Abstract
Agents in financial services carry a constraint most agent stacks never have to meet: sooner or later every one of them has to explain itself — to an owner, an auditor, or a risk committee. This talk is how we built an AgentOps platform at BlackRock under that constraint, in the order it actually happened, and what each layer turned out to depend on.
It began as a thin wrapper over Google ADK — enough to point an agent at our own models instead of a vendor endpoint, with one interface spanning self-hosted open-weight deployments and closed vendor APIs. Evals and guardrails came next: an agent you can't score and can't constrain is not a production candidate here. Then a canvas, so prototyping and experimentation no longer required a Python environment — and canvas and SDK were made to compile to the same representation, so a drawn agent and a written one are the same object to everything downstream. Then an agent registry, the point at which agents stopped being scripts and became owned, versioned, deployable artifacts. Governance followed the registry: per-agent authorization, audit, and kill switches at both the model endpoint and the policy layer. Then a skills hub, so capability became something versioned and shared rather than prompt text copied between projects.
Memory deserves its own treatment, because the two kinds are not variants of each other. Episodic memory is what an agent knows about a person: facts distilled from sessions onto a bi-temporal knowledge graph, where a contradicting fact invalidates its predecessor rather than overwriting it — so you can still ask what the agent believed last March. Procedural memory is what an agent knows how to do: it observes its own successful runs, abstracts what worked into a reusable skill, verifies that skill by replaying it rather than asking a model whether it looks right, and never stores argument values, so the privacy boundary sits at capture. One remembers the user; the other remembers the method.
I'll close on what regulated environments demand that generic agent frameworks don't — inventory with real owners and risk tiers, action scope enforced at runtime, promotion gates before production, audit behind every authorization decision, and the ability to stop an agent mid-flight — and on how to tell the difference between a control you have and one you only describe.
Key Takeaways:
A build order for an enterprise AgentOps stack that held up — an ADK over your own model layer, then evals and guardrails, then a canvas for prototyping, then an agent registry, then governance and a skills hub — and what each layer depends on from the one before it.
How to make evaluation and memory load-bearing rather than decorative: scoring a single agent run at seven independent decision points, and treating episodic memory (what an agent knows about a user) and procedural memory (what it knows how to do) as separate systems, each with its own verification and privacy boundary.
What a regulated environment demands that generic agent frameworks don't — inventory with owners and risk tiers, action scope enforced at runtime, promotion gates, audit and kill switches — and how to tell the difference between a control you have and a control you only claim.