Five questions fintech ops teams ask before letting agents run regulated processes

At a neobank we work with, half of the 3,000 operators now block cards, ship terminals and escalate cases from Claude or Zendesk rather than from a back-office screen. Every ops and product leader I spoke to this month wants the same move for their own regulated processes. Before committing, they all asked the same five questions.

1. “Half our endpoints don’t exist yet. How does this plug in?”

Usually asked by an ops director whose back office belongs to the tech team, and who has to file a ticket and lobby for every change.

No tool invents endpoints, and we don’t claim to. The work splits cleanly. Engineering does it once: connect the backend to your data, expose the endpoints you already have, and write the missing ones as smart actions, each with a plain description. From there, ops own the rest: which steps run in which order, who approves, where the action gets triggered. The tickets stop at the action layer instead of at every workflow change.

2. “Claude can build me a portal with SSO and roles in a week. Why buy?”

It can, and an engineer asking this is asking the right question. The first version is the cheap part. The cost arrives on day two: permissions that drift as teams and partners change, approvals that need rules, an audit log a regulator will read, a core banking system or LLM provider you’ll swap within two years, and a partner who needs access to five actions and nothing else.

One ops director had coded all of that himself into his own agent harness. His reaction to our architecture was that it was exactly what he’d spent months building. The question that matters is who maintains it next year.

3. “Will ops really be autonomous, or will engineering still build everything?”

Both, by design. Builders face a blank-page problem at first: they know the process but not how to lay it out. With onboarding, they build their own screens and workflows within about a week.

Changing data is another matter, and you choose how strict to be. Each role decides whether a user can edit records directly, with no developer involved. For sensitive data, switch off direct edits and route every write through a smart action engineering has reviewed: ops compose freely on top of those actions, but they can’t invent a new way to edit a balance. That boundary is what lets an engineering manager say yes to ops autonomy.

4. “Isn’t MCP probabilistic? I don’t want an LLM deciding which endpoint to call.”

Neither do we. Most teams told us around 80% of their workflows are fully deterministic, and they want them kept that way.

So each action has two doors. Deterministic systems call it through an API. AI-native tools such as Claude call the same action through MCP. Permissions and the audit log are identical either way. Where AI does sit in a workflow, it recommends: a confidence score, a reason, a suggested next step. A named person accepts or rejects, and the log records who.

5. “We have no AI owner, a Copilot licence, and security says no. Where do we start?”

This came from a PM inside a group that had just acquired her company. Security’s fear is concrete: prompt injection, and a model reaching data it shouldn’t.

Three facts address it. The Forest backend runs in your infrastructure, so your records stay there; our servers handle configuration, permissions and logs. Plug in your own AI and no data passes through Forest at all. An agent can only call the actions its role allows, whatever ends up in its prompt. And the first use case can be read-only, with human approval on anything that writes and a full trace of every call. That gives security something to evaluate instead of something to imagine, and a small win gives the next project a reason to exist.

From back office to agent-ready, step by step

One fintech went from connection to its first ops-built workflows in three weeks. Another ran its process against two core banking systems for a year, writing to both, until the new one was ready to take over. A third moved its agents to a European LLM without interrupting operations, because permissions and logs never depended on the model.

Where to start

Pick one process your team runs every day, expose its actions read-only, and let an agent recommend while a person decides. If you want a second pair of eyes, we’ll map that process with you in 30 minutes.