For architecture, data and compliance teams in banks
AI Context Layer: the secure data context for AI agents
in banking.
An AI Context Layer gives AI agents only the context they are allowed to read for a given purpose: identity, consent, meaning and memory per customer. Orchestration (in development) coordinates specialist agents with a bounded mandate, logs every tool call and stops them safely. ACCELERAID delivers both as a layer between your data and any model, hosted in Frankfurt.
✓
Agents see only the slice the purpose allows
✓
Rules live as data, not as prompts
✓
Every mandate, tool call and stop in the log
context.request
Example
Request
agent: service-agent · purpose: service_hint
consent: service, pfm · marketing: objected
Context
12 facts, 3 episodes, 9 rules · excluded: special categories, advisor notes
policy: pass · logged
○
Illustrative concept
Your rules
Personal Finance Management
Next Best Action
Top of Wallet
Transaction data
EUDI Wallet
Virtual advisor
Customer Data Platform
Hosted in Frankfurt
Consent first
12%
run AI agents as a core function today; 66% plan to within three years
> 40%
of agentic AI projects are forecast to be cancelled by the end of 2027, partly for inadequate risk controls
17%
of customers would be comfortable with an agent making financial decisions for them
Starting point
An agent is only as good as the context it is allowed to read.
Three shortcuts that work in a pilot and fail in a bank's production environment.
01 · Agent straight on the data
The agent reads the golden record and with it everything that does not belong in its context: special categories, advisor notes, transactions outside the purpose. What it has seen cannot be taken back.
02 · Rules in the prompt
Contact policy, suitability, purpose limitation and marketing objections live in instructions. They cannot be queried, versioned or evidenced. For compliance, a prompt is not a rulebook.
03 · Kill switch inside the stack
A switch in the agent's own workspace stops the process, not the delegated work: queues, sub-agents and still-valid credentials carry on. A stop needs its own trust boundary.
Five functions
What the Context Layer delivers before a model answers.
The Context Layer is the customer data platform with context. Five functions, the same in every bank, whatever the vendor.
01
Data management
Unify, enrich and hold customer master data, contracts, transactions, service cases and app events as a profile per customer. Connected to core banking, card processor and CRM.
02
Identity resolution
Both sides mean the same person, in the same role, for the same purpose. This applies to the customer in the dialogue as much as to the agent making the request.
03
Consent and purpose
Which purposes this customer has consented to, where they have objected, how much contact budget is left. Queryable at the moment of decision.
04
Semantics and relationships
A booking becomes a meaning: salary, rent, travel, subscription. Products, households and contracts are linked. The model receives meaning, not raw data.
05
Memory in four kinds
Short-term working state, episodes, facts and rules are kept apart. The agent receives the smallest set of high-signal information, not the whole profile.
Architecture
Five layers, one governance trail.
Context, Decision, Activation, Orchestration and Interface Layer. Consent, policy check, logging and model monitoring are not a layer of their own but a property of every layer.
The architecture as described in the blog series “Agentic Experience Platform for Banks”.
Context request
One context request, step by step.
From the agent's mandate to the logged tool call. The agent receives bounded context, never the database.
In most cases the policy check runs automatically because the rules exist as data.
Orchestration · in development
Specialist agents with a bounded mandate.
Before it is first used every agent has four things in writing: mandate, tools, stop criteria, handoff. What is not listed is not allowed.
Marketing agent
Prepares, never sends.
Mandate
prepare segments and offers
Tools
read context, generate proposal, trigger review
Stop
missing suitability, exhausted contact budget, too much uncertainty
Handoff
the business team approves the campaign
Service agent
Classifies, suggests, hands over.
Mandate
classify cases, suggest guidance
Tools
read service case, retrieve context, draft guidance
Stop
complaint, suspected fraud, emotional situation
Handoff
an employee takes over the dialogue
Analysis agent
Answers, reports, changes nothing.
Mandate
answer business questions, report anomalies
Tools
read-only access, visualisation, reporting
Stop
personal raw data outside the purpose
Handoff
the business team decides the measure
Rule between agents
A service-agent hint blocks every marketing-agent offer for seven days. The analysis agent sees the case only as an anonymised count.
Illustrative example from the blog series. Agent design and rules are defined with business and compliance.
Autonomy matrix · in development
Autonomy is a property of the task, not of the agent.
Four levels, each with the same log entry. The difference is approval, not traceability. Any level can be withdrawn at any time.
Level 1
Prepare
The agent assembles context, segments or drafts. Nothing leaves the platform.
Level 2
Propose
The agent presents a reasoned proposal. A person decides whether and how it is executed.
Level 3
Execute within scope
The agent acts within contact budget, amount and purpose. Anything beyond goes to a person.
Level 4
Execute with approval
High impact or irreversibility: the agent prepares, a person approves. The platform does not make credit decisions.
Control plane · in development
Five independent ways to stop an agent.
A kill switch inside the agent's stack is not enough. The stop paths sit outside its permissions and share no admin account.
A stop counts as executed when revoked permissions fail, workers receive no jobs and outgoing traffic ends.
Comparison
Agent on the database, generic copilot or Context Layer with orchestration?
Three architectures currently discussed in banks. The difference lies in what the agent sees, what bounds it and what remains evidenced.
What the agent sees
Golden record, in full
Documents and chat history
Bounded context per purpose: identity, permission, meaning, memory
Consent and purpose
Checked afterwards
Not part of the system
Queryable at the moment of decision, objections take effect immediately
Rules
In the prompt
In the prompt
As data: versioned, queryable, auditable
Tools
Direct system access
Vendor plugins
Tool gateway with permissions per agent and task
Stop
Kill the process
Close the session
Five independent paths: compute, credentials, network, tools, control plane
Log
Application log
Chat history
Agent log: mandate, tool call, abort, handoff, reasoning
Model
Hard-wired
Set by the vendor
Interchangeable: Azure OpenAI Germany, Gemini Frankfurt, own model on request
Our blog article on the orchestration layer describes the architecture behind this table.
How does the Context Layer protect personal data?
What is an AI Context Layer?
Why not connect the agent directly to the database?
What is a specialist agent with a bounded mandate?
What does orchestration do?
How is an agent stopped safely?
Which models can be connected?
How does this relate to Article 26 of the EU AI Act?
What does a first step look like?
Read on
Where to go next.
From the blog
Data & Technology
Context Layer in Banking: Why Customer Context Needs Pace, Purpose Limitation and an Expiry Date
AI & Banking
The Orchestration Layer: Domain Agents with a Bounded Mandate, Humans with Direction
Data & Technology