Use casesFinancial services

Every reported figure traceable. Every lesson under four eyes.

Tillingham's data engineering group builds the pipelines behind its regulatory returns and client reports. Coding agents wrote most of the changes and reviewers corrected the same unwritten rules every week. An eight-week pathfinder put those rules under four-eyes review, in the firm's own cloud, with an audit trail the regulator could read.

Organisation
Asset manager, 60-person data and reporting engineering group
Work in scope
Regulatory returns, client reporting pipelines, the positions and pricing layers
Agents in use
Claude Code, Codex and Copilot
Tools connected
GitHub, Jira, Confluence, Airflow, Slack
Pathfinder
Eight weeks, the quarterly client reporting pipeline, one written success criterion
Memory networks
Firm, reporting platform, one per fund range, one per client, personal
Residency
memco in the firm's own cloud, UK region. Audit records retained seven years.

01Starting point

Where Tillingham started

Tillingham's reporting pipelines carry positions, prices and corporate actions from four custodians into the quarterly client reports and the regulator's returns. Sixty engineers maintain them, and for a year the agents on their machines had written most of the changes: a new column in a return, a client's revised format, a fix when a custodian changed a file layout. Each change goes through two reviewers before it touches a reported figure.

The reviewers corrected the same things every week. Which price feed is authoritative for the quarterly report. Why the pipeline must wait on a custodian's file rather than report the stale position when a Scottish bank holiday delays it. Where a stock split is adjusted. The written procedure was five years behind the desk, and the agents read the procedure. The head of data engineering counted a fortnight: 44 percent of agent-written changes were approved without a change requested, and the rest mostly needed one of a dozen known corrections.

The cost was reviewer hours and the autonomy the firm would not grant. Every change needed a full read because last week's lesson was gone. When internal audit asked why an agent had chosen one feed over another in March, the answer was a prompt, not a record. The pilot the group had run the year before had stalled there: nobody would sign off on an agent that could not show what it had learned, from whom, and when.

02Day one

Day one

The connection was the easy week. memco was deployed into the firm's own cloud, the agents were connected through the plugin, and then model risk and compliance spent a fortnight agreeing who could approve what. The pathfinder clock started when they signed.

  • Deploymentmemco running in the firm's UK cloud account, behind its own identity provider. Nothing in the reporting estate leaves the boundary.
  • Claude Code, Codex and Copilotmemco plugin on every engineer's machine and an MCP connection for the hosted agents, signed in through single sign-on. Reads are scoped by the engineer's group membership.
  • GitHub, Jira and AirflowPull request outcomes, tickets and pipeline run results attach to insights as evidence. A lesson about a feed links to the run that proved it.
  • PoliciesModel risk wrote nine policies before the first session: the authoritative feed per report, what is never reported from a stale file, what never enters memory. Always served, never decayed.
  • SeedThe two reviewers turned their standing corrections into thirty insights, each with scope and source. Each was approved by the other before it served.
  • SparkNetworks, four-eyes validation rules and the audit export to the firm's SIEM configured by the platform engineer with model risk watching.
  1. FirmPolicies: authoritative feeds, stale-data rules, what never enters memory, the regulator's formats.Every agent and engineer in the group.
  2. Reporting platformPipeline conventions, custodian file behaviour, the positions and pricing layers, Airflow quirks.Everyone in data engineering.
  3. Fund range networksRules particular to a range: valuation points, benchmark handling, what the range's reports show.Engineers assigned to that range.
  4. Client networksA client's report format and its agreed exceptions.Engineers on that client's reports. Never promoted above the client.
  5. PersonalEach engineer's own preferences.That engineer's agents only.

fig. 01Scope map

Tillingham memory networksNested scopes: the firm network holding model risk's policies, the reporting platform inside it, fund range networks inside that, sealed client networks for report formats, and the four-eyes route for anything touching a reported figure.FIRMnine policies, model riskREPORTING PLATFORMevery data engineerFUND RANGE AND CLIENT NETWORKSEquity rangesFixed income rangesMulti-asset+ one sealed network perclientPersonal · one per engineerFOUR EYESTWO REVIEWERSReads inherit downward · Writes stay local · Client networks never promote
Tillingham memory networksNested scopes: the firm network holding model risk's policies, the reporting platform inside it, fund range networks inside that, sealed client networks for report formats, and the four-eyes route for anything touching a reported figure.FIRMnine policies, model riskREPORTING PLATFORMevery data engineerFUND RANGE AND CLIENT NETWORKSEquity rangesFixed incomerangesMulti-asset+ one sealednetwork perPersonal · one per engineerFOUR EYESTWO REVIEWERSReads inherit downward · Writes stay local · Client networksnever promote
Policies in the firm network are served on every session. Client formats are sealed and never promote. The dashed route is four eyes: two named reviewers before anything about a reported figure rises above a fund range.

