AI operating model · production, since late 2024

Agents produce.
I built the harness that governs.

Most designers use AI. For two years I have run it as the default first step on every regulated-fintech problem — but the differentiator was never the prompting. I built the layer that governs the output: a human-gated agent harness, and a design system served as a machine-consumable server. The operating principle is one line — agents produce, the harness governs.

2024→now
Production
AI use
9
Agents in the
operating model
14
Ed Agent
MCP tools
65
eds-mcp component
contracts
~60–80%
Token cost cut
on-prem
The shift

From using AI to governing it.

"The model produces. The harness governs. Deterministic checks run first at near-zero token cost — the model is only escalated to when a problem can't be reduced to a rule."

Anyone can open a chat window. The hard part in regulated finance is trust: knowing when the model is right, when it is confidently wrong, and where a human must never be removed.

So I stopped treating AI as an accelerator and built the governance around it. Every claim gets grounded. Every run is auditable. Anything the harness can't prove gets escalated to a human — it is report-only by default, so verdicts are byte-stable and nothing is silently "fixed".

That is DesignOps cost governance, not ML infrastructure — velocity, not autonomy.

What I actually built

Two production systems, both open source.

Not slideware. Two zero-dependency systems I designed, built, and use daily — one governs the agents, one makes the design system something an agent can read.

Ed Agent · v0.6.1 · open source

Ed Agent

The governance harness. A human-gated agent lifecycle that decides what the model is allowed to conclude — and stops it where it shouldn't be confident.

  • 9-stage human-gated lifecycle with two checkpoints — FRAME captures intent, TRUST assesses trust before anything ships
  • Red-team / blue-team adversarial pass on every conclusion
  • Grounding tri-state — every claim marked Grounded, Ungrounded, or Contradicted
  • Inner loop — severity gate, overshoot-rollback, iron-law hard-halt, budget fuse, flywheel learning
  • Control-room dashboard — 127.0.0.1-only, zero external requests, reads one human-readable memory file
  • 14 MCP tools, zero dependencies; report-only by default so it never fake-fixes
See it run live → GitHub
eds-mcp · v1.17.0 · open source

eds-mcp

The design system, made machine-consumable. My component library served as an MCP server, so an agent can scaffold, lint and compliance-check against it directly.

  • 65 component contracts across 14 domains — trading, payments, KYC / AML, compliance and more
  • Pure core engine drives an MCP server with 29 tools + a zero-dep HTTP REST API (OpenAPI 3.1)
  • scaffold_component · lint_usage · compliance_check · audit_accessibility · compose_flow
  • One requirement → a 6-stage lifecycle of real, verifiable artifacts
  • Logic lives in the pure core; server and HTTP are thin adapters that never drift
  • The same design system a human reads — now something an agent can too
Orchestration Studio → Consumer system → GitHub
How a problem moves through it

The governance loop, step by step.

Tap any stage. The model never touches a conclusion until it has survived the checks — and any stage can halt the run and route it to a human.

The line that never moves

What the model does — and what only a human does.

In regulated finance, the dangerous failure is not a slow model — it is a confident one. The harness exists to draw this line and hold it.

Delegated · governed by the harness

The model produces

  • Structured problem decomposition and multi-pathway solution generation
  • Regulatory clause mapping and ROI scoring across dimensions
  • Event-pattern identification across datasets too large to audit by hand
  • Code review, tech-debt audit, and first-pass component scaffolds via eds-mcp
  • Long-document synthesis — 100K-token regulatory PDFs reduced to the operative clauses
Never delegated · human override

Only a human decides

  • Post-cutoff regulatory changes — anything newer than the model's training
  • Specific financial figures — verified independently, never taken from output
  • Client relationship & institutional-political context
  • Competitive IP calls — e.g. rejecting an AGPL-licensed dependency
  • The final brand and aesthetic call

The harness's one job: stop the model being confident where it shouldn't be.

The dividend

One designer. Seven product lines.

Governance is what makes the velocity safe. With the load-bearing analysis governed and auditable, the output of one designer stops looking like one designer's.

7
Product lines
Trading, payments, KYC, institutional API, consumer — shipped from one operating model.
~60–80%
Token cost cut
Models served & fine-tuned on-prem (not pre-trained) — DesignOps cost governance.
9
Agents, one model
Ed Agent orchestrates nine specialised agents against one governance contract.
8
Regulatory updates absorbed
Across 40+ jurisdictions, 100K+ traders — zero structural rebuilds.
The proof · live, in a browser

Don't take the claim. Open the exhibits.

