# Policy & Procedure — Intraday Liquidity & ALM Monitor

> PP-ALM-MONITOR-V1  ·  Middle office  ·  Classification: Internal
> Version v1  ·  Status: Prod  ·  Owner: Hiroshi Tanaka
> Generated 25 Oct 2026 · 23:41 UTC

## Contents

1. Document control
2. Purpose & scope
3. Roles & responsibilities
4. Process overview & procedure
5. Key controls
6. Key metrics & KPIs
7. Systems & data lineage
8. Risk & regulatory
9. Change history
10. Approvals & sign-offs
11. Glossary & references

## 1. Document control

This Policy & Procedure document is generated live from the governed definition of the application. Its authority derives from the platform record — the versioned DAG, the governance sign-offs and the append-only audit log — not from separate manual authoring.

- **Document ID:** PP-ALM-MONITOR-V1
- **Application:** Intraday Liquidity & ALM Monitor  ·  alm-monitor
- **Version:** v1
- **Status:** Prod
- **Category:** Middle office
- **Owner:** Hiroshi Tanaka — Desk Head (Asset & Liability Management desk)
- **Classification:** Internal
- **Effective date:** 08 Jul 2026
- **Review cycle:** Annual
- **Last submitted:** 26 Jun 2026
- **Generated:** 25 Oct 2026 · 23:41 UTC

## 2. Purpose & scope

### Purpose

Reads cash-clearing positions and the SAP treasury view, computes the funding gap and flags overdraft risk to treasury.

It sits in the Middle office domain of the Markets OS App Studio and is delivered as a visually-built Directed Acyclic Graph of typed nodes, executed in a deterministic topological order under enforced governance.

### In scope

- The end-to-end automated workflow defined by the current app version and its nodes.
- The controls embedded in that workflow (human approvals, risk monitors, validations).
- The systems and datasets the workflow reads through the safe MCP broker.
- The governance gates every version must clear before it can run in production.

### Out of scope

- This is a decision-support / automation workflow — it is not investment advice, and it does not itself constitute an order to trade.
- In this proof-of-concept the external connectors (Murex, TLM, Bloomberg, Progmat, SAP, Oracle ERP) are simulated behind the broker; no live booking or settlement occurs.
- Bespoke desk mandates, limits and suitability checks remain governed by their own policies.

> **Not investment advice:** Outputs are automation and analytics for authorised internal users. Any resulting trade remains subject to the desk's own mandate, four-eyes approval and suitability controls.

## 3. Roles & responsibilities

The parties below carry the app through its lifecycle. HITL approver roles are read directly from the app's HUMAN_IN_LOOP node configuration, so this table reflects the controls actually wired into the workflow.

| Party | Responsibility |
| --- | --- |
| Hiroshi Tanaka (Owner) | Accountable for the app: its correctness, its fitness for purpose and its release into production. |
| Platform Engineering / Champions | Build, test and maintain the DAG; remediate findings; publish new versions. |
| Desk risk officer (HITL approvers) | Provide the human approval at each HUMAN_IN_LOOP gate during a run. |
| Technology Standards reviewer, Business Risk reviewer | Clear the governance gates and cryptographically sign off each release. |
| Internal Audit & Assurance | Independent oversight; reads the append-only audit log and sign-off ledger. |
| Head of Global Markets | Ultimate business accountability for the app estate this document belongs to. |

### RACI matrix

| Activity | Responsible | Accountable | Consulted | Informed |
| --- | --- | --- | --- | --- |
| Build, test & maintain the app | Platform Engineering | Hiroshi Tanaka | Desk users | Audit |
| Submit & release to production | Hiroshi Tanaka | Head of Global Markets | Technology Standards reviewer; Business Risk reviewer | Audit |
| Operational approval during runs (HITL) | Desk risk officer | Hiroshi Tanaka | Business Risk | Audit |
| Technical & risk governance review | Technology Standards reviewer; Business Risk reviewer | Head of Global Markets | Compliance | Audit |
| Independent oversight & assurance | Internal Audit | Head of Global Markets | — | Regulators |

