Platform · Customer Data Platform
AI Context Layer: the secure data context for AI agents
in banking.
✓
Agents see only the slice the purpose allows
✓
Rules live as data, not as prompts
✓
Every mandate, tool call and stop in the log
Model-agnostic: Azure OpenAI Germany or Gemini Frankfurt, your own models on request. Agent orchestration and control plane: in development. Last updated: October 20, 2026
context.request
Example
Request
agent: service-agent · purpose: service_hint
consent: service, pfm · marketing: objected
Context
12 facts, 3 episodes, 9 rules · excluded: special categories, advisor notes
policy: pass · logged
○
Illustrative concept
Your rules
Personal Finance Management
Next Best Action
Top of Wallet
Transaction data
EUDI Wallet
Virtual advisor
Customer Data Platform
Hosted in Frankfurt
Consent first
98%
of surveyed CDP users call the platform essential for an agentic future
12%
run AI agents as a core function today; 66% plan to within three years
> 40%
of agentic AI projects are forecast to be cancelled by the end of 2027, partly for inadequate risk controls
17%
of customers would be comfortable with an agent making financial decisions for them
Starting point
An agent is only as good as the context it is allowed to read.
Three shortcuts that work in a pilot and fail in a bank's production environment.
01 · Agent straight on the data
The agent reads the golden record and with it everything that does not belong in its context: special categories, advisor notes, transactions outside the purpose. What it has seen cannot be taken back.
02 · Rules in the prompt
Contact policy, suitability, purpose limitation and marketing objections live in instructions. They cannot be queried, versioned or evidenced. For compliance, a prompt is not a rulebook.
03 · Kill switch inside the stack
A switch in the agent's own workspace stops the process, not the delegated work: queues, sub-agents and still-valid credentials carry on. A stop needs its own trust boundary.
Five functions
What the Context Layer delivers before a model answers.
The Context Layer is the customer data platform with context. Five functions, the same in every bank, whatever the vendor.
Data management
Unify, enrich and hold customer master data, contracts, transactions, service cases and app events as a profile per customer. Connected to core banking, card processor and CRM.
Identity resolution
Both sides mean the same person, in the same role, for the same purpose. This applies to the customer in the dialogue as much as to the agent making the request.
Consent and purpose
Which purposes this customer has consented to, where they have objected, how much contact budget is left. Queryable at the moment of decision.
Semantics and relationships
A booking becomes a meaning: salary, rent, travel, subscription. Products, households and contracts are linked. The model receives meaning, not raw data.
Memory in four kinds
Short-term working state, episodes, facts and rules are kept apart. The agent receives the smallest set of high-signal information, not the whole profile.
Architecture
Five layers, one governance trail.
Context, Decision, Activation, Orchestration and Interface Layer. Consent, policy check, logging and model monitoring are not a layer of their own but a property of every layer.
The architecture as described in the blog series “Agentic Experience Platform for Banks”.
Context request
One context request, step by step.
From the agent's mandate to the logged tool call. The agent receives bounded context, never the database.
In most cases the policy check runs automatically because the rules exist as data.
Orchestration · in development
Specialist agents with a bounded mandate.
Before its first deployment every agent has four things in writing: mandate, tools, stop criteria, handoff. What is not listed is not allowed.
Marketing agent
Prepares, never sends.
Mandate
prepare segments and offers
Tools
read context, generate proposal, trigger review
Stop
missing suitability, exhausted contact budget, too much uncertainty
Handoff
the business team approves the campaign
Service agent
Classifies, suggests, hands over.
Mandate
classify cases, suggest guidance
Tools
read service case, retrieve context, draft guidance
Stop
complaint, suspected fraud, emotional situation
Handoff
an employee takes over the dialogue
Analysis agent
Answers, reports, changes nothing.
Mandate
answer business questions, report anomalies
Tools
read-only access, visualisation, reporting
Stop
personal raw data outside the purpose
Handoff
the business team decides the measure
Rule between agents
A service-agent hint blocks every marketing-agent offer for seven days. The analysis agent sees the case only as an anonymised count.
