Claude Financial Services: what the public plugins actually provide
Operating Financial Services safely: trust boundaries and recovery
Protect customer data and prevent document content from becoming an authorized instruction.
What you will learn
- Start at the connector boundary
- Treat handoff text as untrusted input
- Recover without destroying evidence
Before you start
- Command-line and JSON familiarity
- A disposable workspace with synthetic financial records
A proposed learning project turns validated requests into reviewable records without giving documents control of routing.
Key takeaways
- Schema validity does not establish authority.
- Untrusted documents can affect generated control text.
- Recovery needs evidence and bounded replay.
Start at the connector boundary
A connector declaration is a destination and integration surface, not proof of consent to read every document it can reach. Scope each connection to the smallest approved dataset and keep a record of who authorized it.
Use synthetic records during setup. When real data becomes necessary, agree on access, retention and redaction with the responsible team. Do not copy connector tokens, customer statements or full prompts into public debugging reports.
Treat handoff text as untrusted input
The orchestration sample acknowledges that upstream documents can influence text containing handoff_request. Its target allowlist and payload schema address destinations and shape. They do not authenticate the origin of a requested action.
Keep actual posting, transactions and approvals behind an application control that the model cannot satisfy by writing a sentence. Test the boundary with harmless fake documents that ask for an out-of-scope action; a safe result is a refusal or a pending review.
Recover without destroying evidence
On a suspicious handoff or unexpected connector request, stop new work and preserve a redacted trace with task identifiers. Revoke affected credentials through the provider if exposure is suspected, then verify the scope before resuming.
Restore the reviewed workflow version and replay only explicitly selected tasks. Keep rejected drafts for authorized incident analysis under a retention policy. Automatic replay of every failed item can duplicate external work or repeat the same unsafe instruction.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Inventory connector permissions and owners.
- 2
Keep model output separate from action authorization.
- 3
Pause and review selected tasks before replay.
Copy-ready example
on_unexpected_action:
pause_new_tasks: true
retain: redacted_trace
authorization: human_review
replay: explicitly_selected_tasksFrequently asked questions
May a generated approval sentence authorize posting?
No. Authorization should come from a trusted human or application control.
Should incident logs contain the full customer document?
Prefer task identifiers and minimum redacted evidence under an approved retention policy.
Sources
- Financial Services / README.mdSource checked 2026-09-23
- Financial Services / scripts/orchestrate.pySource checked 2026-09-23
- Financial Services / scripts/validate.pySource checked 2026-09-23