{"id":"7238a53c-e310-4aad-ac31-19891dd2a6b8","arxiv_id":"2608.11344","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Financial institutions can lose the ability to explain or reproduce agentic AI decisions even when the system is capable and seemingly stable; the paper names this a Verifiability Gap and dissects its mechanisms.","lead":"This paper argues that the real risk when AI agents make financial decisions is not whether they can do the job, but whether their decisions can later be verified, explained, and reproduced. Three controlled studies show that provider updates, orchestration design, and model refreshes can silently change or erase the evidence needed to audit agentic choices.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equation (3)'s Markov chain is contradicted by the paper's own Study 2 architecture: the Decider reads layer-3 reports and the layer-4 critic, so Y is not conditionally independent of S3 given S4; the geometric depth bound is not established.","rationale":"The reader's weakest assumption identified Eq. (3) as load-bearing because production systems may not enforce the serial information-access rule. The stronger and more immediate problem is internal: even in the authors' own Study 2 architecture, the terminal Decider observes records from multiple prior layers, so Eq. (3) is not the joint law of the experiment. This does not invalidate the paper's empirical mechanisms or the central conceptual claim that verifiability can bind independently of capability: Study 3's current-reproducibility/historical-fidelity separation and Study 1's control-surface dependence stand on their own. But the formal claims that serial depth causes geometric contraction of discrimination and that retention must grow with depth are not supported by the stated theorems for the architecture actually tested. This is a fixable correctness issue rather than a fatal flaw: the authors could revise the architecture to a strict serial chain, or restate the contraction result for the actual DAG with the bypass depth made explicit. The reader's conditional verdict remains appropriate, so no change in verdict is recommended.","tokens_in":42199,"tokens_out":16868,"duration_ms":160222,"concrete_test":"Using the replication package's run_agents.py, parse the actual communication graph for the 10-agent condition and list the parent nodes of the Decider. If the Decider's parents include nodes from more than one topological layer (quant and customer at layer 3, critic at layer 4), then Eq. (3) is false for that configuration. Then re-derive the contraction bound for the true DAG, C -> S1 -> S2 -> S3 -> (S4, Y), which satisfies the Markov property C -> S3 -> (S4, Y), yielding I(C;Y) <= I(C;S3). Compute the number of sequential stages strictly before the first direct edge into Y and compare it with the 19-stage exponent claimed in Figure 6.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.4 builds the formal core on Eq. (3): C -> S1 -> ... -> Sd -> Y, justified by the rule that only the first layer observes the original case and every downstream agent observes only records transmitted along designated edges. For Theorem 1 and Corollary 3 to apply, Y must be conditionally independent of all earlier states given Sd. The controlled architecture in Study 2 violates this. Figure 5 and Table S2 specify that the terminal Decider reads quant and customer from layer 3 plus the critic from layer 4. Thus Y = g(S3, S4), with a direct edge from S3 to the final decider, so Y is not a function of Sd alone and the joint law is not the chain in Eq. (3). The data-processing argument can still be run along a path, but it gives I(C;Y) <= I(C;S3) (with S4 a function of S3), so the claim in Section 7.4 and Figure 6 that the contraction exponent is 19, not 50, is not implied. The relevant depth is at most the stage before the direct bypass. This is not merely a production-systems gap: the paper's own architecture fails the assumption its theorems require. Corollary 3's conclusion that retention must grow with depth is therefore not established for the configurations actually tested.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper argues that the binding governance constraint on delegating consequential financial decisions to agentic AI is verifiability rather than capability. It defines the Verifiability Gap as the positive shortfall between verification demanded by delegated authority and retained explainability/reproducibility, and develops a multilevel governance theory with seven propositions at firm, regulatory, and network levels. The empirical component consists of three controlled mechanism tests: Study 1 documents provider release drift and withdrawal of replay controls; Study 2 shows orchestration changes decisions, decouples terminal verdicts from execution traces, and produces degenerate outcome reproducibility via output collapse; Study 3 shows a deterministic logistic credit model can perfectly reproduce