a little more possibility
No server behind it. One customer's first few months: their phone on the left, and on the right every agent their tap woke up. None of it is real. No money, no rails, nobody's data.
Any decent model can tell whether a payment looks sound. The questions that decide whether a bank may run this come after: who approved it, what did it know, would it decide the same today.
An agent never writes to the bank, it asks. A checkpoint runs ten gates over the request: is this really you, are you allowed, do your numbers hold up when worked out again. The record is written before the money moves, and the first no ends it.
VMware Cloud Foundation with Private AI Foundation. Agents and models run as pods; the ledger and the evidence chain stay on virtual machines. The agents have no route to the money. Every record names the machine that produced it.
Every component between the phone and the ledger, on one drawing: the zones, the boundary between each pair of them, and the product that enforces it. This is the whole bank, not the part one journey happened to touch.