A retirement advisor that answers “when can I access my pension?” across four national systems — for a third of a cent. The model plans the question and writes the answer. It never does the maths. Every tax calculation runs as a governed Unity Catalog function, because a hallucinated withdrawal limit is not a wrong answer, it is a regulatory event.
Claude Opus 4.1 interprets the question, selects tools and writes the response. Eighteen Unity Catalog functions execute the tax codes. The boundary between them is the entire design.
Claude Sonnet 4 judges every answer for accuracy and regulatory adherence before a member sees it — and MLflow records what it cost, what it cited, and how long each phase took.
Language models are excellent at understanding a pension question and dangerous at answering one. The architecture is built around that distinction.
A member turns 58 and wants to know when she can access her pension. It is a simple question with an answer that depends on her balance, her contribution history, her retirement age under the relevant national scheme, and the tax treatment of each withdrawal option available to her.
Today that question goes to a helpline. She waits, gets a callback scheduled days out, and eventually reaches an advisor who reads from a brochure that does not account for her situation. A simple question takes a week. Six months later, if a dispute arises, there is no record of what she was told.
At fifty thousand members and ten to twelve dollars per call interaction, the routine questions alone run past six million dollars a year — and advisors charging a hundred and fifty an hour spend their time on queries a calculator could answer.
The intelligence layer runs on Claude Opus 4.1 behind the Databricks Agent Framework. It reads the member’s question, works out what is actually being asked, decides which calculations the answer requires and which member data to retrieve, then synthesises the result into something a person can act on.
What it does not do is arithmetic. Every tax calculation, withdrawal limit and benefit projection executes as a Unity Catalog function — code, versioned and governed, implementing the actual regulatory logic. Eighteen of them, country by country.
This is the load-bearing decision. A model that remembers roughly what the concessional contribution cap was is useless in a regulated advisory setting. Put the rule in a function and the number is either right or it is a bug someone can find. The model orchestrates; the code computes.
Planning and language on one side of the line, regulated arithmetic on the other.
“A hallucinated withdrawal limit is not a wrong answer. It is a regulatory event.”
Member names are anonymised before anything reaches the LLM and restored afterwards for the personalised response. The model reasons about a case; it does not need to know whose case it is. The personalisation the member experiences is reassembled on the way out, after the reasoning is done.
Each geography carries its own functions implementing that country’s actual regulatory logic — not a generic calculator with a currency symbol swapped.
In regulated advice, generating the answer is half the job. Being able to show that it was checked, cited and recorded is the other half.
Every response passes through an independent validation step before delivery. Claude Sonnet 4 reads the generated answer against the retrieved data and the regulatory context, checking accuracy and adherence rather than fluency. It is a different model from the one that wrote the answer, which is the point — a model reviewing its own reasoning tends to agree with itself.
Validation runs in one of three modes: LLM judge, deterministic rule checks, or a hybrid of both. The choice is a configuration decision, so a fund with a stricter compliance posture can dial toward deterministic checking without a rebuild.
The agentic pipeline is not a single call. It is eight phases, and each is instrumented individually for duration and cost, which is what makes a slow or expensive query diagnosable rather than mysterious.
Cost is tracked per query and broken down between the main model and the judge, in real time. Not an estimate at the end of the month — a number attached to the individual answer, which is what makes the running cost of a two-model architecture defensible to whoever signs for it.
A three-thousand-fold cost difference does not just save money — it changes which questions are worth answering. At ten dollars a call, a fund discourages members from asking. At a third of a cent, a member can ask six follow-up questions at two in the morning and the economics do not care. That is a different service, not a cheaper one.
MLflow captures traces across the whole pipeline; Unity Catalog governs the functions, the member profile tables and the citation registry. Regulatory references are attached to responses automatically rather than added by an advisor who remembers to.
The dispute six months later — the one that had no record under the old model — now has the question, the data retrieved, the functions called, the rules cited, the validation verdict and the cost. That is the difference between advice you gave and advice you can prove you gave.
The platform and model surface behind the advisor.
Nothing here is specific to pensions. Any regulated advisory domain has the same shape: a question that needs understanding, a calculation that must not be improvised, a regulator who will ask what rule you applied, and a cost per interaction that determines how freely customers are allowed to ask. Wealth management, insurance comparison, loan eligibility and investment research all fit the pattern without changing the architecture — only the functions in the tool layer.