Claude Financial Services: what the public plugins actually provide
Financial Services architecture: separate data, instructions and approval
Trace a work product through domain skills, connector reads, harness validation and human authorization.
What you will learn
- Follow the shared source of instructions
- Put validation between readers and orchestration
- Keep control messages out of document text
Before you start
- Command-line and JSON familiarity
- A disposable workspace with synthetic financial records
A proposed learning project turns validated requests into reviewable records without giving documents control of routing.
Key takeaways
- Bundled skills can drift from their source.
- Valid JSON can contain false business facts.
- An allowlist is not sender authorization.
Follow the shared source of instructions
Vertical skills are the domain source; named agents contain bundled copies for their own workflow. The README describes a synchronization script and a checker for drift. A change to a vertical source therefore needs a review of the affected agent copies.
Slash commands express explicit user actions, while relevant skills supply methods and conventions. Managed-agent wrappers reference the same prompt and skill directories. This reuse explains the packaging; it does not prove identical behavior across host versions.
Put validation between readers and orchestration
scripts/validate.py loads an output instance and a JSON or YAML schema, then calls jsonschema.validate. Its comment describes a harness-side check between a reader subagent and the orchestrator because the documented API path does not enforce that structured output itself.
A schema check can reject the wrong shape while accepting a false amount with the correct numeric type. Keep source references and reconciliation checks beside structural validation. The application must decide whether each draft has enough evidence for a reviewer.
Keep control messages out of document text
scripts/orchestrate.py reads text deltas and attempts to extract a handoff_request. Its own warning notes that a processed document could echo such a blob. An allowlisted target limits destinations, but does not establish that the document is authorized to trigger routing.
A safer extension is a typed control channel with authenticated task identity and separately validated arguments. That is an architecture proposal, not a claim that the reference loop already implements it. Human authorization should remain outside generated text.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Map each agent to its source skills.
- 2
Separate schema validation from evidence validation.
- 3
Identify every place text could become a control message.
Copy-ready example
source rows -> reader draft -> schema check -> evidence review
trusted task identity -> routing policy -> selected agent
reviewed work product -> human authorizationFrequently asked questions
Does schema validation approve the financial conclusion?
No. It checks the instance against a schema, not its truth or business authority.
Is the suggested typed channel already present?
It is a proposed improvement; the inspected sample extracts messages from text.
Sources
- Financial Services / README.mdSource checked 2026-09-23
- Financial Services / scripts/validate.pySource checked 2026-09-23
- Financial Services / scripts/orchestrate.pySource checked 2026-09-23