its current action while failing to recover a historical action. The formal apparatus derives serial contraction and retention lower bounds from the data-processing inequality, and the paper defines reproducibility as a four-target governance profile with a degeneracy diagnostic.","tokens_in":42462,"tokens_out":15054,"duration_ms":131689,"significance":"If the central claim holds, the paper makes a useful contribution to the governance literature by shifting the unit of analysis from model transparency to retained evidence, and by distinguishing four reproducibility targets plus a degeneracy diagnostic. Strengths include the standard information-theoretic scaffold, the explicit bounding of the studies as counterexamples rather than prevalence estimates, the replication package with stored records, and the clean Study 3 demonstration that perfect current replay can coexist with historical-fidelity failure. The main concerns are formal: the Markov-chain assumption in Eq. (3) is violated by the architecture actually tested in Study 2, so the depth/retention theorems are not established for the tested configurations; and the bit-level gap in Corollary 2 does not fully implement the joint-failure construct of Eq. (1). These issues are load-bearing but fixable.","major_comments":[{"comment":"The formal core uses the chain C -> S1 -> ... -> Sd -> Y and justifies it by the rule that no layer beyond the first reads C. In the architecture actually tested in Study 2, the terminal Decider reads the layer-3 Quant/Customer reports and the layer-4 Critic report (Table S2, Fig. 5), so Y = g(S3, S4) and Y is not conditionally independent of S3 given S4. The joint law is therefore not the chain in Eq. (3). Consequently Theorem 1's geometric contraction, Theorem 5's I(C;Y) -> 0 in depth, and Corollary 3's retention-growth conclusion are not established for the tested configurations, and the claim in §7.4/Fig. 6 that the contraction exponent is 19 rather than 50 is not implied. The data-processing argument still gives I(C;Y) <= I(C;S3), so please either revise the architecture so the final action depends only on the last layer, or extend the theory to DAGs with skip edges and state which depth enters the bound.","section":"§4.4, Eq. (3); §7.4, Fig. 6; Supplement S1.2"},{"comment":"The one-versus-ten-agent comparison is reported with inconsistent numbers. Section 7.4.1 and Figure 8a state that mean RO fell from 0.903 to 0.747, while Table 7 reports RO = 0.912 for one agent and 0.794 for ten agents, under what appears to be the same condition (released temperature, five repetitions, same model and cases). If the two analyses use different configurations, repetition counts, or execution conditions, state this explicitly; as written, the central quantitative result of Study 2 is ambiguous. Please reconcile the values and confirm that the family-level numbers in Fig. 8a are derivable from the stored records.","section":"§7.4.1 and Fig. 8a vs Table 7"},{"comment":"Corollary 2 defines the Verifiability Gap in bits as [H([T]_sigma|Y) - H(E)]_+, which measures only the reproducibility route. Equation (1) defines the gap through V_dq = V_sigma(E_dq,R_dq), where the explainability route can compensate for reproducibility. If explainability alone is sufficient under sigma, Eq. (1) gives G_dq=0 even when H(E) < H([T]_sigma|Y). As stated, the bit-level corollary does not implement the joint-failure construct in Eq. (1) unless one assumes the explainability route is empty; please clarify that Eq. (5) formalizes a reproducibility-specific sub-gap, or extend the information-theoretic model to include the explanation evidence.","section":"§4.4, Eq. (5), Corollary 2; Eq. (1)"}],"minor_comments":[{"comment":"Section 3.3 contains a duplicated phrase: 'They distinguish four targets: four distinct targets' should be 'They distinguish four targets.'","section":"§3.3"},{"comment":"Figure 6(b)'s y-axis label 'count' is ambiguous; label the two series explicitly as 'number of agents' and 'sequential stages'.","section":"Fig. 6(b)"},{"comment":"The statement that 29 of 32 modal decisions matched the baseline while five distinct cases changed at least once would benefit from a sentence clarifying that cases can change in one release and revert in another.","section":"§7.3.1"}],"recommendation":"major_revision","confidential_remarks":"The formal and numerical issues raised in the report should be resolved before publication; the paper's conceptual contribution is sound, but the current presentation overstates the support for the depth-growth theorem. I would also suggest a careful audit of all reported statistics against the replication package, given the Table 7 / Figure 8a discrepancy."