Heurist Finance Buys Data for Every Question

Summary

• An AI agent that pays for paid data one item at a time for each question was built on a managed cloud service.
• Engineering work fell by about 80 percent compared with building it in-house, and a single query can now produce an audit trail.
• When you give an agent spending authority, per-request budget control and strict identity isolation must come with it.

An agent that buys paid data and analyzes it for every question

Imagine the moment an investor asks, “How does today’s U.S. personal consumption expenditures price index release affect my portfolio?” To answer this well, it is not enough to summarize macroeconomic news. You have to work out, all together, the price figure just released, the consensus forecast, the stocks the user actually holds and their weights, and their risk tolerance and investment horizon.

The problem is that this kind of advanced data sits mostly behind expensive paid subscription walls and mismatched APIs. There is no single data vendor in the market that provides everything at once. And in an early stage, when the user base is not yet large enough, signing separate enterprise contracts with many data vendors is hard to justify economically.

Heurist, which runs Heurist Finance, a financial intelligence service for individual investors, took an unusual approach to this problem. Instead of signing bulk contracts with data vendors, it made its AI agent buy only the paid data it truly needs, one item at a time, as it processes each question.

This approach makes economic sense, but it poses a big challenge on the development side. The AI agent has to spend money on the user’s behalf and transact with outside parties. The concrete architecture and operating results of this case were revealed in a post that Heurist founder JW Wang and the AWS staff members Joshua Smith and Chethan Shriyan published together on the AWS Machine Learning Blog.

Heurist Finance gathers market data collection, reading of filings and news, deep research, portfolio construction and stress testing, and monitoring of held positions into a single chat. Every answer is generated to reflect the user’s portfolio and investment preferences. The goal of the service is to let anyone with a market question use institutional-style tools, such as a combined risk and return view, full portfolio construction, and scenario analysis.

The barriers when you put a wallet in an agent’s hands

To make an agent buy paid data for every question, it is not enough to attach an external API call tool to a language model. When you hold and spend funds, requirements for custody, spending limits, and a clear audit trail must be met. Otherwise, if the system is hit by a prompt injection attack or the model malfunctions, funds could drain away in an instant.

Specifically, five infrastructure requirements had to be solved to run the agent reliably in production.

The first was per-request identity. Every data lookup and payment action the agent performs has to be tied tightly to a specific user, a specific session, and a specific request ID. If identity does not hold across the whole workflow, you cannot prove who spent money for what purpose.

The second was keeping state across sessions. An investor’s risk tolerance, watched stocks, earlier conversation context, and the state of their investment thesis must be preserved even if the chat window is closed and opened again. If the service asked about investment style from scratch every time, it could not deliver real personalization.

The third was an isolated code execution environment. After buying paid data, computing the impact on a portfolio means running complex code for correlation analysis, scenario analysis, chart generation, and backtesting. A fully isolated sandbox is needed so that code the model generates cannot break into internal systems or outside networks.

The fourth was payment orchestration. Within the question-handling flow, the request for paid data, the quote check, limit verification, electronic signing, and settlement had to connect smoothly with no breaks.

The fifth was traceability from start to finish. For a single question, it must be possible to stitch the whole process into one audit record: what data was bought and at what price, and with what code it was computed to produce the final answer.

Building this infrastructure from scratch on its own could have taken months of engineering time. That would have taken away development capacity from Heurist’s real strengths: building deep financial research workflows and improving its personalized analysis algorithms.

An agent architecture woven from managed infrastructure

Instead of building this base infrastructure from the ground up itself, Heurist adopted Amazon Bedrock AgentCore. It used Strands as the orchestrator that coordinates the flow of the whole request, and it chose Anthropic Claude, running on Amazon Bedrock, as the language model that serves as the central brain.

The parts that make up the whole system each have a clear role and fit together. The user’s portfolio data is stored in an Amazon Aurora PostgreSQL database. AgentCore payments handles buying and paying for paid data in real time, and settlement is processed in USDC, a stablecoin pegged to the U.S. dollar, on the Base blockchain network.

Elements for security and state management were also put in place. AgentCore Identity passes the authenticated user’s information to every service call and issues credentials with a limited scope. AgentCore Memory stores the user’s investment preferences and conversation history across sessions, and AgentCore Code Interpreter runs analysis code safely inside an isolated virtual environment. Charts created from the analysis are stored in Amazon S3, and the trace of the whole request flow is sent to Amazon CloudWatch. The sensitive credentials needed to sign with the blockchain wallet are kept safely in AWS Secrets Manager, and the safety of model inputs and outputs is controlled by Amazon Bedrock Guardrails.

