The complete boundary view of the Autonomous Finance system — C4 Level 1 context showing one system box and all external actors, followed by C4 Level 2 containers revealing agents, managed platform services, and inter-container communication.
The C4 Level 1 diagram answers a single question: what does the Autonomous Finance system do, and who does it talk to? The system boundary is opaque. The agents, the Event Bus, the HITL manager — none of these appear here. They are container-level concerns documented in C4 L2 below.
Four human actors sit outside the boundary: CFO, Group Controller, Treasury Manager, and AP Lead. Eight external software systems surround the boundary. Every arrow carries a relationship description and integration protocol. Vertex AI and Cloud Pub/Sub are GCP-managed platform dependencies — they appear as external software systems at L1 because the system does not own or deploy them, it consumes them via API.
The BTP Integration Suite is shown as a distinct relay node between the system and SAP S/4HANA — it is not a direct RFC connection from GCP to on-premise.
C4 Level 2 opens the system box and shows the major containers — deployable/runnable units. Agents are containers. Cloud Pub/Sub and Vertex AI are GCP-managed platform dependencies — not internal components the system owns. They appear inside the system's GCP project boundary but with a distinct visual treatment indicating they are managed services.
Cloud Pub/Sub is a GCP-managed service. Agents publish to it; they do not own it. Topic names follow a structured namespace — domain.entity.event-type — reflecting the enriched, structured nature of the payloads (not raw SAP dumps). The HITL State Manager subscribes to finance.action.proposed and routes to human review or autonomous execution based on the risk classification schema.
| Action Type | Risk Tier | Trigger Condition | Disposition | EU AI Act Basis |
|---|---|---|---|---|
| GL journal post — IC settlement | High · HITL Required | Amount > €50k OR cross-jurisdiction OR new counterparty entity | Group Controller approval queue · 4h SLA | Annex III §5(b) — AI influencing financial decisions for legal persons |
| GL journal post — IC settlement | Low · Autonomous | Amount ≤ €50k AND same-jurisdiction AND known entity AND confidence ≥ 0.92 | Direct SAP write via BTP · logged to Audit Trail | Annex III §5(b) — below materiality threshold, explainability logged |
| FX hedge recommendation | High · HITL Required | Notional > €500k OR tenor > 90 days OR model confidence < 0.80 | Treasury Manager approval queue · 2h SLA | Annex III §5(b) — material financial risk to legal entity |
| AP payment release routing | High · HITL Required | New supplier (first 3 invoices) OR disputed PO OR invoice > €100k | AP Lead review queue · 8h SLA | Annex III §5(b) — payment instruction with financial consequence |
| AP exception classification | Low · Autonomous | Known supplier · matched PO · amount within 2% tolerance · confidence ≥ 0.90 | Auto-route to resolution queue · no SAP write · logged | Classification only — no financial action, exempted |
| Model inference (all agents) | Logged · No Gate | Every inference call | SHAP attribution + confidence logged to Audit Trail · no human gate on inference itself | Art. 13 Transparency — model output explainability requirement |
Open Banking (PSD2) and ISO 20022 are distinct protocols with different transport formats, authentication mechanisms, and data semantics — they are listed separately. SLA targets and availability tiers are specified for each integration. GCP-managed services (Vertex AI, Cloud Pub/Sub) are listed with their VPC-SC and regional endpoint configuration requirements.
| System | Deployment | Protocol | Data In | Data Out | Latency | SLA / Availability |
|---|---|---|---|---|---|---|
| SAP BTP Integration Suite | SAP Cloud (relay) | REST/OData → RFC translation | IC delta events, GL entries, entity master data | Approved journal posts forwarded to S/4HANA via RFC | Near Real-Time | 99.9% · SAP SLA |
| SAP S/4HANA | On-premise | RFC (via BTP relay) | GL/IC entries, open item lists, entity master | Journal posts, IC settlement confirmations, TP doc writes | Near Real-Time | Customer-managed · ≥99.5% |
| Banking APIs ×4 (PSD2) | Cloud SaaS (banks) | PSD2 Open Banking · REST/JSON · OAuth 2.0 | Real-time account balances, retail transaction feeds, account metadata | None — read-only | Real-Time | 99.5% · PSD2 mandated |
| Banking APIs ×4 (SWIFT) | SWIFT Network | ISO 20022 XML · SWIFT gpi · MX messages | Intraday liquidity position, cross-border payment confirmations, MT→MX migrated messages | None — read-only (payment initiation out of scope L1) | 15-30 min batch | 99.9% · SWIFT SLA |
| FX Rate Feeds (ECB + BoC) | Public API | REST pull (scheduled) · JSON/XML | EUR/CHF/CAD spot rates, forward curves, historical series | None — read-only | 15-min Poll | Public · no SLA · retry logic req'd |
| Supplier Invoice Ingestion | Hybrid (email + EDI) | Email IMAP · EDIFACT D.96A · Document AI API | Structured invoice fields: supplier, PO ref, line items, amounts, currency, due date, exception flags | None — intake only; AP posting via SAP | Async / Event-driven | Best-effort · dead-letter queue |
| Vertex AI Prediction (GCP) | GCP europe-west3 (managed) | gRPC · regional private endpoint · VPC-SC enforced | Feature vectors: IC mismatch signals, cash position vectors, invoice exception embeddings | Inference scores, confidence intervals, SHAP attribution values | Real-Time <200ms | 99.95% · GCP SLA · VPC-private |
| Cloud Pub/Sub (GCP) | GCP europe-west3 (managed) | Pub/Sub API · push + pull · VPC-SC enforced | Agent action proposals, HITL decisions, audit events, feature deltas | Routed messages to subscribers (HITL, Audit Trail, Feature Store Adapter) | Real-Time | 99.95% · GCP SLA |
| AE Data Governance (M-08) | AE Platform (GCP) | Feature Store API · synchronous gate | Feature definitions, lineage metadata for validation | Validated feature versions approved for Feature Store write; DQ score | Pre-batch gate | 99.9% · AE Platform SLA |
| AE GreenOps (M-06) | AE Platform (GCP) | Scheduler API · carbon-aware (Grid Carbon API) | Retraining job manifests, carbon intensity signals | Carbon-optimised batch schedule; green execution windows; Scope 3 emissions tags per run | Batch / Scheduled | Best-effort · carbon-aware |
| AE Strategy Dashboard (M-07) | AE Platform (GCP) | Pub/Sub push · ae.kpi.finance.updated topic | None — write-only | KPI feed: close duration (days), cash forecast accuracy (%), AP exception rate, IC mismatch count, hedge P&L attribution | Near Real-Time | 99.9% · AE Platform SLA |
Compliance constraints are expressed architecturally — not as policy overlays. Each framework maps to a specific structural decision. CSRD is cited at the correct category level for a manufacturing group (not Category 15, which applies to financial institutions' financed emissions). GDPR is cited at the correct articles with accurate scope. PIPEDA compliance is expressed through jurisdiction-aware routing visible in the architecture.
jurisdiction: CA envelope tag. The routing layer applies CA-specific retention (7 years per CRA requirements), access controls aligned to PIPEDA's accountability principle, and ensures the Bank of Canada FX feed data path is tagged as a CA-jurisdiction data flow. This is visible in the Pub/Sub event envelope — not enforced only at the policy layer.