Stateful Mediation and Selective Auditing for Financial Language-Model Actions: A Paired Controlled Simulator Study

Abstract

Language-model agents can propose financial actions based on observations that become stale before execution. This study measures how five execution arrangements translate the same model proposals into post-state harm and correct completion in a controlled synthetic financial workflow. A protocol was internally frozen before generation. Four fixed quantized local model builds and two seeds converted 240 visible contexts into 1,920 context-level proposals. Mapping those proposals to 480 paired episode variants produced 3,840 proposal-by-episode units; replay through five arms yielded 19,200 transitions. State-bound checking produced 24 harmful transitions among 3,840 units, compared with 1,126 under direct execution (paired risk difference −0.2870; separate one-sided 95% generator-sensitivity bounds −0.2901 to −0.2836). On hazardous interpositions, its paired difference from snapshot checking was −0.8167; on paired benign interpositions, its correct-completion difference from coarse full-state checking was +0.8167. Those contrasts are algebraic sign mirrors over shared contexts, not independent confirmations. State-bound checking retained 81.67% eligible completion but did not eliminate harms visible at observation. All three contrast directions were structurally constrained by the nested mediators; the resampling bounds address nonzero magnitude under the synthetic generator, not discovery of an empirically contestable sign. In 60,000 selective-audit trajectories, no policy crossed either prespecified stopping threshold by 480 observations; all threshold times were censored at 481. Binding execution to current control state changed consequences in this fixed suite, while the conservative audit procedure did not yield an operational stopping certificate.