Deterministic Safety: Bounding AI Agents with DMN Engines

As Large Language Model (LLM) agents transition from passive informational assistants to active autonomous decision nodes in core banking architectures, financial institutions face a critical governance challenge: The Stochastic Vulnerability of Generative AI.

While autonomous agents excel at reasoning across unstructured trade documents, parsing customer dispute histories, and recommending exception overrides, their underlying execution model is inherently probabilistic. Prompt engineering, system instructions, and temperature tuning reduce—but never eliminate—the risk of model hallucination, parameter drift, or prompt injection attacks. In a Tier-1 banking environment, an unconstrained AI agent that recommends an invalid $500,000 credit line increase or waives a mandatory Anti-Money Laundering (AML) verification check creates immediate compliance and financial liability.

Under the Xenon Architecture Standards, modern core banking platforms eliminate non-deterministic operational risk through the Hybrid AI-DMN Safety Pattern. This pattern mandates that autonomous AI agents never possess direct execution authority over financial transactions. Instead, AI agents act strictly as Proposal Generators, whose outputs are intercepted, validated, and clamped by deterministic Decision Model and Notation (DMN 1.3) engines running on Flowable DMN before any state mutation can occur.

💡 Explore the Xenon Architecture Standard For comprehensive architectural blueprints, BIAN service domain mappings, and dual-orchestration integration patterns, visit the official Xenon Architecture Guide. To inspect reference code, infrastructure templates, and open-source banking modules, explore the VecPay-Tech GitHub Organization.

---

BIAN Service Domain Guardrail Mapping

In a Banking Industry Architecture Network (BIAN) topology, financial and operational risk parameters vary across service domains. The hybrid AI-DMN guardrail pattern assigns specific DMN policy enforcement mechanisms based on domain criticality.

BIAN Service Domain	AI Agent Scope	Proposed AI Output	Deterministic DMN Guardrail	Hit Policy	Guardrail Action
Consumer Advice	Product eligibility & rate matching	Recommended APR & fee waiver	Max fee waiver cap & APR floor table	FIRST (F)	Clamp / Hard Override
Credit Assessment	Commercial credit exception scoring	Proposed credit limit adjustment	Debt-to-Income ($DTI$) hard cap & regulatory ceiling	UNIQUE (U)	Reject & Escalate to Human
Payment Execution	FX surcharge exception handling	Dynamic FX spread reduction	Tiered currency spread floor matrix	COLLECT (MIN)	Enforce Minimum Spread
Fraud Evaluation	False positive transaction triage	Recommended hold release	Historical transaction anomaly threshold	ANY (A)	Reject / Require Dual Sign-Off
Customer Onboarding	Identity verification exception review	Document validation pass/fail	Regulatory KYC risk score matrix	UNIQUE (U)	Hard Compliance Rejection

---

The Hybrid AI-DMN Safety Architecture

The core tenet of Deterministic Safety is the separation of Probabilistic Suggestion from Deterministic Execution.

An AI agent analyzes complex inputs and constructs a structured proposal payload. This payload is passed into a stateless Flowable DMN Engine, which evaluates the proposal against versioned, business-approved decision tables.

