AURAM Field-Tests AI Agent Operations on Banking APIs / Clarifying AI and Human Roles in Work That Moves Money

We measured the MCP server that GMO Aozora Net Bank provides in its sandbox environment across 15 test cases, and are publishing the design principles for control that never lets AI decide whether an operation may be executed.

AURAM Inc. (head office: Chuo-ku, Tokyo; Representative Director: Kazuhiro Fukuda; "AURAM") is a startup whose core is a "movable-asset digital ledger" that records the ownership and the collateral status of real-world assets on a blockchain without moving the physical asset, so that third parties can verify them independently. On that foundation, AURAM is building an on-chain financial platform that automates the entire financial process, from the sale and purchase of an asset through collateralization to the settlement of payment, with AI agents and smart contracts. We have now applied the MCP server that GMO Aozora Net Bank, Ltd. released in July 2026 for operating banking APIs from AI agents (in its "sunabar" sandbox environment) to the practical settlement scenarios of our platform. We verified it, reported the results to the bank, and received answers to 13 items of inquiry.

In June 2026 AURAM demonstrated and published the transfer of ownership that accompanies the sale of a real-world asset, and in July on-chain lending collateralized by that ownership, together with "Oracle Guardian Agent," an autonomous AI agent that protects collateral value. This third release addresses the remaining layer: settlement. There is a single question. When an AI agent is entrusted with operations that move money, what should be protected, and at which layer? The verification system used here, including its decision gate, was designed and implemented by our Representative Director Fukuda himself, as an "AI solopreneur" who drives development single-handedly with full use of AI. We registered four agents with natural-language policies, implemented a deterministic decision gate on our own ledger side as well, compared the judgments of the two across 15 test cases, and derived design principles for "what can be left to an AI agent, and what requires human judgment."

Highlights

Background

The era in which AI agents operate bank accounts has already begun

Since the start of 2026, the groundwork for operating the APIs provided by financial institutions from AI agents has been laid rapidly. In May 2026, GMO Aozora Net Bank, Ltd. announced its policy for building an "Agentic API," and in July of the same year it released, in its "sunabar" sandbox environment, an MCP server that lets AI agents execute balance inquiries, retrieval of deposit and withdrawal statements, transfers and other operations from natural-language instructions.

MCP (Model Context Protocol) is an open standard published by Anthropic in 2024 for connecting AI models to external tools and data. When the APIs of a financial institution support this standard, it means that an AI agent can become an actor that moves money.

At the same time, when operations that move money are entrusted to an AI agent, a question arises: who decides what may be executed, and at which layer?

For AURAM, this question is the business design itself

The on-chain financial platform AURAM is building is designed to incorporate AI into every process, from asset registration through trading, collateralization and settlement. In addition to the monitoring of collateral value we have already published ("Oracle Guardian Agent," which autonomously detects anomalies in price data and halts operations), we are widening the scope to the automatic reading of engravings at the time of asset registration, and to the automation of settlement operations covered by this verification. In a financial infrastructure where the transfer of assets, the enforcement of security interests and the settlement of funds all run under program control, a mistake in designing "how much to leave to AI, and where human judgment begins" leads directly to incorrect movements of money or incorrect transfers of rights. We therefore applied the released MCP server to our own practical scenarios and confirmed by measurement where control resides.

Overview of the Verification

Environment	The MCP server in the "sunabar" sandbox environment of GMO Aozora Net Bank (released July 17, 2026)
Subject	Settlement operations on our platform: the flow in which a customer purchases a real-world asset (a gold bar), receipt of the payment is confirmed, and the transfer of ownership is recorded
Configuration	Four agents were registered, each with a natural-language policy (up to 150 characters). A deterministic decision gate holding the state of orders, inventory and transfers was also implemented on the AURAM side, and the judgments of the two were compared
Scale	15 test cases (conducted in one day); the MCP server provides 22 tools in total

The verification results were sent to the bank as a report, and we received answers to 13 items of inquiry.

* All measurements below were made in the sunabar environment and do not confirm the behavior of the production environment. The usage agreement for the sunabar environment is in the name of HANDS ON Inc., which our Representative Director Kazuhiro Fukuda also represents, and this verification was carried out by AURAM with that company's cooperation.

What the Measurements Confirmed

1. The bank's natural-language policy works with high accuracy

For constraints set per agent in natural language of up to 150 characters (an upper limit on the amount, a restriction on the type of operation, and dates and times), we confirmed that each clause was evaluated individually, and that the grounds were recorded even for clauses that were not violated. The following is an actual judgment for a transfer exceeding the upper limit.

2. Judgments that require business context can only be assured on the operator's side

In each of the cases below, the funds arrived normally, in a valid format, in a valid account, and nothing appears abnormal from the bank's point of view. Yet AURAM's decision gate stopped them.

Case	Bank side	AURAM gate
Payment of an amount different from the order amount	No anomaly	Stopped
Payment made under a name different from the orderer	No anomaly	Stopped
Duplicate payment against the same order	No anomaly	Stopped
No inventory available for allocation	No anomaly	Stopped
Settlement covering amounts whose transfer is not complete	No anomaly	Stopped

These are not stopped on the bank's side because of any shortcoming in the accuracy of the policy. It is because the information needed for the judgment (the state of orders, inventory and transfers) does not exist on the bank's side in the first place. The boundary can be summarized as follows: constraints that can be judged from the content of the request alone (amount, type of operation, date and time) are evaluated on the bank's side, while constraints whose judgment requires business context are not.

