I opened the fourth episode of the cel_agents podcast with the question that tends to come up as soon as we automate the building and testing of financial products with AI: how far can agents go? To talk about security, control, and governance, I welcomed back Gabriel Zaninotti, AI Software Engineer at Celcoin, who had already shown in EP02 what happens on the other side of the prompt.
▶ Watch: https://www.youtube.com/watch?v=856aPbxSv94
Gabriel started from the context we operate in. In a financial environment that is highly regulated, critical, and handles large volumes of money, the agent cannot be in control of the funds. That is why it never sees the credentials, which are created inside Celcoin’s environment and only work in the sandbox. Even there, authentication is handled by the cel_agents platform. The agent learns to call the tools it needs to build, and it does all of that work without seeing a single credential.
That keeps the agent’s reach well defined. The customer’s agent can build the application, get credentialed, authenticate, and make test calls. What it cannot do is take an action on its own: even to run the tests, it needs an instruction from the user and goes through our pipeline.
The second layer is scopes. In the workspace, each person has a role, such as owner, admin, or developer. On the agent side, MCP authorization is also scoped, and access to credentials is among the most sensitive scopes. When I asked whether each journey gets its own MCP, the answer helped show the design: there is a single MCP, and the project is what sets the boundaries of the work. Gabriel used my own sandbox as the example. Inside it I create projects, and when the agent works on one of them, it knows which sandbox it is in, which project, and which products. That way it does not jump from one project to another or mix contexts.
I also made a point of mentioning one detail of the architecture. The code is written by the customer’s LLM, in Cursor or Codex, and Celcoin’s MCP gives it the context of our infrastructure. That is why it matters to know what gets recorded on our side. For Gabriel, traceability is one of the most important parts of any automated process, because the danger lies in ending up with a black box where nobody can see what is happening, and in a financial process that weighs even more. In cel_agents, the screens show what was done, and every MCP call is logged in language that even people without a technical background can read. Under the hood, we control which tools the LLM calls and which skills it uses.
I come away from this conversation with an idea that sits at the foundation of cel_agents. AI earns its place in financial infrastructure as it moves forward with clear controls, minimal permissions, and a trail that anyone on the team can follow. The last episode of the series looks at where this transformation can take us, and the earlier ones, with Rafael Zigart and with Gabriel, are all on the cel_agents page.