Illustrative example from the blog series. Agent design and rules are defined with business and compliance.
Autonomy matrix · in development
Autonomy is a property of the task, not of the agent.
Four levels, each with the same log entry. The difference is approval, not traceability. Any level can be withdrawn at any time.
Prepare
The agent assembles context, segments or drafts. Nothing leaves the platform.
Level 1
Propose
The agent presents a reasoned proposal. A person decides whether and how it is executed.
Level 2
Execute within scope
The agent acts within contact budget, amount and purpose. Anything beyond goes to a person.
Level 3
Execute with approval
High impact or irreversibility: the agent prepares, a person approves. The platform does not make credit decisions.
Level 4
Control plane · in development
Five independent ways to stop an agent.
A kill switch inside the agent's stack is not enough. The stop paths sit outside its permissions and share no admin account.
A stop counts as executed when revoked permissions fail, workers receive no jobs and outgoing traffic ends.
Comparison
Agent on the database, generic copilot or Context Layer with orchestration?
Three architectures currently discussed in banks. The difference lies in what the agent sees, what bounds it and what remains evidenced.
Golden record, in full
Documents and chat history
Bounded context per purpose: identity, permission, meaning, memory
Checked afterwards
Not part of the system
Queryable at the moment of decision, objections take effect immediately
In the prompt
In the prompt
As data: versioned, queryable, auditable
Direct system access
Vendor plugins
Tool gateway with permissions per agent and task
Kill the process
Close the session
Five independent paths: compute, credentials, network, tools, control plane
Application log
Chat history
Agent log: mandate, tool call, abort, handoff, reasoning
Hard-wired
Set by the vendor
Interchangeable: Azure OpenAI Germany, Gemini Frankfurt, own model on request
Our blog article on the orchestration layer describes the architecture behind this table.
Data protection & security
Privacy is architecture. Built for regulated banking.
Data protection is architecture, not a feature. The platform connects to core banking, card processor, CRM and app and runs where your supervisor expects it to.
Privacy by design
✓
Consent per purpose
✓
Hosted in Frankfurt
✓
PII filter before the model
✓
No cross-tenant training
01
GDPR & DPA
A data processing agreement, purpose limitation and deletion concepts are part of every project, with a joint data protection impact assessment on request. Every use of customer data is tied to a documented purpose and a consent.
02
Hosted in Frankfurt
Private cloud in the ISO 27001 certified data center in Frankfurt, on-premise optional. Data stays in Germany.
03
PII filter before the model call
Personal data is detected and masked before a language model sees a request. No cross-tenant training: customer data only trains the bank's own models.
04
Tenant separation
Each bank runs in its own logically separated environment with its own keys, roles and logs.
05
SOC 2 Type I certified
ACCELERAID is SOC 2 Type I certified; the report is available under NDA. Audit-proof logging is standard.
06
Enterprise hosting
Enterprise hosting in the PCI DSS certified data center. The ISO 27001 and PCI DSS certifications apply to the data center.
Agents only receive the context the purpose allows and act within defined rules under human control. Automated individual decisions within the meaning of Art. 22 GDPR are not intended; assessing individual processing activities is up to your data protection officer.
The agreed configuration, the contract and the related evidence, such as the SOC 2 Type I report, are authoritative.
FAQ
Frequently asked questions about the AI Context Layer.
What architecture, data and compliance teams want to know before they start.
How does the Context Layer protect personal data?
What is an AI Context Layer?
Why not connect the agent directly to the database?
What is a specialist agent with a bounded mandate?
What does orchestration do?
How is an agent stopped safely?
Which models can be connected?
How does this relate to Article 26 of the EU AI Act?
What does a first step look like?
Read on
Where to go next.
Which agent do we bound first?
In 45 minutes we sketch one specialist agent with you: mandate, tools, stop criteria, handoff. Afterwards you know which data the Context Layer needs and what the log will contain.