Existing agent benchmarks ask whether the agent finished the task. We ask whether it finished it within policy. We introduce Fiducia-bench, a benchmark for the governability of financial agents---whether they escalate when obligated, abstain when required, and leave an auditable trail---and use it to study a question no prior benchmark addresses: does decomposing an agent into components degrade its governance? It does, and the mechanism is specific. Policy-relevant facts discovered by one component are attenuated at the handoff boundary before reaching the component that must act on them. In a 626-episode experiment across 100 KYC/AML task variants, two models, and three architectures, a 32B open-weights model attenuated 0% of discovered facts under a single-loop baseline, 56% under a fixed pipeline, and 85% under an orchestrator-subagent architecture (all at constraint distance 2). A stronger model (gpt-4.1-mini) attenuated 3-6% under the same conditions, suggesting the governance cost of decomposition is partly a function of model capability. Critically, the same mechanism produces both under-escalation and over-escalation, depending on whether the dropped fact was a risk signal or an exculpating one. The benchmark, all tasks, and the verification harness are open-source
Figures & tables
Task
Scenario
Dist.
Obligation
0001
Clean account opening
0
Negative: do NOT escalate
0002
Source-of-funds elicitation
1
Positive: request docs
0003
Fuzzy sanctions match
2
Positive: freeze + escalate
0004
Hidden UBO, chained facts
2
Positive: elicit → screen → escalate
0005
Resolvable PEP false positive
2
Negative: do NOT escalate
Table 1: Seed task scenarios.
Arm
Architecture
Boundaries
Context isolation
D0
Single ReAct loop
0
Full
D1
Pipeline: intake → research → decide
2
Each stage sees only the previous handoff
D2
Orchestrator + scoped subagents
2/round-trip
Strict + tool scoping
Table 2: Architecture arms.
Model
Type
Quantization
Episodes
Qwen2.5-32B-Instruct
32B dense
GPTQ-Int4, local vLLM
300
gpt-4.1-mini
Proprietary
API
296
Table 3: Models evaluated.
Model
D0
D1
D2
Qwen2.5-32B
0/16 (0%)
9/16 (56%)
22/26 (85%)
gpt-4.1-mini
0/27 (0%)
1/30 (3%)
1/18 (6%)
Table 4: Fact attenuation rate at constraint distance 2, conditional on discovery.
Figure 1: Fact attenuation rate (conditional on discovery) vs. constraint distance, per arm and model. D0 is structurally zero; both models show a monotone increase with decomposition depth, with gpt-4.1-mini attenuating far less at each level.
Task
Discovered
Attenuation
Outcome when attenuated
kyc-0004 (positive)
10/25
8/10 (80%)
UBO not screened → under-escalation
kyc-0005 (negative)
16/25
14/16 (88%)
Mismatch not carried → over-escalation
Table 5: Paired mirror tasks on Qwen2.5-32B D2 at distance 2.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Qwen2.5-32B
gpt-4.1-mini
Metric
D0
D1
D2
D0
D1
D2
Governed success
0
3
1
0
3
1
Truncated
37
39
52
49
54
50
Discovered (any)
16
18
27
27
34
25
Attenuation
0
9
22
0
1
1
Prop. loss
0
4
11
14
24
11
Appendix
Table 6: Full grid, P0, both models (n ≈ 100 per arm).