## Design a Governed Agent for Portfolio Rebalancing Design an agentic architecture that can propose and, when authorized, execute portfolio rebalancing. Available capabilities include identifier resolution, entitlement checks, portfolio-state retrieval, trade construction, and approval handling. Some teams propose exposing every capability through MCP and allowing a general coding agent to orchestrate them directly. Explain the orchestration model, where domain rules should live, and how components such as LangChain, LangGraph, LangSmith, MCP tools, documents, and agent skills could be used without making any one framework mandatory. Show how the design prevents a general agent from bypassing identifier validation, entitlements, current portfolio state, or approval logic. Include controls for confidential financial data and the exact points at which humans must remain in the loop. ### Constraints & Assumptions - Market and portfolio state can change between proposal and execution. - Users have different data and trading entitlements. - A rebalance may exceed risk limits or require more than one approver. - Tool output and model context can contain confidential financial information. - Every executed action must be reconstructable for audit. ### Clarifying Questions to Ask - Does the system only recommend trades, or may it submit them after approval? - Which limits must be enforced synchronously at execution time? - What freshness guarantees exist for positions, prices, and restrictions? - Which data may be sent to each model or observability service? ```hint Put invariants below the model Treat the language model as a planner operating through capabilities whose own authorization and validation cannot be disabled by a prompt. ``` ### What a Strong Answer Covers - A typed, stateful workflow with explicit proposal, validation, approval, execution, and reconciliation states. - Deterministic enforcement of identifiers, entitlements, risk limits, freshness, idempotency, and approvals at tool or service boundaries. - A clear distinction between integration libraries, workflow orchestration, tracing/evaluation, MCP transport, explanatory documents, and reusable agent instructions. - Least-privilege credentials, data minimization, redaction, environment isolation, retention controls, and audit logs. - Revalidation immediately before execution, safe retries, human escalation, and fail-closed handling of stale or ambiguous state. ### Follow-up Questions - How would you prevent an approved proposal from executing after the portfolio has materially changed? - Which trace fields are useful for debugging but unsafe to send to a third-party observability service? - How would you make execution idempotent when a client retries after a timeout?