Autonomous LLM Agents as Dynamic Decision Nodes in Temporal Sagas

Modern core banking platforms are increasingly adopting generative AI and Large Language Model (LLM) agents to handle complex operational reasoning—such as assessing unstructured trade finance documents, triaging complex fraud cases, and resolving cross-border exception processing. However, introducing autonomous AI agents into core banking workflows presents a fundamental architectural contradiction: Temporal Sagas demand absolute determinism, whereas LLM reasoning is inherently non-deterministic.

Temporal workflows achieve fault tolerance through event-sourced execution replay. If a workflow definition behaves non-deterministically during history replay, execution drifts, state corruption occurs, and replay validation fails. Conversely, LLMs generate probabilistic outcomes influenced by temperature settings, floating-point variance across hardware inference clusters, and model version shifts.

Under the Xenon Architecture Standards, core banking platforms resolve this tension by encapsulating autonomous LLM agents inside isolated Temporal Activities bounded by strict JSON schema contracts, formal validation guardrails, and deterministic fallback paths. This paper evaluates the operational boundaries, dynamic task planning topologies, mathematical reliability models, and compensation patterns required to deploy autonomous LLM agents as dynamic decision nodes in distributed core banking Sagas.

💡 Explore the Xenon Architecture Standard For comprehensive architectural blueprints, BIAN service domain mappings, and dual-orchestration integration patterns, visit the official Xenon Architecture Guide. To inspect reference code, infrastructure templates, and open-source banking modules, explore the VecPay-Tech GitHub Organization.

Not all decision nodes within a Banking Industry Architecture Network (BIAN) ecosystem require LLM autonomy. Integrating AI agents into deterministic Sagas must be strictly categorized by domain risk and exception frequency.

To prevent non-deterministic LLM behavior from corrupting Temporal's execution history, LLM agent reasoning must never execute directly within a Temporal Workflow Definition. Instead, the workflow definition maintains absolute determinism, while the LLM execution logic is fully encapsulated inside a Temporal Activity.

THE DETERMINISM ISOLATION ARCHITECTURE +---------------------------------------------------------------------------------+ | TEMPORAL WORKFLOW ENGINE (100% Deterministic Event History Execution) | | | | [Start Workflow] ---> [Execute Activity: RunAgentActivity] ---> [Branch Logic] | +-----------------------------------|---------------------------------^-----------+ | | 1. Invoke Activity Payload 4. Return Deterministic (Structured Context) Structured JSON Output | | +-----------------------------------|---------------------------------|-----------+ | TEMPORAL ACTIVITY WORKER LAYER v | | | (Non-Deterministic Sandbox) | | | | | | +---------------------------------------------------------------+ | | | | LLM AGENT REASONING LOOP | | | | | | | | | | [Construct Prompt] ---> [LLM Inference Engine (OpenAI/Ollama)]| | | | | │ | | | | | ▼ | | | | | [JSON Guardrail Validation] ◄── [Tool Call / Re-Act Loop] | | | | +----------------------------------│----------------------------+ | | | | | | | 2.

Return Output Schema | | | (Passed or Rejected) | | +-------------------------------------│-------------------------------+-----------+ v +---------------------------------------------------------------------------------+ | IMMUTABLE EVENT STORE & STATE AUDIT | | [ Persists Prompt Hash, Token Cost, Confidence Score, and Decision Payload ] | +---------------------------------------------------------------------------------+ Enter fullscreen mode Exit fullscreen mode Key Architectural Rules Replay Immutability: Temporal records the activity output payload (the LLM's final structured JSON decision) into the workflow's Event History. During workflow replay, Temporal does not re-invoke the LLM activity; it simply reads the recorded decision payload from history. Deterministic Branching: The workflow evaluates the structured decision payload using standard deterministic logic ( if/else or switch statements) to dispatch downstream machine Sagas or human tasks.

