Teamday
← Back

Nori Agentic Cut Hour-Long Sec Master Checks to 5 Minutes

AI Engineer
agentsenterpriseautomationknowledge-workbusiness

How Nori Agentic Put Cloud Agents on a Security Master Database

Amol Kapoor is CEO of Nori Agentic, a New York company that builds cloud agents; he spent about 12 years as an AI engineer, four and a half of them at Google. His co-founder and CTO Clifford Ressel worked in back-office finance, and he opens the AI Engineer talk by explaining the security master: the master database of every instrument an asset manager holds, and the source of truth for risk, P&L accounting and regulatory reporting. For public stocks the problem is solved by shared identifiers from vendors and numbering agencies. For private assets, a loan to a power plant developer or land next to a hydro plant, there are no shared identifiers and no vendor API. "The asset is captured and defined entirely by the documentation." The data lives in PDFs in a Box folder, Outlook emails and Zoom transcripts, and the data scales one-to-one with the assets.

The customer's problem: Nori works with a Fortune 200 asset manager in New York that recently started holding many private assets. Its data engineers ran a day-over-day diff of a table with about 50,000 assets and 200 columns each, and every changed cell went to a triage team to check against documents and data sources. "Every single one of those changes in that investment universe would have, on average, an hour of work behind it." Price changes, renamed assets, bankruptcies, ownership changes and renegotiated contracts added up to hundreds or thousands of hours a month.

The cloud agent loop: Kapoor defines a cloud agent as a coding agent like Claude Code that runs in a remote environment instead of a laptop, so it can be audited, observed and triggered on a schedule without a person involved. When a cell changes, a Nori agent spins up, running a locally deployed open-source model so the data stays on-prem. It has instructions to find the source of the change, and tools for Box PDFs, public APIs such as Bloomberg and a small slice of email. It assembles an explanation with citations, recommends keeping or discarding the change, and pings the cell's owner in Slack for a yes or no. "You can take something that used to take an hour and make it just five minutes of human work."

No custom agent needed: Kapoor pushes back on the idea that this requires bespoke infrastructure. "Agents get information the same way a new analyst does, from written instructions about where documents live, which sources to trust, and how to judge a change, all in English." Nori uses generic agents (Claude Code, OpenCode or open-source agents like Pi) and skins them with skills and agent markdown files; most of the customization is the configs and credentials dropped on the machine. The sec master agent should run on the same cloud agent infrastructure as the audit agent or the code review agent, with different instructions, tools and triggers owned by the company and the orchestration, security and integrations owned by a vendor.

Proactive, not reactive: "The future of enterprise AI is not use a robot on your laptop to solve a problem. It's having the robots come to you with tasks, advice, analysis, and recommendations." Kapoor calls the sec master agents "cleaner fish automatons" on the database, and argues the same primitive applies across a firm.

5 Lessons from Nori Agentic's Finance Deployment

  • Diff the data, not the documents - A day-over-day diff of the sec master turns an unbounded reading job into a list of changed cells, each a bounded case for an agent to assemble.
  • Agents assemble the case, humans decide - Most of the hour was searching documents, which agents do well and humans do badly. The human keeps the five-minute decision and accountability.
  • Aim for 95% automation - "It's really important to aim for 95% automation, and it's okay to keep a human in the loop." Kapoor says 100% end-to-end doesn't work in software factories and works even less in finance.
  • Configure with English, not code - Markdown instructions on where documents live, which sources to trust and how to judge a change replace custom agent code. Open-source models on-prem handle the data residency concern.
  • Adoption is a collaboration problem - People buy solutions and engineers sell building blocks. Nori's successes came from domain experts who made the leap from "cloud agents" to a problem they had that day.

What the Agentic Sec Master Means for Back-Office Teams

Kapoor's closing point is Fred Brooks' accidental complexity: much back-office work exists because teams and vendors record the same data in different formats, and agents are good at exactly that low-complexity, high-effort work. The pattern is event-triggered cloud agents configured with agent skills and a human in the loop only for the final decision. It matches how Wise approves the job, not every step and how Arca keeps humans on anything that moves money.