The per-question data payment flow through the x402 protocol

In Heurist Finance, a single user question needs a mix of real-time stock prices, macro indicators, company filing reports, financial data, and news. Of these, the paid data is bought through the x402 protocol in a set order of five steps.

First, the Heurist Finance system sends a request for the information it needs to the data merchant’s paid data feed endpoint.

Second, the merchant does not handle the request right away. It replies with the x402 payment terms and an HTTP 402 status code. HTTP 402 is the web standard status code meaning “Payment Required.” The payment terms the merchant sends back state the amount charged, the payee who will receive the money, USDC as the asset used for payment, and Base as the settlement network.

Third, AgentCore payments compares the merchant’s payment terms with the spending cap maxSpendAmount set in that run’s Payment Session. The Payment Manager coordinates the CoinbaseCDP Payment Connector, and for each interaction with a user, one new Payment Session and one new Payment Instrument are created. Here the Payment Instrument is an embedded crypto wallet bound only to the Base network. If the amount the merchant asks for exceeds the set cap, the system stops the payment at once, tells the user the budget was exceeded, and suggests alternatives.

Fourth, if the amount charged fits within the set budget, the system calls the Process Payment API. At this point it uses the Payment Instrument to sign the blockchain transaction. The secret credentials needed for payment are not hard-coded in the system. They are taken safely from AWS Secrets Manager at run time.

Fifth, Heurist Finance puts the proof of the transaction signature in the X-PAYMENT request header and sends the request to the data merchant again. Only after verifying the payment proof does the merchant deliver the paid data that was requested.

In the real production environment, answering one question probably required buying several paid feeds one after another. So the orchestrator likely planned the list of data it needed before sending the first data request, and made payments while deducting the actual amount from the session’s remaining budget each time a merchant replied with HTTP 402. With the x402 approach like this, you can buy only as much data as you need at the moment you need it, without prior enterprise contracts or large prepaid balances. This payment flow was implemented with AgentCore payments, Payment Manager, Payment Connector, and an SDK integration.

Security devices behind personalization and isolated analysis

Once the paid data arrives, AgentCore Code Interpreter starts right away. Code Interpreter runs in an isolated sandbox where any outbound network traffic (egress) is fully blocked. That is why analysis code the model generates can finish correlation analysis, scenario analysis, charting, and backtesting safely. This compute environment runs inside the AWS cloud and is cleaned up as soon as the analysis job ends.

At the same time, the service delivers thorough personalization. Even when a user asks a broad question such as “Is this stock overvalued right now?”, the service does its research based on that user’s existing holdings, watched stocks, investment horizon, and risk preference. It does not start from zero each time a question comes in. It looks for answers on top of accumulated investment context, so the analysis becomes more refined as the profile builds up.

For this, AgentCore Memory stores the user’s preferences, the state of their investment thesis, and their conversation history across sessions. And AgentCore Identity strictly limits access to this storage to that one user. Thanks to this, Heurist did not need to build a separate user preference database or a complex access control layer.

In the real implementation, the roles of Aurora and AgentCore Memory were probably clearly separated. Quantitative asset data that must be exact to the last unit, such as the number of shares held or the average purchase price, was likely stored in Aurora. Qualitative context, such as the investment thesis for why a stock is held or the user’s preferences, was likely stored in Memory. A user’s profile and conversation history reveal a person’s investment beliefs, risk tolerance, investment horizon, and held positions in full, so Heurist designed identity, access control, and auditing as the basic premise of every request.

Inside the system, four unique identifiers follow every action. Whenever a tool call, a payment, or a memory lookup happens, the user ID, the workload identity, the request ID, and the trace ID are recorded together to build a single audit record. The boundaries between services are firm, too. Identity receives OAuth authentication and issues credentials with a limited scope of permission, and payments isolates the Payment Session and the wallet per user. The payment secret key stays only in Secrets Manager, and the Payment Credential Provider takes it out only at run time and hands it to the Payment Connector.

The last line of defense is Amazon Bedrock Guardrails. The input filter blocks in advance malicious prompt injection attacks aimed at the payment tool or the data lookup tool. And the output filter enforces Heurist’s strict internal financial policy of not casually recommending an unhedged single stock.

