John Feminella took the stage at AI Engineer to turn Citibank's $900 million Revlon blunder into a design spec for AI agents. I think his framing is the honest one for enterprises right now, because it treats safety as velocity, not friction, and it names the system that failed.
That system was Flexcube, Citibank's loan processing software, and the attacker requirement was not remote at all. Three internal approvers with local access overrode a warning on Aug. 11, 2020 that money was about to leave the bank, and Flexcube then sent about $900 million in principal to more than 300 lenders instead of the $8 million in interest Revlon owed, according to Feminella.
The timeline matters because the fix for finance came after the loss. Lenders kept the windfall, arguing a repayment is a repayment, and after August 2020 new commercial loan clauses tried to claw back that exact mistake, Feminella said. Before that clause, there was no contract language to reverse a full principal payout sent in error. What still has to happen for AI, in his telling, is the same institutional catch-up.
Feminella, who leads AI architecture and engineering at Two Sigma, argued that non-deterministic agents fail like non-deterministic humans and need boundaries, not cages. Sandboxing everything is safe but useless, letting agents run wild is powerful but ungovernable in a regulated firm, and policy docs in prompts are not enforceable at runtime, he said. The concession is fair: a harbor-kept ship is safe, to borrow his John Shedd quote, but founders will simply route around heavy gates into shadow IT if every notebook experiment waits two months for the same review as a production deployer.
His answer was five composable controls that keep cost low for teams. A firm-wide agent registry that auto-registers any agent built in approved frameworks and records owner, tools and endpoints. Risk scoring so a Jira summarizer does not queue with an agent that can touch production. Declarative guardrails that translate registry policy into enforceable endpoint and host allow lists at initialization. Shared evals, treated like unit tests for a runtime model dependency, and runtime classification that fast-paths explicit rules, denies clear dangers, and only pings a human for ambiguous actions, instead of drowning approvers until they click yes by reflex. He illustrated that fatigue with an anecdote of an OpenClaw agent that compacted context, lost the "wait for approval" instruction, and deleted hundreds of emails after being asked to suggest deletions.
The pattern is not Two Sigma-specific. Google Cloud's Gemini Enterprise Agent Platform now describes its Agent Registry the same way, as a centralized catalog for discovering, tracking, and managing all agents, tools, and MCP servers across the organization. The gap Feminella leaves open is declaration. His guardrails work when builders honestly list the four tools they need out of 500, but an open-ended coding agent that looks like Claude Code or Pi by design will stretch that list over time, and a compromised or misled agent will not volunteer its new intent. If you are a founder asking what to copy, copy the registry first, then make every new capability a policy change you can see.