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know before you read it. First, this is a serious and mostly careful paper on an important problem: how to govern agentic AI in finance when you can't replay or explain what it did. The Verifiability Gap construct and the four-part reproducibility profile (RO/RH/RP/RT plus the DV collapse diagnostic) are genuinely new and useful, and the three studies are honestly framed as mechanism tests with code and data shipped. Second, there is a load-bearing formal flaw in Section 4.4 that the authors have not noticed: their own Study 2 architecture violates the Markov chain assumption (Eq. 3) that the theorems depend on.\n\nThe paper's contribution is real. Study 1's demonstration that provider releases change historical decisions and also withdraw the controls (temperature, top_p, top_k, seed) an auditor would need is a concrete, valuable observation. Study 3's deterministic-logistic result—RO=1 while RH=0—is a clean counterexample that will be useful for teaching. The profile framework is a sensible antidote to single-number reproducibility metrics.\n\nNow the soft spots, in proportion. The main one is the Eq (3) issue. The chain C->S1->...->Sd->Y requires that Y be conditionally independent of earlier states given Sd. But Figure 5 and Table S2 show the Decider reads from layer 3 (quant, customer) and layer 4 (critic), so Y is a function of S3 and S4. The critic is a deterministic function of S3, so Y is effectively a function of S3 alone; the DPI gives I(C;Y) <= I(C;S3), and the \"exponent 19\" claim in Figure 6 is not supported. The effective depth is 3, not 19. This doesn't kill the qualitative argument that serial compression destroys information, but it does mean the quantitative contraction bound and Corollary 3's depth-dependent retention growth are not established for the tested architecture. The authors need to either change the architecture to match the chain or restate the theorems for the actual DAG.\n\nSecond, the title claim—verifiability, not capability, is the binding constraint—is broader than the evidence. The studies are 32 constructed cases, one provider, one researcher-designed graph. The authors say this themselves, but readers should not mistake mechanism identification for prevalence.\n\nThird, Section 6's propositions are plausible but mostly untested; that's fine, they're framed as such.\n\nWho benefits: IS and FinTech governance researchers, regulators thinking about AI auditability, and reproducibility-minded ML folks. It deserves a serious referee, but the Eq (3) problem must be fixed or reframed before I'd trust the formal results.\n\nRecommendation: send it out for review—conditional acceptance level if the authors address the chain mismatch.","headline":"Serious and useful paper on agentic AI governance, but its formal core rests on a Markov-chain assumption that the paper's own Study 2 architecture violates.","tokens_in":43005,"tokens_out":5683,"would_cite":true,"duration_ms":100040,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that the binding constraint on delegating consequential financial decisions to agentic AI is verifiability, not capability: an agent can stay accurate and stable while the institution cannot substantiate how it acted.","keywords":["agentic AI governance","Verifiability Gap","delegated authority","reproducibility","explainability","FinTech","output collapse","evidence-contingent delegation"],"falsifier":"Run the Study 1 release-timeline and Study 2 orchestration protocols on a provider that exposes a dated pinned endpoint, a random seed, and temperature control: if baseline-modal historical fidelity stays at 1.000 across releases and exact trace reproducibility $R_T$ reaches 1 at any depth beyond a single agent, the provider-dominance and serial-contraction claims would be refuted.","tokens_in":41943,"feed_emoji":"🔍","tokens_out":19110,"duration_ms":147521,"temperature":0.7,"pith_summary":"Agentic AI in finance is new not because it is opaque — banks have validated opaque models for decades by re-running them — but because the empirical remedy for opacity may no longer work. The paper argues that the binding constraint on delegating consequential decisions is verifiability, not capability, and defines the Verifiability Gap as the shortfall between the verification that delegated authority demands and the explainability and reproducibility retained after a decision. Three controlled studies show the same gap opening from three directions: provider releases change historical financial actions while withdrawing the controls needed to replay them; orchestration changes the operative decision rule while no execution record ever repeats; and a deterministic credit model can reproduce its current action perfectly while failing to recover a historical one. The upshot is evidence-contingent delegation: an agent's authority is defensible only while retained evidence substantiates how it was exercised, and when that evidence falls short the institution should narrow authority or route decisions to substantive human review. A reader should care because banks, card networks, and regulators are already moving loan decisions, trades, and compliance dispositions into precisely these