How a single question is actually handled

In the real service, how the system moves when the question “How does today’s PCE release impact my portfolio?” comes in shows well how all these devices combine.

First, the orchestrator reads the user’s portfolio information from the Aurora database. At this point AgentCore Identity steps in and limits the scope so that only that user’s data is queried.

Second, the orchestrator calls the paid consensus forecast endpoint of a macroeconomic data merchant. When the merchant returns an HTTP 402 code, AgentCore payments checks the spending cap for this interaction and signs the payment with the Payment Instrument dedicated to the Base network. When signing is done, it sends the request again with the proof in the X-PAYMENT header and receives the latest consensus data.

Third, based on the newly received consensus forecast and the portfolio data from Aurora, AgentCore Code Interpreter computes the impact inside the isolated sandbox. The chart produced by the calculation is saved as a file in Amazon S3.

Fourth, the model on Amazon Bedrock writes the final answer text, taking into account the user’s holdings, investment horizon, and risk preference. It is delivered to the user’s screen by real-time streaming together with the chart created in S3.

Aurora, Identity, payments, Code Interpreter, S3, Bedrock, and Observability are all involved in this whole flow. Because the user and trace context are kept from start to finish, the payment record for buying the paid data and the portfolio analysis written with that data connect perfectly under a single trace ID.

Services used at each step of a PCE question

Less development effort and operational results

By adopting this cloud-managed infrastructure, Heurist gained considerable engineering efficiency. By Heurist’s estimate, the engineering workload of building the agent system fell by about 80% compared with developing its own LLM orchestration stack. This is because AgentCore took over identity management, memory across sessions, the isolated sandbox, and the complex blockchain payment setup.

Heurist founder JW Wang said the following about this.

“AgentCore does the platform work so we can double down our energy on the product work. The managed infrastructure saved us months.”

At the same time, because the marginal cost per user became predictable, a base was also laid for setting reasonable pricing aimed at ordinary individual investors.

Two big operational benefits were also confirmed. The first is a higher level of readiness for compliance and shorter time to resolve problems. Thanks to AgentCore Observability traces, you can fully reproduce what decision path the agent took to give a certain piece of advice. A compliance question is answered with one query. Operators would likely have gathered the data purchase, the code execution, and the model output into one timeline in CloudWatch, keyed on the trace ID. The second is the safety of user assets and credentials. The crypto credentials used for payment are not exposed across the system. They stay isolated in AWS Secrets Manager and are taken out only at run time, so the safety of end users went up.

Heurist plans to extend its product features in three directions: event-based research tied to listed companies’ earnings announcement dates, a feature that automatically analyzes major market events from each individual portfolio’s point of view, and a research recommendation feature based on what traders with similar investment horizons have been mostly researching recently.

Suggestions for companies preparing for agent payments

The Heurist Finance case shows an important principle for companies that want to hand an AI agent real authority over money transactions with outside systems, beyond simple text generation.

Giving an agent the authority to spend money does not mean granting unconditional autonomy. On the contrary, a controlled environment must come first: one that physically enforces, at the architecture level, a budget limit (maxSpendAmount) for each single request, and that hands the agent only payment instruments isolated per session. A defense mechanism is essential that stops the payment when the limit is exceeded, tells the user, and suggests alternatives.

It also shows the possibility of turning the cost structure of buying data from a fixed cost into a variable cost. In the past, when starting a new business, you had to sign huge annual contracts with large data vendors first. But when a micropayment protocol is combined with agent payments, you can obtain data in real time only in the amount users actually ask for, which greatly lowers the up-front fixed cost burden.

Finally, when handling sensitive personalization data, it is safer to adopt a memory design tied directly to the identity authentication layer, rather than keep adding separate stores. Investment philosophy and financial asset information are highly sensitive personal information. Rather than spreading them across separate external databases, using a memory infrastructure strongly bound to the user identity token passed with each request lets you reach two goals at once: personalization quality and data isolation. As we move toward an era in which agents take real actions on our behalf, governance and isolation design should be at the center of the system, not an add-on.

---

Sources

1. AWS Machine Learning Blog — How Heurist Finance built an AI-native investment workbench on Amazon Bedrock AgentCore
   https://aws.amazon.com/blogs/machine-learning/how-heurist-finance-built-an-ai-native-investment-workbench-on-amazon-bedrock-agentcore/
   Published: 2026-09-09 (JW Wang — Founder, Heurist; Joshua Smith and Chethan Shriyan — AWS)