                              HYBRID AI-DMN SAFETY TOPOLOGY

  +---------------------------------------------------------------------------------+
  | PROBABILISTIC LAYER (Non-Deterministic AI Agent)                                |
  |                                                                                 |
  |  Unstructured Data / Event ---> [ LLM Agent Reasoning Loop ]                    |
  +--------------------------------------------------|------------------------------+
                                                     |
                                            1. Generates Dynamic Proposal Payload
                                               (e.g., Proposed Limit: $75,000)
                                                     |
                                                     v
  +---------------------------------------------------------------------------------+
  | DETERMINISTIC GUARDRAIL LAYER (Flowable DMN Engine)                             |
  |                                                                                 |
  |  +---------------------------------------------------------------------------+  |
  |  | Flowable DMN Decision Table                                               |  |
  |  |                                                                           |  |
  |  |  Input: { ProposedLimit: $75,000, RiskTier: "TIER_2", MaxAllowed: $50,000 }|  |
  |  |  Evaluation: Rule Violated (ProposedLimit > MaxAllowed)                   |  |
  |  |  Output: { Status: "CLAMPED", FinalLimit: $50,000, Escalation: false }     |  |
  |  +---------------------------------------------------------------------------+  |
  +--------------------------------------------------|------------------------------+
                                                     |
                                            2. Evaluates & Clamps Proposal
                                                     |
                                                     v
  +---------------------------------------------------------------------------------+
  | TRANSACTIONAL EXECUTION LAYER (Temporal Saga / Microservice)                    |
  |                                                                                 |
  |  [ Execute Ledger Mutation with Guardrailed Payload: $50,000 ]                  |
  +---------------------------------------------------------------------------------+

Safety Execution Lifecycle

1. Proposal Generation: The AI Agent receives an operational task, executes internal reasoning tools, and outputs a structured JSON proposal containing its recommended actions and confidence metrics.
2. Deterministic Interception: A Spring Boot application service intercepts the AI proposal before invoking any transaction API or downstream Temporal Saga.
3. DMN Guardrail Evaluation: The proposal parameters (along with verified customer facts retrieved directly from core databases) are injected into the Flowable DMN Engine.
4. Enforcement Execution:
5. PASSED: The proposed payload falls within legal policy parameters and proceeds to execution.
6. CLAMPED: The proposal exceeds non-critical limits (e.g., requested fee discount is too high); the DMN engine automatically clamps the value to the maximum permissible threshold.
7. REJECTED / ESCALATED: The proposal violates strict regulatory or risk boundaries; the execution path is halted, and control is routed to a human compliance officer.

---

Mathematical Reliability & Safety Probability

By introducing a deterministic DMN guardrail between the stochastic AI agent and the financial database, the composite system safety probability $P_{\text{safe-execution}}$ moves from probabilistic uncertainty to absolute deterministic boundary control.

Let $P_{\text{agent-valid}}$ be the probability that an LLM agent generates a correct, non-hallucinated proposal, and $P_{\text{dmn-coverage}}$ be the coverage completeness of the DMN rule table. The overall safety probability of the system is defined as:

$$P_{\text{safe-execution}} = P_{\text{agent-valid}} + \bigl( 1 - P_{\text{agent-valid}} \bigr) \times P_{\text{dmn-guard-block}}$$

Where $P_{\text{dmn-guard-block}}$ is the probability that the DMN engine successfully catches and intercepts an out-of-bounds or hallucinated proposal:

$$P_{\text{dmn-guard-block}} = 1 - P_{\text{rule-omission}}$$

Because DMN 1.3 tables are exhaustively verifiable for completeness and overlap using automated static analysis, $P_{\text{rule-omission}} \to 0$ , guaranteeing that even if $P_{\text{agent-valid}}$ drops during model degradation, $P_{\text{safe-execution}} \approx 1.0$ for all defined financial boundaries.

---

Technical Implementation: Flowable DMN Guardrail Integration

1. DMN 1.3 Decision Table Definition (ai-credit-override-guardrail.dmn)

The DMN table below evaluates an AI agent's proposed credit limit override for a commercial account. It enforces hard ceiling caps based on verified internal customer risk tiers and flags required human sign-offs.