systems.","feed_headline":"Verifiability, not capability, is the binding limit on agentic AI","feed_subtitle":"Stable, accurate agents can still leave a bank unable to explain or replay a decision it authorized.","key_machinery":"The central object is the Verifiability Gap, a shortfall in retained verification capacity indexed to a verifier, an evidentiary standard, and an audit lag, together with the reproducibility profile $R(t;\\sigma) = (R_O, R_H, R_P, R_T; D_V)$ that separates current outcome, historical outcome, material process, and exact trace reproducibility and tracks verdict differentiation $D_V$ as a degeneracy diagnostic. The argument is carried by a serial-pipeline information model in which only the first layer observes the original case and the joint law factorizes as a Markov chain $C \\to S_1 \\to S_2 \\to \\cdots \\to S_d \\to Y$; on that chain the paper proves that discrimination contracts geometrically in depth (Theorem 1), that $\\sigma$-reversibility is equivalent to equality in the data-processing inequality (Theorem 2), that deterministic summarization is incompatible with reversibility (Theorem 3), and that reversibility requires retaining at least $H([T]_\\sigma \\mid Y)$ bits of evidence (Theorem 4). These results convert the verbal claim that serial handoffs widen the gap into a bit-level accounting of what an institution must keep.","core_discovery":"The paper's central claim is that an agentic AI system can remain highly capable, accurate, and behaviorally stable while the responsible institution becomes entirely unable to substantiate how that system exercised its delegated authority. It formalizes this as the Verifiability Gap, $G_{dq} = [\\rho_\\sigma(A_d) - V_{dq}]^+$, the positive shortfall between the verification required by delegated authority and the verification capacity retained in explainability and reproducibility, indexed to a named verifier, an evidentiary standard, and an audit lag. The formal core is a set of information-theoretic results on serial agent pipelines: discrimination $I(C;Y)$ contracts geometrically with pipeline depth via the data-processing inequality, a stage is $\\sigma$-reversible exactly when it throws nothing away, a stage either summarizes or stays auditable but cannot do both, and the retained evidence must satisfy $H(E) \\geq H([T]_\\sigma \\mid Y)$ — the institution must store at least as many bits as its pipeline destroyed. Empirically, three studies identify distinct mechanisms: provider releases silently shift risk posture while withdrawing temperature, top-p, top-k, and seed controls; orchestration acts as a latent policy layer in which no execution record repeats at any scale and apparent stability can be degenerate output collapse; and a preserved logistic credit model achieves perfect current reproducibility while failing to reproduce a historical decision that crossed a policy threshold. The conclusion is that reproducibility is a governance profile, not a scalar, and that delegated authority remains defensible only while retained evidence substantiates its exercise.","pith_inferences":["A cheap monitoring heuristic follows from Study 3's position-beats-magnitude finding: track each case's distance to the nearest policy cutoff, because cases near a boundary are the population at risk of historical-fidelity failure after any refresh, and audit those cases first.","Theorem 6 implies a minimal supervisory screen: since a blanket-default system and a perfect system are statistically indistinguishable on within-case re-runs alone, any audit standard should include cross-case differentiation statistics comparing modal verdicts across cases with different correct actions.","The Markov-chain restriction suggests a concrete research agenda: re-derive the retention bound for non-serial topologies with shared memory or original-case visibility, and measure empirically whether such topologies shrink the Verifiability Gap or merely relocate it.","Transferred to clinical or public-sector delegation, the same profile would likely bind where the evidentiary standard is externally imposed by courts or regulators; measuring $R(t;\\sigma)$ in those settings would test whether the gap's mechanisms are specific to provider-hosted financial models or general to any serial agent pipeline."],"forward_implications":["Provider releases, control-surface withdrawals, and orchestration changes are governance events: institutions should react with historical replay, revalidation, and reauthorization rather than treat them as routine maintenance.","No threshold on current outcome reproducibility is a sufficient audit criterion: because $R_O \\geq 1/L$ always while the trace record and case information can both be zero, outcome agreement alone can certify a system that has stopped distinguishing its cases.","Institutions should retain an executable evidence bundle — decision-time inputs, component versions, prompts, tool responses, memory states, causally material