Dynamic Valuation Control (VCA) Engine · P&P

Priya Raman · Quant & DX Champion P
Policy & Procedure

Dynamic Valuation Control (VCA) Engine

Tech standards review Middle office Internal PP-VCA-IPV-V1
Version
v1
Owner
Sophie Laurent · Desk Head
Desk
Cross-Asset Solutions
Effective date
—
Review cycle
Annual
Graph
6 nodes · 6 edges
Generated
25 Oct 2026 · 22:34 UTC
1

Document control

This Policy & Procedure document is generated live from the governed definition of the application. Its authority derives from the platform record — the versioned DAG, the governance sign-offs and the append-only audit log — not from separate manual authoring.

Document ID
PP-VCA-IPV-V1
Application
Dynamic Valuation Control (VCA) Engine · vca-ipv
Version
v1
Status
Tech standards review
Category
Middle office
Owner
Sophie Laurent — Desk Head (Cross-Asset Solutions desk)
Classification
Internal
Effective date
—
Review cycle
Annual
Last submitted
25 May 2026
Generated
25 Oct 2026 · 22:34 UTC
2

Purpose & scope

Purpose

Compares trader marks to Bloomberg consensus and routes large variances to product control for an IPV adjustment.

It sits in the Middle office domain of the Markets OS App Studio and is delivered as a visually-built Directed Acyclic Graph of typed nodes, executed in a deterministic topological order under enforced governance.

In scope

  • The end-to-end automated workflow defined by the current app version and its nodes.
  • The controls embedded in that workflow (human approvals, risk monitors, validations).
  • The systems and datasets the workflow reads through the safe MCP broker.
  • The governance gates every version must clear before it can run in production.

Out of scope

  • This is a decision-support / automation workflow — it is not investment advice, and it does not itself constitute an order to trade.
  • In this proof-of-concept the external connectors (Murex, TLM, Bloomberg, Progmat, SAP, Oracle ERP) are simulated behind the broker; no live booking or settlement occurs.
  • Bespoke desk mandates, limits and suitability checks remain governed by their own policies.
Not investment advice. Outputs are automation and analytics for authorised internal users. Any resulting trade remains subject to the desk's own mandate, four-eyes approval and suitability controls.
3

Roles & responsibilities

The parties below carry the app through its lifecycle. HITL approver roles are read directly from the app's HUMAN_IN_LOOP node configuration, so this table reflects the controls actually wired into the workflow.

PartyResponsibility
Sophie Laurent (Owner)Accountable for the app: its correctness, its fitness for purpose and its release into production.
Platform Engineering / ChampionsBuild, test and maintain the DAG; remediate findings; publish new versions.
Risk officer (HITL approver)Provide the human approval at each HUMAN_IN_LOOP gate during a run.
Technology Standards reviewer, Business Risk reviewerClear the governance gates and cryptographically sign off each release.
Internal Audit & AssuranceIndependent oversight; reads the append-only audit log and sign-off ledger.
Head of Global MarketsUltimate business accountability for the app estate this document belongs to.

RACI matrix

ActivityResponsibleAccountableConsultedInformed
Build, test & maintain the appPlatform EngineeringSophie LaurentDesk usersAudit
Submit & release to productionSophie LaurentHead of Global MarketsTechnology Standards reviewer; Business Risk reviewerAudit
Operational approval during runs (HITL)Risk officerSophie LaurentBusiness RiskAudit
Technical & risk governance reviewTechnology Standards reviewer; Business Risk reviewerHead of Global MarketsComplianceAudit
Independent oversight & assuranceInternal AuditHead of Global Markets—Regulators

RACI — Responsible does the work · Accountable owns the outcome · Consulted gives input · Informed is kept in the loop.

4

Process overview & procedure

The procedure below is the exact sequence the execution engine runs, listed in the topological order the platform schedules (Kahn's algorithm — every step appears after the steps it depends on). Each step names the action, the system or dataset it touches, its inputs and outputs, and any control that fires at that point.

#ActionSystem / dataInputsOutputsControl
1Trader Marks (Data source)Dataset: tradesWorkflow triggerBloomberg Consensus—
2Bloomberg Consensus (MCP call)BLOOMBERG · getQuote (via MCP)Trader MarksVariance—
3Variance (Transform)Platform computeBloomberg ConsensusLarge Variance?—
4Large Variance? (Decision)Platform computeVarianceProduct Control, IPV AdjustmentConditional routing
5Product Control (Human in loop)Approver: RISK_OFFICERLarge Variance?IPV AdjustmentHuman approval — RISK_OFFICER (SLA 120m)
6IPV Adjustment (Output)Platform computeLarge Variance?, Product ControlFinal output—
5

Key controls

Controls prefixed C- are wired into this app's DAG; controls prefixed P- are platform controls that apply to every governed app. Evidence for each is recorded in the named table.

