logged too. He said: "The industry cares about outcomes, but, um, compliance cares about auditability."

Why it matters

Our reading: the design choice is where authority sits. The custodian link exists, but the agent may not use it. Money movement stays with people, and the log shows who acted. That lets accountability rest with identifiable staff, though Singh did not say a named person signs off each transfer. The logic is that a rule which does not read the email cannot be argued with by it. The talk did not test whether Arca's rules hold up. Buyers can ask which actions an agent may take and who approves.

The other side

All of this is Singh's own account, with no outside test in the conversation. Arca is not a software vendor but, he said, "the firm ourselves", so it can require staff feedback. A buyer of vendor software may not have that control. Model-based checks also sit in the safety path, and Arca still scans for injection, so the threat is live. The talk did not cover how often people reject agent plans, or whether review slows clients.