3. An AI's own declaration is not a basis for finality

The "reason for execution" that an AI agent passes to a banking API is a self-declaration by the caller, and is reference information that is not verified on the bank's side. We confirmed this both by measurement and by checking with the bank. Likewise, execution procedures written in natural language in a tool description are not enforced as arguments. This is not a property specific to any particular bank: a tool description exists to convey context and usage to an AI model, and is not designed as a mechanism for access control. Accordingly, when AI output is used for auditing, it has to be reconciled against the operator's own independent records.

4. The acceptance of a request and the finality of funds are asynchronous

A transfer through a banking API is not established at the moment the AI agent executes the request via the API. It becomes final only after transaction authentication (approval) by the account holder, a human. Under this structure it is easy to make mistakes such as treating the response to the request as final, treating a human's declaration that "I approved it" as final, or inferring expiry from the passage of time. The design principle we derived from this verification is that the AI agent side has to be implemented so that it goes and checks for itself whether a request has become final. On this point, our inquiry to the bank also brought concrete answers: preventing duplicate execution with an idempotency key, and confirming finality with a result-inquiry API.

The Division of Roles AURAM Proposes: What to Leave to AI, What Humans Decide

These are the design principles for the division of roles when an AI agent is entrusted with work that moves money, as derived from this verification.

Layer	Responsibility	Examples
Leave to the AI agent	Investigation, reconciliation, explanation, drafting	Retrieving deposit and withdrawal statements and reconciling them with order information, detecting anomalies and explaining the situation, presenting proposed responses
Leave to deterministic rules	Judging whether an operation may be executed	Permitting execution only when the conditions on payment amount, account name, duplicate payment, inventory and settlement status are all satisfied. Neither an AI's declaration nor a human's verbal instruction may override it
Keep with humans	Approval of fund payouts, design of the rules, auditing	Final approval of operations that send money out, such as settlements and refunds; changes to the decision rules themselves; after-the-fact verification through append-only logs

The essential point is not to let the AI agent decide whether an operation may be executed. The AI presents its judgment together with an explanation of why it reached that conclusion; a deterministic gate that holds the business context judges whether execution is permitted; and a human approves the payout of funds. The bank's policy works effectively as a declaration of intent, and combining it with the operator's gate in two layers produces control that does not depend on either one alone.

AURAM applies this design policy consistently. In "Oracle Guardian Agent," the AI agent published in July 2026 that autonomously detects anomalies in gold-price data and halts operations, judgment and explanation are likewise delegated to AI (Claude, a large language model from Anthropic), while the enforcement of a halt is handled by deterministic rules. The agents used in this verification are also implemented with Claude.

Next Steps

AURAM will apply the two-layer control design principle confirmed in this verification to the full implementation of settlement functions that link the confirmation of incoming purchase payments with the recording of ownership transfers. Beyond that, our goal is to bring to transactions in real-world assets a mechanism that establishes the transfer of an asset and the settlement of funds simultaneously in a single procedure (DVP). We welcome collaboration with financial institutions interested in programmable means of payment, such as tokenized deposits and stablecoins.

We will also advance discussions on where responsibility lies and how control should be designed when work is delegated to AI agents, in forums such as the AI subcommittee of the Japan Blockchain Association, and we welcome the exchange of views with financial institutions and businesses working on similar challenges.

About the AURAM Platform

"AURAM" is a "movable-asset digital ledger" platform that records and manages the ownership of real-world assets such as gold bars as transfer-restricted NFTs (a proprietary implementation referencing ERC-721). By implementing Article 184 of the Japanese Civil Code ("transfer of possession by instruction") on-chain, we have built a mechanism that securely transfers only the ownership of a gold bar stored in a vault, without physically moving it (patent pending).

Representative Profile

Kazuhiro Fukuda, Representative Director　Profile page

After conducting research on multi-agent AI at Tohoku University's Graduate School of Information Sciences, he worked at Toshiba Corporation and Sony Corporation before founding his own ventures. He is a serial entrepreneur who has sold three businesses he founded through M&A.

Alongside managing businesses, as a private investor in real estate, equities and angel investments, as well as physical assets including gold bars, he experienced firsthand the many pain points of real-asset ownership: poor liquidity, opaque provenance, and the difficulty of using assets as collateral. Convinced that "these unsolved problems can absolutely be fixed with technology and business," he founded AURAM Inc. in 2026.

About AURAM Inc.

Corporate philosophy: "Creating trust. Toward a world where idle real assets can be put to work, without letting them go."

The solid value of real assets such as gold tends to lie dormant in a vault, the price paid for keeping it safe. Without moving the physical asset out of the vault, AURAM records its ownership and collateral status on a tamper-proof movable-asset digital ledger, rigorously protecting the holder's privacy while enabling authorized third parties, such as financial institutions, to verify authenticity whenever needed. Trust, once established, stays with the asset, and idle real assets become assets that can be traded with confidence and pledged as collateral without ever being let go. For companies, this provides a hedge against inflation and currency fluctuations together with liquidity; for individuals, steady asset building.

Company name	AURAM Inc.
Address	Nihonbashi Royal Plaza 706, 17-1 Nihonbashi-Kabutocho, Chuo-ku, Tokyo 103-0026, Japan
Representative	Kazuhiro Fukuda, Representative Director
Established	February 25, 2026
Capital	JPY 5,000,000
Business	Operation of a real-asset trading platform; blockchain-based recording of ownership and collateral of movable assets (movable-asset digital ledger); operation of asset-management media
URL	https://www.auram.co.jp/en/

Full Press Release

Contact

For questions about this release or to discuss partnerships and collaboration, please feel free to reach us via the contact form.