Idempotency & Retry Safety: LLM activities must implement strict idempotency keys (derived from WorkflowID + RunID + ActivityTaskID ) to prevent duplicate inference costs or repeated side effects during network retries. Mathematical Model: Agent Decision Reliability & Guardrail Probability The reliability of an LLM agent operating as a dynamic decision node within a distributed financial Saga depends on schema adherence, hallucination rates, and downstream transaction commitment.

The probability of a successful autonomous decision node commit P node-success P_{\text{node-success}} P node-success ​ across an agentic execution path is defined as:

If the agent's confidence score falls below a pre-configured threshold θ confidence \theta_{\text{confidence}} θ confidence ​, or if P schema-valid = 0 P_{\text{schema-valid}} = 0 P schema-valid ​ = 0 after maximum retries, the system triggers a Deterministic Fallback Override, shifting control to a standard rule engine or human user task.

package com.xenon.banking.ai.model; import com.fasterxml.jackson.annotation.JsonProperty; import java.util.List; public record TradeExceptionDecision ( @JsonProperty ( required = true ) String decisionOutcome, // "APPROVE_EXEMPTION", "REJECT_EXEMPTION", "ESCALATE_HUMAN" @JsonProperty ( required = true ) double confidenceScore, // 0.0 to 1.0 @JsonProperty ( required = true ) String reasoningSummary, @JsonProperty ( required = true ) List < String > verifiedClauseIdentifiers, @JsonProperty ( required = true ) String recommendedCompensatingAction ) {} Enter fullscreen mode Exit fullscreen mode 2. Temporal Activity Encapsulating the LLM Reasoning Loop This Java activity executes an agentic reasoning loop using structured function calling. If the LLM generates invalid JSON or fails validation constraints, the activity retries locally up to a bounded threshold before returning an explicit failure state.

package com.xenon.banking.ai.activity; import com.fasterxml.jackson.databind.ObjectMapper; import com.xenon.banking.ai.model.TradeExceptionDecision; import io.temporal.activity.Activity; import io.temporal.activity.ActivityExecutionContext; import org.springframework.stereotype.Component; import java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; import java.util.Map; @Component ( "tradeAgentActivity" ) public class TradeAgentActivityImpl implements TradeAgentActivity { private final HttpClient httpClient = HttpClient. newHttpClient (); private final ObjectMapper objectMapper = new ObjectMapper (); @Override public TradeExceptionDecision evaluateTradeException ( String documentText, String exceptionCode, double transactionAmount ) { ActivityExecutionContext ctx = Activity. getExecutionContext (); String workflowId = ctx. getInfo (). getWorkflowId (); System. out. println ( "Executing Agentic Decision Node for Workflow: " + workflowId ); // Construct System & User Prompt for Structured Function Calling String promptPayload = buildPromptJson ( documentText, exceptionCode, transactionAmount ); int attempts = 0; int maxRetries = 3; while ( attempts < maxRetries ) { attempts ++; try { // Call LLM Inference Endpoint (OpenAI / Internal Enterprise Model API) HttpRequest request = HttpRequest. newBuilder (). uri ( URI. create ( "https://ai-gateway.internal.xenon/v1/chat/completions" )). header ( "Content-Type", "application/json" ). header ( "Authorization", "Bearer " + System. getenv ( "AI_GATEWAY_KEY" )). POST ( HttpRequest. BodyPublishers. ofString ( promptPayload )). build (); HttpResponse < String > response = httpClient. send ( request, HttpResponse.