03The first weeks

The first weeks

Week one cost more than it returned: reads on a sparse memory added eight percent to token use and the first reuse came on day nine. From the second week the lessons were the reviewers' own corrections, approved by the other reviewer and served under their names.

fig. 02Deployment timeline

Tillingham: deployment to programme licenceTimeline from the deployment into the firm's cloud three weeks before the pathfinder, the baseline fortnight, the eight-week pathfinder with its first reuse on day nine, the model change in week five, the warehouse migration in week seven and the readout in week eight.DEPLOYMENT AND RULESEIGHT-WEEK PATHFINDERDAY 9First reuse, anotherrangeDAY -21Deployed in the firm'scloudDAY -14Baseline; ninepolicies writtenDAY 0Pathfinder starts;thirty seededDAY 2FX fix lessonDAY 18Benchmark lessonsplit; four-eyes ruleDAY 33Approved model changesDAY 47Warehouse migrated; 31retiredDAY 56Readout: 71% against60
Tillingham: deployment to programme licenceTimeline from the deployment into the firm's cloud three weeks before the pathfinder, the baseline fortnight, the eight-week pathfinder with its first reuse on day nine, the model change in week five, the warehouse migration in week seven and the readout in week eight.Deployment and rulesEight-week pathfinderDAY -21Deployed in the firm's cloudDAY -14Baseline; nine policies writtenDAY 0Pathfinder starts; thirty seededDAY 2FX fix lessonDAY 9First reuse, another rangeDAY 18Benchmark lesson split; four-eyes ruleDAY 33Approved model changesDAY 47Warehouse migrated; 31 retiredDAY 56Readout: 71% against 60
Spacing is proportional to elapsed days. The filled mark is the first reuse: a lesson one range's agent learned, cited by another's before it wrote a conversion.
  • Day 2. An agent builds the quarterly report's FX conversion from the intraday feed.Quarterly client reports convert at the 4pm fix from the official rates feed. The intraday feed is for monitoring only.Approved by both reviewers. Day nine: an agent on a different fund range cites it before writing a conversion. First reuse, and the first time a reviewer did not have to write it.
  • Day 7. A Scottish bank holiday delays a custodian's positions file and an agent's change lets the pipeline report yesterday's positions.When a custodian file misses the cut-off, the pipeline waits and raises the delay. It never reports from the previous file.Written as a policy, not an insight, after model risk read it. Served on every run. The agent that proposed reporting stale positions is the provenance.
  • Day 12. A stock split is adjusted in the pricing layer, which is where the agent found the price, and the positions are wrong until a reviewer catches it.Corporate actions are applied in the positions layer. The pricing layer carries the unadjusted price with the action reference.The correction recurs nowhere else. Three later changes touching corporate actions cite the insight and pass review first time.
  • Day 18. An insight about benchmark handling is promoted to the platform network. True for the equity ranges, wrong for the fixed income ranges.Benchmark returns on fixed income ranges are gross of fees. On equity ranges they are net. An insight that says which must say for which ranges.A reviewer says she no longer trusts what the agents bring her. Split into two scoped insights. Model risk adds a rule: nothing about a reported figure promotes above a fund range without both reviewers. The reviewer approves the next fortnight's insights herself before she reads them from an agent again.
  • Day 26. A client's report format is proposed for the platform network because three clients share it.Report formats are client facts. They live in the client's network and never promote above it, however many clients share them.Held by the rule. The three clients keep three identical insights in three sealed networks, which is the point.
  • Week 7. The firm migrates the reporting warehouse to a new platform.Pipelines read from the new warehouse from 1 November. The old connection strings, schemas and partitioning rules are retired.Thirty-one insights about the old warehouse are retired in a day, each with the migration ticket as provenance. memco flags four that conflict with the new schema; the reviewers rewrite two and retire two.