_RACI — Responsible does the work · Accountable owns the outcome · Consulted gives input · Informed is kept in the loop._

## 4. Process overview & procedure

The procedure below is the exact sequence the execution engine runs, listed in the topological order the platform schedules (Kahn's algorithm — every step appears after the steps it depends on). Each step names the action, the system or dataset it touches, its inputs and outputs, and any control that fires at that point.

| # | Action | System / data | Inputs | Outputs | Control |
| --- | --- | --- | --- | --- | --- |
| 1 | Cash Clearing  (Data source) | Dataset: positions | Workflow trigger | SAP Treasury Position | — |
| 2 | SAP Treasury Position  (MCP call) | SAP · getTreasuryPosition (via MCP) | Cash Clearing | Funding Requirement | — |
| 3 | Funding Requirement  (Risk calc) | Metric: PV01 | SAP Treasury Position | Overdraft Risk? | — |
| 4 | Overdraft Risk?  (Decision) | Platform compute | Funding Requirement | Liquidity Alert | Conditional routing |
| 5 | Liquidity Alert  (Output) | Platform compute | Overdraft Risk? | Final output | — |

## 5. Key controls

Controls prefixed C- are wired into this app's DAG; controls prefixed P- are platform controls that apply to every governed app. Evidence for each is recorded in the named table.

| Control | Description | Type | Owner | Frequency | Evidence |
| --- | --- | --- | --- | --- | --- |
| P-01 | Four-eyes on trades — the database enforces approver ≠ trader on every booking (CHECK constraint chk_trade_four_eyes). | Preventive | Platform | Per trade | mos_trades |
| P-02 | Governance release gates — DRAFT → TECH_STANDARDS_REVIEW → BUSINESS_RISK_REVIEW → APPROVED_FOR_PROD → PROD; no version runs in production un-gated. | Preventive | Governance | Per release | mos_governance_reviews |
| P-03 | $50M / high-risk-counterparty auto-mandate — a size or counterparty breach in any node config forces a Level-3 Compliance review, recorded with its machine reason. | Preventive / Detective | Governance | Per submission | mos_governance_reviews.mandated_reason |
| P-04 | Cryptographic sign-offs — each gate is cleared by an HMAC signature over a hash of the exact graph, re-verified at promotion time. | Preventive | Governance | Per release | mos_governance_signoffs |
| P-05 | Append-only audit log — every state change is written immutably; overrides require a ≥20-character justification (DB CHECK). | Detective | Platform | Continuous | mos_audit_log |
| P-06 | Safe MCP allow-list — the AI never touches a system directly; the broker allow-lists each operation, denies writes on read-only connectors, and audits every call. | Preventive | Platform | Per call | mos_mcp_invocations |

## 6. Key metrics & KPIs

The operational metrics below are computed live from the execution ledger. The workspace for this app presents the same figures as live KPI tiles and charts.

| Metric | Definition | Target | Current | Source |
| --- | --- | --- | --- | --- |
| Run volume | Total workflow executions recorded for this app. | Steady-state utilisation once live | 1 | mos_execution_runs |
| STP rate | Runs completing straight-through with no failure. | ≥ 95% | 100.0% | mos_execution_runs |
| HITL interventions | Runs that halted awaiting a human decision. | Minimise; resolve within SLA | 0 | mos_execution_runs · mos_execution_node_results |
| HITL SLA | Target minutes to a human decision at each HUMAN_IN_LOOP gate. | No HITL gate | No HITL gate | HUMAN_IN_LOOP node config |
| Execution failures | Runs that ended FAILED. | 0 | 0 | mos_execution_runs |

Open the live workspace KPIs →  (/apps/7/workspace)