handoffs, and policy thresholds — and secure contractual version pinning, escrow, or replay rights that follow audit horizons rather than release cycles.","Delegation should be evidence-contingent: when retained verification capacity falls below the standard required by exercised authority, the institution should narrow the agent's mandate or route affected decisions to substantive human review.","Deeper orchestration raises the evidentiary price of the same autonomy: because every compressing handoff destroys reconstructability, keeping the Verifiability Gap closed requires storing strictly more bits for every material compression stage."],"supporting_citations":[{"why":"Supplies the theoretical framework of delegation to and from agentic IS artifacts that the paper extends into evidence-contingent delegation.","marker":"[Baird and Maruping, 2021]"},{"why":"The model-risk management supervisory guidance (SR 11-7) whose assumption that independent validation remains possible the paper argues agentic systems break.","marker":"[Board of Governors of the Federal Reserve System and OCC, 2011]"},{"why":"Documents non-determinism of 'deterministic' LLM system settings in hosted environments, the empirical basis for the reproducibility deficit.","marker":"[Atıl et al., 2025]"},{"why":"Defines the reproducibility program and standards the paper decomposes into four governance targets.","marker":"[Pineau et al., 2021]"},{"why":"Supplies the evidence that fluent chain-of-thought explanations can be unfaithful, load-bearing for the explainability-deficit route and P2/P5.","marker":"[Turpin et al., 2023]"},{"why":"The public HELOC credit dataset on which Study 3's preserved-version experiment and faithfulness probes are built.","marker":"[FICO, 2018]"},{"why":"The decision-provenance construct the Verifiability Gap is positioned against and that the paper extends with composable handoff records.","marker":"[Singh et al., 2019]"},{"why":"The financial-stability analysis of shared AI infrastructure that grounds Proposition P7 on synchronized common-mode audit failures.","marker":"[Financial Stability Board, 2024]"}],"fun_headline_variants":["The Verifiability Gap: capability isn't the problem","Stable agents can leave banks blind","Authority without evidence is indefensible","Agentic AI's real risk: unverifiable actions","Capability doesn't buy auditability"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The formal contraction and retention theorems assume that the pipeline factorizes as a Markov chain — only the first layer observes the original case and every downstream agent sees only the records transmitted along designated edges — so if production agentic systems let later agents see the original case, live tools, or shared memory, the serial information loss and the retention lower bound may not hold.","fun_headline_variants_meta":{"raw":{"variants":["The Verifiability Gap: capability isn't the problem","Stable agents can leave banks blind","Authority without evidence is indefensible","Agentic AI's real risk: unverifiable actions","Capability doesn't buy auditability"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000716,"raw_usage":{"total_tokens":3338,"prompt_tokens":1186,"completion_tokens":2152,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":802,"completion_tokens_details":{"reasoning_tokens":2084}},"tokens_in":802,"tokens_out":2152,"duration_ms":15163,"temperature":1.0,"reasoning_tokens":2084,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:12:46.405538+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the Study 1 release-timeline and Study 2 orchestration protocols on a provider that exposes a dated pinned endpoint, a random seed, and temperature control: if baseline-modal historical fidelity stays at 1.000 across releases and exact trace reproducibility $R_T$ reaches 1 at any depth beyond a single agent, the provider-dominance and serial-contraction claims would be refuted.","supporting_citations":[{"cited_title":"Supervisory guidance on model risk management ( SR 11-7)","cited_arxiv_id":null,"evidence_quote":"The model-risk management supervisory guidance (SR 11-7) whose assumption that independent validation remains possible the paper argues agentic systems break."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the evidence that fluent chain-of-thought explanations can be unfaithful, load-bearing for the explainability-deficit route and P2/P5."},{"cited_title":"Explainable machine learning challenge: Home equity line of credit ( HELOC ) dataset","cited_arxiv_id":null,"evidence_quote":"The public HELOC credit dataset on which Study 3's preserved-version experiment and faithfulness probes are built."},{"cited_title":"Decision provenance: Harnessing data flow for accountable systems","cited_arxiv_id":null,"evidence_quote":"The decision-provenance construct the Verifiability Gap is positioned against and that the paper extends with composable handoff records."}],"review_version":1}