04Governance

Governance

  • Four eyes on every reported figureAn insight that touches a reported figure, a feed choice or a regulatory format waits for two named reviewers. Platform insights about tooling serve after one. Model risk owns the rules and reviews them quarterly.
  • Policies for what must never driftAuthoritative feeds, stale-data handling and what never enters memory are policies, written by model risk, served on every session and never re-ranked. An insight that contradicts one is flagged, not served.
  • Point-in-time reconstructionEvery insight is versioned with the date it served, the date it changed and who approved it. Internal audit can ask what the agents knew on 14 March and get the answer as a record, not a recollection.
  • Client networks are sealedA client's formats and exceptions live in that client's network, readable by the engineers on its reports and promoted nowhere. The regulator's formats live in the firm network for everyone.
  • Residency, audit and retentionmemco runs in the firm's own UK cloud behind its identity provider. Every read, write, approval and retirement is exported to the SIEM. Audit records are kept seven years. Insights retire on evidence, with the ticket that changed the world as provenance.

fig. 03The write path

From one reviewer's correction to another range's agent, under four eyesSwimlane showing an agent converting at the intraday feed, the first reviewer correcting it to the 4pm fix, the agent proposing the lesson with the pipeline run attached, memco holding it for a second reviewer because it touches a reported figure, then serving it to another fund range's agent on day nine.FIRST REVIEWERENGINEER'S AGENTmemcoSECOND REVIEWERANOTHER RANGE'SAGENTConverts FX atthe intraday feedday 2Corrects: the 4pmfixProposes thelesson, runattachedFOUR EYESHeld: a reportedfigureSecond approval,versioned anddatedCites it beforewriting aconversionday 9
From one reviewer's correction to another range's agent, under four eyesSwimlane showing an agent converting at the intraday feed, the first reviewer correcting it to the 4pm fix, the agent proposing the lesson with the pipeline run attached, memco holding it for a second reviewer because it touches a reported figure, then serving it to another fund range's agent on day nine.ENGINEER'S AGENTConverts FX at the intraday feedday 2FIRST REVIEWERCorrects: the 4pm fixENGINEER'S AGENTProposes the lesson, run attachedmemco · FOUR EYESHeld: a reported figureSECOND REVIEWERSecond approval, versioned and datedANOTHER RANGE'S AGENTCites it before writing a conversionday 9
The dashed node is four eyes: anything touching a reported figure waits for two named reviewers. Every version is dated for point-in-time audit.

05What compounded

What compounded

The pathfinder had one written criterion: approvals without a change requested, on the quarterly reporting pipeline, against the fortnight's baseline. The readout in week eight met it, and the firm took the agreement to a named programme licence covering the whole reporting platform.

MetricMovementWhy
First-pass acceptance44% to 71%Approvals without a change requested, on the pathfinder pipeline, by week eight. The success criterion was 60 percent.
Safe autonomous completionZero, by designEvery change to a reported figure still has two human approvals. The firm's position is that the metric to move is the quality of what reaches the reviewers, not whether they are there.
Repeat-error rateTwelve corrections to threeThe three that remained concern judgement calls the reviewers chose to keep as judgement.
Adaptation speed31 lessons retired in a dayThe warehouse migration in week seven. Before memco, the old connection strings would have lived in prompt files and been found by failing runs over the following quarter.
Time to an accepted resultDown 29%Changes touching feeds or corporate actions, measured from ticket open to second approval. The gain is in fewer review rounds, not faster typing.
Improvement with experienceThrough two model changesThe approved model changed in week five. The lessons were never in the prompt, so nothing was retuned.

fig. 04Against the criterion

Approvals without a change requested, baseline to week eightSlopegraph: approvals without a change requested on the reporting pipeline rise from 44 to 71 percent, past the written criterion of 60.BASELINEWEEK 8CRITERION 60%44%71%Reporting pipeline, connected
Agent-written changes approved without a change requested, on the quarterly reporting pipeline. The dashed rule is the pathfinder's written criterion.

fig. 05Costs before it pays

Tokens per approved change, week by weekLine chart indexed to the baseline: 108 in week one, crossover in week two, 82 by week four and 64 by week eight.607590100BASELINECROSSOVER10864WK 1WK 2WK 4WK 6WK 8Tokens per approved change, reporting pipeline
Index, baseline fortnight = 100, counted after reads. Week one cost eight percent more than the baseline.

06What it cost

What it cost

  • Setup timeA week for the deployment into the firm's cloud and single sign-on. A fortnight for model risk and compliance to agree validation rules, scopes and the audit export. Eight weeks of pathfinder with a written criterion before the licence.
  • Who ran itOne platform engineer, the head of data engineering and one model-risk analyst. The two reviewers spent about three hours a week approving insights in month one, about one by month three.
  • Licence and tokensA paid pathfinder, then a named programme licence for the reporting platform with unlimited users and agents inside it. Reads added eight percent to token use in week one. By week eight tokens per approved change were down 36 percent, after the reads.
  • What it replacedA prompt library maintained by hand, the Confluence page of desk rules last edited in 2021, and the pilot that never left pilot.

Put your reviewers' corrections under audit.

Join the waitlist

More deployments.

All use cases