## 7. Systems & data lineage

Every external system this workflow interfaces is reached through the MCP broker — the only safe path to a connector. The broker allow-lists the operation, denies any write on a read-only connector, and audits the call. No node touches a live system directly.

| System / source | Type | Interface | Access | Note |
| --- | --- | --- | --- | --- |
| positions | Internal dataset | Direct query | Read | Platform data (mos_positions and related tables). |
| SAP | Connector (MCP) | getTreasuryPosition | Read-only via broker | Allow-listed; every call audited to mos_mcp_invocations. |

## 8. Risk & regulatory

### Regulatory validations

This version references no explicit VALIDATION ruleset. Regulatory obligations remain governed by the desk's standing controls and the platform governance gates.

### Governance status

- **Current version status:** Prod
- **Release control:** Gated (DRAFT → PROD) with cryptographic sign-offs
- **Audit trail:** Append-only mos_audit_log

### Model risk

Any pricing, risk or NLP node embeds a model. In this proof-of-concept those computations are deterministic simulations; in production they fall under the bank's model-risk management framework (independent validation, periodic review and performance monitoring) before use.

## 9. Change history

Every version this app has carried, newest first. A new version is always a fresh DRAFT until it clears governance.

| Version | Status | Author | Created | Submitted | Approved |
| --- | --- | --- | --- | --- | --- |
| v1  (current) | Prod | Hiroshi Tanaka | 13 May 2026 | 26 Jun 2026 | 08 Jul 2026 |

## 10. Approvals & sign-offs

Each sign-off is an HMAC signature over a hash of the exact graph that was signed, appended to the immutable sign-off ledger. The Verified badge is re-derived here and now — the same check promotion runs — so any tampering with the ledger row or the graph shows as Invalid.

| Gate | Signer | Decision | Signature | Signed at | Hash |
| --- | --- | --- | --- | --- | --- |
| Tech standards | Raj Patel | Approved | Verified | 10 Jun 2026 · 02:57 | e7733e2f79bb93f004898cb4… |
| Business risk | Anja Kowalski | Approved | Verified | 22 Jun 2026 · 02:57 | 88d51e6e02a2a557a48884e6… |

## 11. Glossary & references

### Node types used in this app

| Type | Name | Family | Meaning |
| --- | --- | --- | --- |
| DATA_SOURCE | Data source | Source | Reads a platform dataset (trades, positions, curves, reports …) into the flow. |
| MCP_CALL | MCP call | Source | Calls an external system through the safe, audited MCP broker. |
| RISK_CALCULATION | Risk calc | Transform | Computes a risk metric (VaR, DV01, greeks, CS01 …). |
| DECISION | Decision | Decision | Routes the flow along conditional branches. |
| OUTPUT | Output | Sink | The terminal result of the workflow. |

### Connectors

| Connector | System |
| --- | --- |
| MUREX | Murex MX.3 — trade capture, valuation & book risk |
| TLM | SmartStream TLM — reconciliation, breaks & settlement instructions |
| BLOOMBERG | Bloomberg — market data, curves, FX rates & security static |
| PROGMAT | Progmat — tokenization ledger & on-chain settlement |
| SAP | SAP Treasury — treasury & cash positions, journals |
| ORACLE_ERP | Oracle ERP — general-ledger & AP/AR balances |

### Platform terms

| Term | Definition |
| --- | --- |
| DAG | Directed Acyclic Graph — the shape every app takes; nodes run in topological order with no cycles. |
| HITL | Human-in-the-loop — a control node that halts a run for a human decision. |
| MCP | The broker layer through which the AI safely, and only in an allow-listed way, touches a system. |
| STP | Straight-through processing — a run completing with no human intervention or failure. |
| Sign-off | A cryptographic (HMAC) approval binding a named human to the exact graph they approved. |
| Governance gate | A required review (Tech Standards / Business Risk / L3 Compliance) a version must clear. |

---

_Generated automatically by Markets OS from the governed app definition. This document reflects the live platform record at the time of generation._