ControlDescriptionTypeOwnerFrequencyEvidence
C-01Product Control — Human approval by RISK_OFFICER within a 120-minute SLA. The run halts (PENDING_HITL) until the decision is recorded.PreventiveRISK_OFFICERPer runmos_execution_node_results
P-01Four-eyes on trades — the database enforces approver ≠ trader on every booking (CHECK constraint chk_trade_four_eyes).PreventivePlatformPer trademos_trades
P-02Governance release gates — DRAFT → TECH_STANDARDS_REVIEW → BUSINESS_RISK_REVIEW → APPROVED_FOR_PROD → PROD; no version runs in production un-gated.PreventiveGovernancePer releasemos_governance_reviews
P-03$50M / high-risk-counterparty auto-mandate — a size or counterparty breach in any node config forces a Level-3 Compliance review, recorded with its machine reason.Preventive / DetectiveGovernancePer submissionmos_governance_reviews.mandated_reason
P-04Cryptographic sign-offs — each gate is cleared by an HMAC signature over a hash of the exact graph, re-verified at promotion time.PreventiveGovernancePer releasemos_governance_signoffs
P-05Append-only audit log — every state change is written immutably; overrides require a ≥20-character justification (DB CHECK).DetectivePlatformContinuousmos_audit_log
P-06Safe MCP allow-list — the AI never touches a system directly; the broker allow-lists each operation, denies writes on read-only connectors, and audits every call.PreventivePlatformPer callmos_mcp_invocations
6

Key metrics & KPIs

The operational metrics below are computed live from the execution ledger. The workspace for this app presents the same figures as live KPI tiles and charts.

MetricDefinitionTargetCurrentSource
Run volumeTotal workflow executions recorded for this app.Steady-state utilisation once live0mos_execution_runs
STP rateRuns completing straight-through with no failure.≥ 95%n/amos_execution_runs
HITL interventionsRuns that halted awaiting a human decision.Minimise; resolve within SLA0mos_execution_runs · mos_execution_node_results
HITL SLATarget minutes to a human decision at each HUMAN_IN_LOOP gate.120m120mHUMAN_IN_LOOP node config
Execution failuresRuns that ended FAILED.00mos_execution_runs

Open the live workspace KPIs →

7

Systems & data lineage

Every external system this workflow interfaces is reached through the MCP broker — the only safe path to a connector. The broker allow-lists the operation, denies any write on a read-only connector, and audits the call. No node touches a live system directly.

System / sourceTypeInterfaceAccessNote
tradesInternal datasetDirect queryReadPlatform data (mos_trades and related tables).
BLOOMBERGConnector (MCP)getQuoteRead-only via brokerAllow-listed; every call audited to mos_mcp_invocations.
8

Risk & regulatory

Regulatory validations

This version references no explicit VALIDATION ruleset. Regulatory obligations remain governed by the desk's standing controls and the platform governance gates.

Governance status

Current version status
Tech standards review
Release control
Gated (DRAFT → PROD) with cryptographic sign-offs
Audit trail
Append-only mos_audit_log

Model risk

Any pricing, risk or NLP node embeds a model. In this proof-of-concept those computations are deterministic simulations; in production they fall under the bank's model-risk management framework (independent validation, periodic review and performance monitoring) before use.

9

Change history

Every version this app has carried, newest first. A new version is always a fresh DRAFT until it clears governance.

VersionStatusAuthorCreatedSubmittedApproved
v1 (current)Tech standards reviewSophie Laurent24 Apr 202625 May 2026—
10

Approvals & sign-offs

Not yet signed off. The current version carries no cryptographic sign-offs. It has not yet cleared governance, so it cannot run in production. Sign-offs appear here once reviewers approve it.
11

Glossary & references

Node types used in this app

TypeNameFamilyMeaning
DATA_SOURCEData sourceSourceReads a platform dataset (trades, positions, curves, reports …) into the flow.
MCP_CALLMCP callSourceCalls an external system through the safe, audited MCP broker.
DATA_TRANSFORMTransformTransformMaps, filters, aggregates, joins or enriches data in-flow.
DECISIONDecisionDecisionRoutes the flow along conditional branches.
HUMAN_IN_LOOPHuman in loopControlHalts the run and waits for a named human to approve.
OUTPUTOutputSinkThe terminal result of the workflow.

Connectors

ConnectorSystem
MUREXMurex MX.3 — trade capture, valuation & book risk
TLMSmartStream TLM — reconciliation, breaks & settlement instructions
BLOOMBERGBloomberg — market data, curves, FX rates & security static
PROGMATProgmat — tokenization ledger & on-chain settlement
SAPSAP Treasury — treasury & cash positions, journals
ORACLE_ERPOracle ERP — general-ledger & AP/AR balances

Platform terms

TermDefinition
DAGDirected Acyclic Graph — the shape every app takes; nodes run in topological order with no cycles.
HITLHuman-in-the-loop — a control node that halts a run for a human decision.
MCPThe broker layer through which the AI safely, and only in an allow-listed way, touches a system.
STPStraight-through processing — a run completing with no human intervention or failure.
Sign-offA cryptographic (HMAC) approval binding a named human to the exact graph they approved.
Governance gateA required review (Tech Standards / Business Risk / L3 Compliance) a version must clear.

Generated automatically by Markets OS from the governed app definition — this document reflects the live platform record at the time of generation.