An advisor-facing product generates summaries and figures that financial advisors read, rely on and pass on. The role was posted as automation throughput. The exposure lay in the numbers themselves. A figure that reaches an advisor stale, or one the advisor is not entitled to see, or one that never existed in any source, is a compliance failure and a breach of trust. The regulatory layer here is live, and the regulator names this exact feature type as a focus.
A number on an advisor's screen can be accurate and still be the wrong number to show.
A figure displayed to an advisor has at least three properties besides being correct. It has an age, because it came from a feed that updates on some cadence and was true as of a particular moment. It has an entitlement, because data licences and access rules decide who may see it. And it has a provenance, a record somewhere that it was derived from. A figure can be correct as of last week, correct but shown to someone not permitted to see it, or plausible and traceable to nothing at all. Each of those is a failure, and none of them shows up in an accuracy check.
Freshness has a trap built into ordinary monitoring. Most alert rules evaluate incoming values: page if this number is out of range. When a feed stops sending, no values arrive, so no rule is ever evaluated, and the dashboard stays green while the data goes stale. The engineering answer is a dead-man's switch, named after the handle a train driver must keep holding. The system expects a regular sign of life from each feed and raises the alarm when that sign stops. Silence becomes an event, where ordinary monitoring treats it as the absence of one.
Generated summaries add the provenance problem. Language generation produces fluent text, and fluent text about finance contains numbers. Some of those numbers come from the data provided. Others can be produced by the generator because they are plausible in context. A numeric-claim trace binds each number in the output to a specific source record. Where that binding cannot be made, the right behaviour is to abstain and say the figure is unavailable. An honest gap is recoverable. An invented figure in front of a client may not be.
Throughput was the visible metric. Whether the product was safe came down to three separate properties: every figure fresh, every figure entitled, no figure fabricated. They fail independently, so each needs its own control. An engagement shaped around throughput would have improved only the speed at which unverified numbers arrived, which makes every gap occur more often without making any of them smaller.
The data failures that matter are quiet, and most alerting listens for noise.
Data pipelines are usually monitored for bad values: a price out of range, a field that fails to parse, a job that throws an error. Those failures are loud and get fixed quickly. The failures that reach a client are quieter. A feed stops updating and the last good value stays on screen. A cache serves yesterday's figure with today's timestamp on the page. Nothing errors, so nothing alerts.
Generated content adds a second quiet failure. A summary that reads well and contains a confident figure is rarely questioned by the person reading it, and in a product where speed is the visible metric there is pressure never to leave a gap. A fabricated number fills that gap neatly, and it looks exactly like a real one.
The reflex, and the fix.
Build for throughput
It is the posted role and the visible metric.
Faster delivery of a stale or unentitled figure is a worse outcome than the slow version, because volume is what turns an integrity gap into a pattern.
Reframe it as data integrity
Two-lane alerting and a numeric-claim trace with an abstain path, in place of the pipeline speed the role described.
Numbers reaching an advisor that are fresh, entitled and traceable, with silence caught as a signal in its own right.
Frame it as integrity, because the compliance exposure attaches to the number an advisor sees, not to how fast the pipeline runs.
Watchdog and dead-man's-switch alerting
Alerting runs in two lanes. One pages on values out of range. The other pages on silence, so a data feed that stops sending is caught even though no bad value ever arrives. It is the same silence-detection discipline used on server fleets, applied to data freshness.
A numeric-claim trace
Every figure that reaches an advisor is traced back to its source, and where no source can be found the system abstains. No fabricated or stale number is presented. This is the faithfulness discipline from governed retrieval, applied to financial data.
Entitlement checked at presentation
A number the advisor is not entitled to see is a compliance failure even when it is perfectly accurate and perfectly fresh, so entitlement is checked at the moment of display.
What each choice cost, and what it bought.
AReframing throughput as integrity
The role asked for faster automation, and delivering that would have been straightforward and easy to report on. The engagement was reframed around the three properties that create the compliance exposure. That meant arguing against the brief and accepting that the most visible metric would not be the one improved. It bought work aimed at what the regulator cares about, which is the number an advisor sees, and avoided making unverified numbers arrive faster.
BPaging on silence as a separate lane
Alerting was split into two lanes, one for out-of-range values and one for silence. A second lane means more alerts to tune and more ways to be woken at night. Without it, the most common way a figure goes stale, a feed that simply stops, would produce no alert at all. The discipline is borrowed directly from server-fleet monitoring, where a machine that stops reporting is treated as a machine with a problem.
CAbstaining over fabricating
Every figure in generated output must be traced to a source record, and where it cannot be, the system abstains. Advisors will sometimes see a gap where they expected a number, which is less satisfying than a complete summary. A gap is honest and recoverable. A fabricated figure passed to a client is a compliance failure that the advisor carries, and nothing about the summary would have warned them.
DChecking entitlement at the moment of display
Entitlement could have been checked once, when data entered the system. It is checked at presentation instead, the last step before an advisor sees anything. Data travels through caches, summaries and derived figures, and by the end it can be far from where it was first checked. Checking at the point of display costs a little at every view, and it is the only place where the answer is guaranteed to concern this figure and this advisor.
A single headline number hides where a system fails. This work was scored on the dimensions that actually decide whether it holds in production, measured on real, held-out cases rather than the demo path.
A faster pipeline delivering figures nobody can trace, with a feed that went quiet last Tuesday and an alerting rule that only fires on values it never received.
A data-integrity layer in which every number reaching an advisor is fresh, entitled and traceable. Silence and staleness are caught by a dead-man's switch, every figure is traced to source, and the system abstains when the source is missing.
What it owns, and what it hands to a person.
Outcomes are qualitative, and no figure is claimed until one is confirmed. The watchdog and the numeric-claim trace are two facets of one engagement, and the page presents them that way.
The same two disciplines recur wherever a machine-produced number reaches somebody accountable for it. Page on absence as well as on value, and bind every claim to something checkable, with an abstain path when it is not.
A number shown to someone accountable for it can be accurate and still be stale, unentitled or untraceable. Each of those needs its own control.
Alert rules that evaluate values cannot fire when values stop arriving. Add a separate lane that pages on silence.
Bind every figure in generated text to a source record, and abstain when the binding fails. A visible gap is recoverable and an invented number may not be.
Check entitlement at the moment of display, because data drifts far from where it was first checked as it passes through caches and summaries.
When the brief asks for speed in a regulated product, ask first what the regulator cares about. Making unverified output faster makes every gap more frequent.