<?xml version="1.0" encoding="UTF-8"?>
<definitions xmlns="https://www.omg.org/spec/DMN/20191111/MODEL/"
             xmlns:flowable="http://flowable.org/dmn"
             id="definitions_ai_credit_guardrail"
             name="AI Credit Override Guardrail"
             namespace="http://xenon.banking/dmn/safety">

  <decision id="aiCreditOverrideGuardrail" name="AI Credit Limit Override Guardrail">
    <decisionTable id="decisionTable_ai_guardrail" hitPolicy="FIRST">

      <!-- Inputs from AI Proposal and Core DB -->
      <input id="input_1" label="Customer Risk Tier">
        <inputExpression id="inputExpression_1" typeRef="string">
          <text>customerRiskTier</text>
        </inputExpression>
      </input>

      <input id="input_2" label="AI Proposed Credit Limit">
        <inputExpression id="inputExpression_2" typeRef="number">
          <text>proposedLimit</text>
        </inputExpression>
      </input>

      <input id="input_3" label="AI Agent Confidence Score">
        <inputExpression id="inputExpression_3" typeRef="number">
          <text>agentConfidenceScore</text>
        </inputExpression>
      </input>

      <!-- Outputs -->
      <output id="output_1" label="Guardrail Decision" name="guardrailDecision" typeRef="string" />
      <output id="output_2" label="Sanitized Credit Limit" name="sanitizedLimit" typeRef="number" />
      <output id="output_3" label="Require Human Review" name="requireHumanReview" typeRef="boolean" />
      <output id="output_4" label="Policy Violation Reason" name="violationReason" typeRef="string" />

      <!-- Rule 1: Reject low-confidence AI proposals instantly -->
      <rule id="rule_1">
        <inputEntry id="inputEntry_1_1"><text>-</text></inputEntry>
        <inputEntry id="inputEntry_2_1"><text>-</text></inputEntry>
        <inputEntry id="inputEntry_3_1"><text>&lt; 0.85</text></inputEntry>
        <outputEntry id="outputEntry_1_1"><text>"REJECTED"</text></outputEntry>
        <outputEntry id="outputEntry_2_1"><text>0.00</text></outputEntry>
        <outputEntry id="outputEntry_3_1"><text>true</text></outputEntry>
        <outputEntry id="outputEntry_4_1"><text>"AI agent confidence score below threshold (0.85)."</text></outputEntry>
      </rule>

      <!-- Rule 2: High Risk Tier - Absolute Cap at $25,000. Clamp if exceeded. -->
      <rule id="rule_2">
        <inputEntry id="inputEntry_1_2"><text>"HIGH_RISK"</text></inputEntry>
        <inputEntry id="inputEntry_2_2"><text>&gt; 25000</text></inputEntry>
        <inputEntry id="inputEntry_3_2"><text>&gt;= 0.85</text></inputEntry>
        <outputEntry id="outputEntry_1_2"><text>"CLAMPED"</text></outputEntry>
        <outputEntry id="outputEntry_2_2"><text>25000.00</text></outputEntry>
        <outputEntry id="outputEntry_3_2"><text>true</text></outputEntry>
        <outputEntry id="outputEntry_4_2"><text>"Proposed limit exceeded HIGH_RISK tier maximum cap ($25,000)."</text></outputEntry>
      </rule>

      <!-- Rule 3: Medium Risk Tier - Absolute Cap at $100,000. Clamp if exceeded. -->
      <rule id="rule_3">
        <inputEntry id="inputEntry_1_3"><text>"MEDIUM_RISK"</text></inputEntry>
        <inputEntry id="inputEntry_2_3"><text>&gt; 100000</text></inputEntry>
        <inputEntry id="inputEntry_3_3"><text>&gt;= 0.85</text></inputEntry>
        <outputEntry id="outputEntry_1_3"><text>"CLAMPED"</text></outputEntry>
        <outputEntry id="outputEntry_2_3"><text>100000.00</text></outputEntry>
        <outputEntry id="outputEntry_3_3"><text>false</text></outputEntry>
        <outputEntry id="outputEntry_4_3"><text>"Proposed limit clamped to MEDIUM_RISK policy cap ($100,000)."</text></outputEntry>
      </rule>

