Portability With Accountability
anthropics/financial-services is best understood as a governed portability system. It packages financial methods into skills, places those skills inside named workflows, and carries the workflows between interactive and headless runtimes. The final question is whether that movement preserves the alignment among evidence, tools, artifacts, checks, and human authority. Readers can evaluate any workflow in the repository by following that alignment across its full lifecycle rather than judging portability from a shared prompt or a successful file upload.
The portable unit is a chain, not a prompt
A reusable system prompt is useful because it preserves a role and a way of working. It is not sufficient because the role depends on everything around it. A named agent needs a domain method to tell it how to calculate, compare, classify, or evaluate. It needs an input and source boundary to tell it what evidence is relevant and what is merely a claim. It needs a runtime to tell it which tools and connectors are available. It needs an artifact contract to make the result inspectable. It needs checks to expose errors and uncertainty. It needs an authority boundary to say who may approve, post, publish, distribute, or act.
The repository makes these dependencies visible through layers. Vertical plugins hold reusable skills, commands, and connector definitions. Named agent plugins add role prompts, workflow order, outputs, and guardrails. Managed Agent cookbooks translate those workflows into headless manifests with toolsets, environment-configured MCP servers, leaf workers, steering events, and output locations. Synchronization keeps bundled skill copies aligned with vertical sources, while deployment compilation turns human-readable references into uploaded skills and created-agent IDs.
The chain is easier to trust when each layer answers a different question. The skill answers, “What method should be applied?” The named agent answers, “When does that method run, and what work product should result?” The runtime answers, “What may this worker read, call, or write?” The artifact answers, “What can another professional inspect?” The checker answers, “Which mechanical or evidentiary conditions have been tested?” The human or firm system answers, “What decision or action is authorized?”
If those questions are blurred, portability becomes cosmetic. Two agents can share a prompt while using different providers, different skill copies, different write permissions, or different review paths. They may look identical in a marketplace and behave differently in practice. The repository's one-source-of-truth idea is therefore a starting condition for consistency, not proof of runtime equivalence.
Least privilege belongs inside the workflow
The security design is part of the business process because the artifacts have consequences. A GL exception report can influence a controller's investigation. A KYC escalation packet can affect onboarding. A model can shape a valuation discussion. A research note can influence a senior analyst's view. The closer a worker is to raw outsider-authored material or durable output, the more carefully its tools and authority must be bounded.
That is why the Managed Agent patterns separate the document reader, trusted computation, independent critic, and write-holder. A reader may extract fields from an onboarding packet or candidate breaks from a custodian statement, but it does not receive a connector, shell, or write capability. The orchestrator or rules layer applies trusted sources or firm policy. A critic re-verifies material findings where the workflow calls for it. A single leaf worker writes the report, workbook, or escalation packet from a normalized or verified result.
This is not a generic security add-on applied after the workflow is designed. It changes the meaning of the workflow. The KYC reader is not a risk decision-maker because it does not have the rules or authority to approve. The GL reader is not a resolver because it does not have trusted internal sources or write access. The model builder can write a workbook, but the auditor and user review remain separate states. Least privilege turns a broad claim—“the agent processes the case”—into narrower claims that can be reviewed: “the reader extracted these fields,” “the rules engine produced these outcomes,” “the critic confirmed these breaks,” and “the writer staged this artifact.”
The same design also governs context crossing between named agents. A handoff to Model Builder, Month-End Closer, or another workflow is an event with a target and payload, not a silent transfer of all upstream authority. An allowlist can restrict destinations, and a schema can restrict payload shape, but the receiving workflow must still apply its own method and checks.