BodyHandlers. ofString ()); // Parse Structured Output Response String rawJsonResponse = extractStructuredJsonFromResponse ( response. body ()); TradeExceptionDecision decision = objectMapper. readValue ( rawJsonResponse, TradeExceptionDecision. class ); // Validation Guardrail: Enforce minimum confidence threshold if ( decision. confidenceScore () < 0.85 ) { System. out. println ( "Agent confidence score (" + decision. confidenceScore () + ") below threshold. Escalating." ); return new TradeExceptionDecision ( "ESCALATE_HUMAN", decision. confidenceScore (), "Low confidence score in automated evaluation.", decision. verifiedClauseIdentifiers (), "NONE" ); } return decision; // Successfully evaluated and validated } catch ( Exception e ) { System. err. println ( "Attempt " + attempts + " failed to parse LLM structured decision: " + e. getMessage ()); if ( attempts >= maxRetries ) { // Fail-safe default returned to Workflow return new TradeExceptionDecision ( "ESCALATE_HUMAN", 0.0, "LLM execution failed structural validation after retries.", List. of (), "NONE" ); } } } return new TradeExceptionDecision ( "ESCALATE_HUMAN", 0.0, "Execution exhausted retries.", List. of (), "NONE" ); } private String buildPromptJson ( String documentText, String exceptionCode, double amount ) { // Formats prompt enforcing JSON Schema output constraints return """ { "model": "xenon-financial-agent-v2", "messages": [ {"role": "system", "content": "You are a specialized risk evaluation agent. You must output JSON conforming strictly to the TradeExceptionDecision schema."}, {"role": "user", "content": "Evaluate document: %s under exception code: %s for amount: %.2f"} ], "response_format": {"type": "json_object"}, "temperature": 0.0 } """. formatted ( escapeJson ( documentText ), exceptionCode, amount ); } private String extractStructuredJsonFromResponse ( String responseBody ) throws Exception { var node = objectMapper. readTree ( responseBody ); return node. path ( "choices" ). get ( 0 ). path ( "message" ). path ( "content" ). asText (); } private String escapeJson ( String input ) { return input. replace ( "\"", "\\\"" ). replace ( "\n", " " ); } } Enter fullscreen mode Exit fullscreen mode 3.

Temporal Workflow Definition (Deterministic Branching) The workflow invokes the agent activity. Depending on the agent's structured decision, it deterministically dispatches an automated downstream machine Saga or suspends for human review.

package com.xenon.banking.ai.workflow; import com.xenon.banking.ai.activity.TradeAgentActivity; import com.xenon.banking.ai.model.TradeExceptionDecision; import io.temporal.activity.ActivityOptions; import io.temporal.workflow.Workflow; import io.temporal.workflow.WorkflowInterface; import io.temporal.workflow.WorkflowMethod; import java.time.Duration; @WorkflowInterface public interface TradeResolutionWorkflow { @WorkflowMethod void processTradeException ( String tradeId, String documentText, String exceptionCode, double amount ); } public class TradeResolutionWorkflowImpl implements TradeResolutionWorkflow { private final TradeAgentActivity agentActivity = Workflow. newActivityStub ( TradeAgentActivity. class, ActivityOptions. newBuilder (). setStartToCloseTimeout ( Duration. ofSeconds ( 30 )). setRetryOptions ( io. temporal. common. RetryOptions. newBuilder (). setMaximumAttempts ( 3 ). build ()). build () ); @Override public void processTradeException ( String tradeId, String documentText, String exceptionCode, double amount ) { // 1. Invoke Isolated LLM Agent Activity (Non-deterministic code runs safely inside activity) TradeExceptionDecision agentDecision = agentActivity. evaluateTradeException ( documentText, exceptionCode, amount ); // 2.

Deterministic Workflow Execution Path based on Activity Event History switch ( agentDecision. decisionOutcome ()) { case "APPROVE_EXEMPTION" -> { // Trigger automated machine Saga step (e.g., Ledger Release) Workflow. getLogger ( TradeResolutionWorkflowImpl. class ). info ( "Agent approved exception. Executing release Saga." ); executeAutomatedReleaseSaga ( tradeId, amount ); } case "REJECT_EXEMPTION" -> { // Trigger automated cancellation & compensation Saga Workflow. getLogger ( TradeResolutionWorkflowImpl. class ). info ( "Agent rejected exception. Executing compensation Saga." ); executeCompensatingCancellationSaga ( tradeId ); } case "ESCALATE_HUMAN" -> { // Halt workflow deterministically and await Human-in-the-Loop Signal Workflow. getLogger ( TradeResolutionWorkflowImpl. class ). warn ( "Agent requested human escalation.