      <!-- Rule 4: Standard Approval Pass-Through -->
      <rule id="rule_4">
        <inputEntry id="inputEntry_1_4"><text>-</text></inputEntry>
        <inputEntry id="inputEntry_2_4"><text>-</text></inputEntry>
        <inputEntry id="inputEntry_3_4"><text>&gt;= 0.85</text></inputEntry>
        <outputEntry id="outputEntry_1_4"><text>"PASSED"</text></outputEntry>
        <outputEntry id="outputEntry_2_4"><text>proposedLimit</text></outputEntry>
        <outputEntry id="outputEntry_3_4"><text>false</text></outputEntry>
        <outputEntry id="outputEntry_4_4"><text>"NONE"</text></outputEntry>
      </rule>

    </decisionTable>
  </decision>
</definitions>

---

2. Spring Boot Guardrail Interceptor Service (Java 21)

This application service receives the AI agent's raw recommendation, executes the Flowable DMN Engine synchronously, and enforces the resulting sanitized bounds.

package com.xenon.banking.ai.guardrail;

import org.flowable.dmn.api.DmnDecisionService;
import org.springframework.stereotype.Service;

import java.util.HashMap;
import java.util.Map;

public record AiProposalPayload(
        String customerId,
        String customerRiskTier,
        double proposedCreditLimit,
        double agentConfidenceScore,
        String agentReasoning
) {}

public record GuardrailedExecutionPayload(
        String customerId,
        String executionStatus, // "PASSED", "CLAMPED", "REJECTED"
        double finalApprovedLimit,
        boolean requiresHumanReview,
        String violationReason,
        String originalAgentReasoning
) {}

@Service
public class AiDecisionGuardrailService {

    private final DmnDecisionService dmnDecisionService;

    public AiDecisionGuardrailService(DmnDecisionService dmnDecisionService) {
        this.dmnDecisionService = dmnDecisionService;
    }

    public GuardrailedExecutionPayload sanitizeAgentProposal(AiProposalPayload proposal) {
        // 1. Prepare Fact Environment for DMN Engine
        Map<String, Object> inputVariables = new HashMap<>();
        inputVariables.put("customerRiskTier", proposal.customerRiskTier());
        inputVariables.put("proposedLimit", proposal.proposedCreditLimit());
        inputVariables.put("agentConfidenceScore", proposal.agentConfidenceScore());

        // 2. Execute Flowable DMN Decision Table synchronously
        Map<String, Object> dmnResult = dmnDecisionService.createExecutionBuilder()
                .decisionKey("aiCreditOverrideGuardrail")
                .variables(inputVariables)
                .executeWithSingleResult();

        if (dmnResult == null || dmnResult.isEmpty()) {
            // Safety Fail-Closed: If DMN execution fails, default to total rejection
            return new GuardrailedExecutionPayload(
                    proposal.customerId(),
                    "REJECTED",
                    0.00,
                    true,
                    "CRITICAL: DMN Guardrail engine failed to return execution result.",
                    proposal.agentReasoning()
            );
        }

        // 3. Extract Sanitized Output Parameters
        String guardrailDecision = (String) dmnResult.get("guardrailDecision");
        double sanitizedLimit = ((Number) dmnResult.get("sanitizedLimit")).doubleValue();
        boolean requireHumanReview = (Boolean) dmnResult.get("requireHumanReview");
        String violationReason = (String) dmnResult.get("violationReason");

        // 4. Construct Final Guardrailed Execution Context
        return new GuardrailedExecutionPayload(
                proposal.customerId(),
                guardrailDecision,
                sanitizedLimit,
                requireHumanReview,
                violationReason,
                proposal.agentReasoning()
        );
    }
}

---

Operational Guardrail Patterns: Clamping, Escalation, and Rejection

When an AI agent's proposal triggers a DMN rule violation, the system handles the exception deterministically based on three core architectural patterns:

