The Security Architecture of the AI-Native Fintech

Abstract

This work introduces Continuous-Coherence Security (CCS), a security architecture for AI-native fintechs, Open Finance, Embedded Finance, and autonomous financial agents. The proposal addresses a fundamental limitation of conventional security models: authentication and authorization may establish that an action is permitted, but not necessarily that it remains coherent with identity, purpose, context, history, and operational state throughout an execution trajectory. The framework formalizes this distinction through: SecureExecution = Authorization ∩ Coherence and explicitly separates the Reasoning Plane, Authority Plane, and Execution Plane. The architecture incorporates agent identity, least privilege, capability budgets, typed tool contracts, explicit abstention, deterministic policy enforcement, non-compensable constraints, pointwise and sequence-level coherence analysis, and governed execution. Evaluation was conducted in two stages. Stage I uses a synthetic 15,000-action testbed comparing a baseline, least privilege, a deterministic gateway, and Full CCS. On the frozen held-out test set, observed attack-success rate decreased from 99.66% under the baseline to 22.90% under the deterministic gateway and 1.44% under Full CCS, with 4.80% observed benign friction. Stage II evaluates two local 4B-class models, Qwen3:4B and Gemma3:4B, in a simulated financial runtime using real tool proposals, explicit no_action, typed contracts, frozen-trace counterfactual replay, semantically diverse adversarial variants, and two experimental arms: natural model susceptibility and assumed-compromise authority fault injection. Under the frozen protocol, natural adversarial induction was 43.3% for Qwen3:4B and 66.7% for Gemma3:4B. Despite this significant difference in model susceptibility, Full CCS produced zero observed unauthorized state changes across 60 adversarial episodes per model, with confidence intervals explicitly reported and observed benign friction of 12.5% and 17.5%, respectively. The study also formally separates threat detection from architectural containment. In Stage II, coherence evidence is provided by the experimental harness; therefore, the results evaluate containment given controlled evidence rather than autonomous threat detection from raw production financial telemetry. Within the controlled scope of the testbed, the findings support the design principle that model compromise need not imply system compromise. The study does not claim universal security, does not validate production financial environments, and does not interpret 0/60 observed compromises as proof of perfect protection. Its primary contribution is an operational, measurable, and falsifiable architecture for reducing systemic dependence on the intrinsic robustness of the underlying model.