Keeping Strands agents honest in a household money app
Many household money leaks are small and quiet. A washing machine breaks a few months before its guarantee runs out, and the repair gets paid without anyone asking the seller. A free trial turns into a monthly charge. A card payment has no receipt by the time someone needs one. None of this is hard to spot. It is just easy to miss. An agent sounds like a good fit: read the records, point at what…
Household money leaks can be small and subtle, such as a washing machine repair after its warranty expires or a free trial turning into a recurring charge. These issues can be easily overlooked. Agents could help identify such problems by reviewing records and pointing out what requires a decision. However, language models interpreting financial data may make unwarranted assumptions. Hestia, a model created for the AWS Agents for Humans hackathon, aims to address this issue in a limited way.
Two Strands agents employ Claude Haiku 4.5 on Amazon Bedrock through the EU inference profile and are embedded within the same Lambda function. Neither agent has write permissions, as they focus solely on reading data. The review agent reads a household through four tools and produces a brief summary. The reading agent, which lacks tools, converts pasted text into suggested records.
Both agents operate within a stored replica of a fictional household with a 30-minute access period. The review agent and its four read-only tools work in tandem. The review agent builds a fresh agent instance with a BedrockModel, the tools, and a system prompt, executing it once and requesting every tool to be used once. The tools are straightforward Python closures over the loaded private copy and the review date.
Each tool, such as audit_subscriptions() and check_receipts_and_utilities(), is wrapped as a Strands tool, with schemas derived from the tools' signatures and documentation.
The model reading process is identical to what a reviewer would read. The tools close over one private copy, preventing any tool from accessing data from other households. Tool outputs are limited to 1600 characters. After the run, the trace is reconstructed by pairing toolUse and toolResult blocks in agent.messages, and token usage is determined from result.metrics.accumulated_usage. Both are saved with the briefing.
A system prompt guides the agents' behavior. They are instructed to utilize the tools, refrain from implying entitlement to refunds, repairs, or amounts, avoid inventing deadlines, rely only on tool outputs for amounts and dates, and limit the briefing to 180 words across three sections: what was checked, decisions awaiting the household, and the suggested next step.
The guard reviews the generated text to ensure compliance with these guidelines. If the text contains banned patterns, such as entitlement language or invented deadlines, the briefing is withheld. The guard also checks for euro amounts not present in the tool outputs and ensures the text does not exceed 3200 characters.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