                                GUARDRAIL EXCEPTION PATTERNS

                    +------------------------------------------+
                    | AI Agent Proposal Input Payload          |
                    +--------------------+---------------------+
                                         |
                                         v
                    +--------------------+---------------------+
                    | Flowable DMN Engine Evaluation           |
                    +----+---------------+---------------+-----+
                         |               |               |
        [ Outcome 1 ]    | [ Outcome 2 ] | [ Outcome 3 ] |
        Proposal Passed  | Clamped Limit | Policy Reject |
                         |               |               |
                         v               v               v
                +----------------+ +-----------+ +-----------------+
                | Direct Machine | | Execute   | | Suspend & Route |
                | Saga Execution | | Clamped   | | to Human User   |
                |                | | Value     | | Task (Flowable) |
                +----------------+ +-----------+ +-----------------+

1. The Clamping Pattern (Value Bounding)

If the AI agent suggests an action that is conceptually valid but numerically excessive (e.g., an dynamic FX rate discount of 1.5% when maximum policy allows 0.5%), the DMN engine mutates the execution variable to the maximum policy boundary (0.5%). The transaction proceeds without breaking operational velocity, while an audit event logs the clamping action.

2. The Human Escalation Pattern (Flowable BPMN Hand-off)

If the AI agent proposes an exception on an account flagged as HIGH_RISK, or if the agent's internal confidence score falls below policy threshold ($< 0.85$), the DMN engine sets requireHumanReview = true. The system suspends automatic processing and instantiates a native Flowable BPMN User Task, routing the AI proposal and DMN violation audit log to a senior human underwriter.

3. Hard Policy Rejection (Fail-Closed)

If an AI agent attempts an action that violates zero-tolerance regulatory rules (such as waiving a mandatory sanction screening step), the DMN engine returns a hard REJECTED status. The transaction halts instantly, preventing the downstream Temporal Saga from initializing.

---

Observability, Regulatory Lineage, and Auditability

Financial regulators (such as OCC, EBA, and MAS) require full explainability for every automated decision, especially when AI models are involved. Storing only the LLM's prompt and completion logs is insufficient because prompt completions do not prove that policy guardrails were enforced at runtime.

Enterprise Safety Audit Event Schema

For every AI proposal processed through the guardrail service, an immutable compliance audit record is written to the centralized log stream (Kafka / Elastic Search), binding the AI context to the DMN execution result:

{
  "eventId": "AUDIT-SAFE-2026-880192",
  "correlationId": "BIAN-CRED-2026-44012",
  "bianDomain": "CreditAssessment",
  "timestamp": "2026-09-16T12:01:00Z",
  "aiAgentMetadata": {
    "modelId": "xenon-risk-agent-v3",
    "promptHash": "a8f92b...3c11",
    "rawProposedLimit": 75000.00,
    "confidenceScore": 0.91,
    "agentReasoning": "Strong cash flow history over 12 months justifies limit increase."
  },
  "dmnGuardrailMetadata": {
    "decisionKey": "aiCreditOverrideGuardrail",
    "decisionTableVersion": "v2026.2.0",
    "evaluatedHitPolicy": "FIRST",
    "ruleMatched": "rule_2",
    "guardrailOutcome": "CLAMPED",
    "enforcedFinalLimit": 25000.00,
    "violationReason": "Proposed limit exceeded HIGH_RISK tier maximum cap ($25,000)."
  },
  "executionTrace": {
    "downstreamSagaTriggered": true,
    "sagaExecutionId": "SAGA-CREDIT-77019",
    "humanOverrideRequired": true
  }
}

---

Combining stochastic AI reasoning with deterministic Flowable DMN engines solves the core AI adoption dilemma in enterprise banking. By relegating Large Language Model agents to proposal generation and enforcing absolute financial and regulatory boundaries via DMN 1.3 decision tables, core banking platforms achieve advanced operational automation without compromising system safety, financial predictability, or regulatory compliance across BIAN service domains.