Every system on this page has a live surface you can inspect — no install, no signup.

Governance · live port

Ed Agent — the harness, in the browser

The real assessor, loop and iron-laws ported to run live in-page — multi-tab console, severity gauge, and the control-room dashboard.

Run it eds-mcp · orchestration

Design system as a server

The Orchestration Studio — 65 component contracts, generated from the real engine, verified against it, one requirement to six stages.

Explore Capstone · all of it, converged

TradeX Institutional Terminal

A functional institutional trading simulation — live charts, FIX 4.4 engine, Design Mode tracing 19 decisions to their signal source, and a Human↔Agent API toggle.

Open terminal AI trust · human-in-the-loop

Nova — the AI-trust co-pilot

Where model output requires human judgment by design — confidence intervals, a draggable handoff threshold, and a compliance heat-meter.

See the study Live data · agents reading signals

Macro Signal — live market data

Agents surfacing patterns across datasets too large to audit manually, rendered as a designed decision surface rather than a raw feed.

See it live Case study · the decisions

TradeX — the annotated build

16 annotated design decisions, FIX provenance, and the decision register that shows the reasoning behind every fork.

Read it Curated · not my build

The library I learn from

The open-source tools, Claude Skills and creators I study and borrow workflow from — a shared reference, kept distinct from the systems above, which I actually built.

Browse the library
github / Ed-Agent github / eds-mcp github / ReactOmega github / GalaxyJS
The argument

I'm not the genius. That's the point.

The institutional products that ship from here won't be built by the smartest person in the room. They'll be built by the person who can define the problem precisely, govern the agents that produce, and keep a human on every decision that carries regulatory or financial weight.

Since late 2024 I haven't run a significant problem without the model — not as a shortcut, but as a protocol. The advantage compounded not because I prompted well, but because I built the layer that decides what the model is allowed to conclude. Grounded or not. Halt or continue. Ship or escalate.

That last distinction is the whole game in regulated finance. Agent-to-agent systems are already in production, and the interfaces being designed now — how those systems present and consume data — will shape institutional finance for the next decade. The designer who has been shipping with both cognitive architectures since 2024, and who built the governance to make it safe, is not a nice-to-have in that transition.

The failure mode I watch for is the model confident on what it shouldn't be — a post-cutoff rule, a specific figure, a client's politics. So the harness grounds every claim, halts on iron-law violations, and routes the unresolved to a human. It never fake-fixes. It processes faster so domain knowledge has more precise inputs to work with — it does not replace the judgment.

A company with Ed Chen has an operating model for what's coming.

Nearly five years in institutional finance. 100K+ traders on live systems, 40+ jurisdictions, eight regulatory updates absorbed without structural rework — every recent decision made with AI governed, grounded and auditable. I'd like to show you what this looks like applied to your product.

Start a conversation → For recruiters & hiring teams Ed Agent case study About Ed
Portfolio threads

Where this case study sits in the larger web

The operating model is the spine that runs under the rest of the portfolio — the same evidence discipline, applied to how the work itself gets made.

Thread

Agents, Trust & Human-in-the-Loop

Where AI output requires human judgment by design — and how that handoff is made compliant.

  • The Operating Model — this page The governance harness and the human boundary that never moves Methodology · Ed Agent v0.6.1 · report-only default
  • Nova — AI-Trust Co-Pilot Confidence intervals + a draggable human-handoff threshold Case study · n=40 mixed-methods · SR 11-7 escalation
  • Ed Agent — Case Study The real assessor, loop and iron-laws ported to run live Case study · byte-identical to the Node modules
Thread

Design Systems as Infrastructure

A design system is not a Figma file — it is a contract that both humans and machines can consume.

  • The Operating Model — eds-mcp Design system served as an MCP server — 65 contracts, 29 tools Methodology · OpenAPI 3.1 · compliance + a11y checks
  • Design System Showcase 245 categories, dual-theme, a decision register per component Marketing surface · tokens-first · regulatory anchors
  • ACY Securities 150-component system absorbing 8 regulatory rewrites, no rebuild Case study · 100K+ traders · 40+ jurisdictions