Awaiting signal." ); awaitHumanReviewSignal ( tradeId, agentDecision. reasoningSummary ()); } default -> throw new IllegalStateException ( "Unexpected agent decision outcome: " + agentDecision. decisionOutcome ()); } } private void executeAutomatedReleaseSaga ( String tradeId, double amount ) { // Standard deterministic machine Activity calls } private void executeCompensatingCancellationSaga ( String tradeId ) { // Standard deterministic compensating Activity calls } private void awaitHumanReviewSignal ( String tradeId, String reasoning ) { // Suspend workflow execution until human approval signal arrives } } Enter fullscreen mode Exit fullscreen mode Transactional Consistency and Saga Compensation Scenarios When an autonomous LLM agent decides to approve an operational exception, it triggers forward transactions (e.g., balance holds or ledger postings). If a downstream microservice fails after an LLM agent decision has been rendered, the Temporal orchestrator automatically executes standard Compensating Actions.

AGENT DECISION SAGA COMPENSATION FLOW +-----------------------+ 1. Approve Exception +-----------------------+ | LLM Agent Activity | ---------------------------------> | Temporal Saga Manager | | (Evaluates Document) | | (Workflow History) | +-----------------------+ +-----------+-----------+ | 2. Execute Step 1 (Ledger Debit) | v +-----------------------+ 3.

Step 2 Fails (API Timeout) +-----------------------+ | Downstream Services | <----------------------------------| Executing Machine | | (Ledger / Risk Engine)| ---------------------------------> | Activities | +-----------------------+ 4. Trigger Compensation +-----------+-----------+ | 5. Execute Rollback Activity | (Revert Ledger Debit) v +-----------------------+ | Audit Log & Escalate | | to Human Desk | +-----------------------+ Enter fullscreen mode Exit fullscreen mode Compensation Safety Rules Non-Reversible Actions: An LLM agent must never execute uncompensable real-world actions (such as dispatching an external Fedwire SWIFT MT103 message) directly from within its reasoning loop.

Two-Stage Authorization: The agent activity may only modify internal staging state or emit execution intents. The actual final settlement step must be gated by a secondary deterministic activity or a human approval check if the transaction value exceeds strict monetary limits. Observability, Prompt Lineage, and Auditability Financial regulators (such as OCC, EBA, and MAS) require complete lineage for AI-assisted operational decisions.

Storing only the final decision payload is insufficient; the system must retain full cryptographic lineage of the agent's context.

For every LLM decision node invocation, the activity writes an immutable audit record to the centralized log storage layer, linked to the Temporal WorkflowID and RunID:

{ "auditId": "AUDIT-2026-902183", "temporalWorkflowId": "TradeResolution-TR-9902", "temporalRunId": "b182f4e8-421d-405a-a309-88f2b7190012", "bianDomain": "TradePositioning", "llmProvider": "Azure-OpenAI-Internal", "modelDeployment": "gpt-4o-financial-v2", "promptHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "inputTokenCount": 1420, "outputTokenCount": 185, "rawOutput": "{ \" decisionOutcome \": \" APPROVE_EXEMPTION \", \" confidenceScore \":0.94, \" reasoningSummary \": \" Clause 4b matches standard ICC UCP 600 rules. \", \" verifiedClauseIdentifiers \":[ \" CLAUSE-4B \" ], \" recommendedCompensatingAction \": \" NONE \" }", "confidenceScore": 0.94, "schemaValidationPassed": true, "executionTimestamp": "2026-09-16T11:56:28Z" } Enter fullscreen mode Exit fullscreen mode Integrating autonomous LLM agents into Temporal Sagas bridges the gap between flexible AI-driven reasoning and rigid financial reliability. By strict application of the Determinism Isolation Pattern —confining non-deterministic LLM execution inside structured Temporal Activities while keeping the orchestration workflow fully deterministic—core banking platforms achieve intelligent operational automation without sacrificing transactional integrity, fault tolerance, or regulatory auditability across BIAN service domains.