Bound Together: Composing Finance Agent Harnesses from Best-of-Breed Parts

A finance agent is a model inside a harness: the loop that connects it to data, retrieval, memory, tools, sandboxing, approvals, tracing, and records. The strongest implementation of each of these parts usually lives in a different harness. We ask whether a finance harness can be assembled from the best parts of several harnesses, and what binding it needs to meet finance's requirements.

We survey 22 harnesses, grading 667 capability cells from source code at pinned commits. Of 60 best-in-class cells, only 25 can be used outside their original harness. We compose components chosen from the survey leaders into one harness and add a thin binding layer. The layer enforces four finance requirements on every call: point-in-time reads, host-set least-privilege scope, declared and recorded model fallback, and a hash-chained record with journalled approvals.

On FinCompose-Bench (a synthetic trading desk with seven probe types plus four public datasets, scored from environment ledgers), we compare against five single-harness baselines and direct composition across seven proprietary and open-weights models. A scripted worst-case policy shows the bound harness contains every probed failure path, and ablations show that removing each property restores its failure. Across the seven models the invariants hold in every run. The 95% lower bound of the paired clean-accuracy difference to direct composition stays above −3 points in 6 of 7 models. Against single harnesses configured with a tool allowlist and a fallback chain, which match the bound harness on outage survival, it still uniquely records every model switch, enforces point-in-time reads, keeps a verifiable record, and, with a content-keyed journal, resumes every crashed run exactly once under all seven models. The main cost is conservative blocking of legitimate transfers by the borrowed injection-containment component; we report the pre-registered tests the results fail.