AI Portfolio Assistant Guidance Catalog
Guidelines implementing principles across APA Gemara components.
Authority Ladder
Controls that define, grant, and enforce authority levels from observe through execute.
apa-guidance-observe-onlyObserve Authority Controls
Constrain observe-level sessions to reading authorized portfolio and application context without analysis, explanation, or action.
apa-guidance-observe-only.1At observe, the assistant may read FDC3 context and approved portfolio views for the active user and portfolio only.apa-guidance-observe-only.2At observe, the assistant must not invoke analysis tools, produce explanations or recommendations, construct order proposals, or trigger execution.
apa-principlesproportional-authority
apa-vectorsauthority-escalationcross-portfolio-context-bleedunintended-fdc3-broadcast
apa-guidance-analyse-explainAnalyse and Explain Authority Controls
Allow analysis and explanation only through deterministic tools and grounded interpretation within the granted authority level.
apa-guidance-analyse-explain.1Analyse — At analyse, the assistant may invoke approved deterministic applications to compute exposures, stress scenarios, and related analytics for the active portfolio.apa-guidance-analyse-explain.2Explain — At explain, the assistant may interpret deterministic results and retrieved research to help the portfolio manager understand positions and risks, disclosing material uncertainty.apa-guidance-analyse-explain.3Analyse and explain must not include recommendations, order proposals, or execution.
apa-principlesproportional-authoritydeterministic-calculations
apa-vectorshallucinated-financial-claimoverconfident-explanationstale-or-incorrect-market-data
apa-guidance-recommend-controlsRecommendation Authority Controls
Permit recommendations only when suitability, grounding, and oversight controls for the recommend authority level are satisfied.
apa-guidance-recommend-controls.1Recommendations must cite supporting deterministic outputs or approved research and must not present speculative claims as fact.apa-guidance-recommend-controls.2Recommendations must be consistent with the client's mandate and risk profile and must be presented as suggestions for portfolio manager consideration, not as instructions.apa-guidance-recommend-controls.3A recommendation must not be forwarded automatically into order construction or execution workflows.
apa-principlesproportional-authoritysuitability-and-conducthuman-oversight-of-consequence
apa-vectorsunsupervised-recommendation-acceptanceoverconfident-explanationhallucinated-financial-claim
apa-guidance-propose-approvalProposal Authority and Human Approval
Require recorded human approval before any order proposal proceeds toward trading workflows.
apa-guidance-propose-approval.1At propose, the assistant may construct a structured order proposal for the active portfolio based on deterministic analytics and approved inputs.apa-guidance-propose-approval.2Mandatory approval — An order proposal must not leave the assistant's controlled workspace or enter trading systems until an authorized portfolio manager records explicit approval.apa-guidance-propose-approval.3Approval evidence must identify the approver, timestamp, proposal identifier, and material assumptions.
apa-principleshuman-oversight-of-consequenceevidence-of-authority-useproportional-authority
apa-vectorsorder-proposal-without-approvalauthority-escalation
apa-guidance-execute-prohibitedAutonomous Execution Prohibited
Prohibit the assistant from autonomously executing orders or effecting portfolio changes.
apa-guidance-execute-prohibited.1Hard prohibition — The AI Portfolio Assistant must not submit orders, trigger execution intents, or otherwise effect portfolio changes autonomously under any authority grant.apa-guidance-execute-prohibited.2Execution may occur only through approved human-operated trading workflows after a separately authorized human decision.apa-guidance-execute-prohibited.3Technical controls must block FDC3 intents, APIs, and tools that would enable autonomous execution by the assistant.
apa-principlesprohibited-autonomous-executionproportional-authority
apa-vectorsexecution-bypassorder-proposal-without-approval
Oversight
Human-in-the-loop and accountability requirements for consequential AI outputs.
apa-guidance-human-oversightHuman Oversight Requirements
Ensure a qualified portfolio manager retains meaningful control over consequential AI outputs.
apa-guidance-human-oversight.1Portfolio managers remain accountable for investment decisions informed or proposed by the assistant.apa-guidance-human-oversight.2Human review is mandatory for propose-level outputs and for any path that could lead to execution.apa-guidance-human-oversight.3Oversight interfaces must present supporting evidence, assumptions, and residual uncertainty in a form that enables informed approval or rejection.
apa-principleshuman-oversight-of-consequencesuitability-and-conduct
apa-vectorsunsupervised-recommendation-acceptanceorder-proposal-without-approvaloverconfident-explanation
Data Protection
Confidentiality, FDC3 context boundaries, and model-provider data handling.
apa-guidance-fdc3-boundariesFDC3 Context and Broadcast Boundaries
Confine FDC3 context sharing to authorized applications, users, and portfolios for the current session.
apa-guidance-fdc3-boundaries.1The assistant may consume and emit FDC3 context only for the active portfolio manager session and authorized application set.apa-guidance-fdc3-boundaries.2Portfolio context from one client must not be mixed into prompts, tool calls, or broadcasts for another client.apa-guidance-fdc3-boundaries.3Sensitive explanations, recommendations, and order proposals must not be broadcast on FDC3 channels beyond applications explicitly authorized to receive them.
apa-principlesclient-confidentiality
apa-vectorscross-portfolio-context-bleedunintended-fdc3-broadcast
apa-guidance-model-providersModel Provider Data Controls
Prevent unauthorized exfiltration of client and portfolio data to external model providers.
apa-guidance-model-providers.1Only approved model providers and deployment configurations may process Portfolio Assistant prompts and tool results.apa-guidance-model-providers.2Prompts must minimize client-identifying and portfolio detail to what is necessary for the granted authority and intended use.apa-guidance-model-providers.3Provider contracts and technical controls must address retention, training use, residency, and breach notification consistent with firm policy.
apa-principlesclient-confidentiality
apa-vectorsmodel-provider-data-exfiltrationcross-portfolio-context-bleed
Tool Use
Requirements for deterministic applications, research retrieval, demo FDC3 intents, provenance, and safe tool invocation.
apa-guidance-deterministic-calcsDeterministic Calculation Separation
Ensure numerical financial calculations are performed by deterministic applications rather than by the language model.
apa-guidance-deterministic-calcs.1Exposures, stress scenarios, valuations, and similar figures used as authoritative inputs must originate from approved deterministic applications.apa-guidance-deterministic-calcs.2The assistant may summarize and explain deterministic outputs but must not invent substitute numerical results or present model arithmetic as authoritative.apa-guidance-deterministic-calcs.3Explanations and recommendations must reference the originating tool outputs when citing quantitative claims.
apa-principlesdeterministic-calculations
apa-vectorshallucinated-financial-claimstale-or-incorrect-market-datatool-argument-injection
apa-guidance-research-hygieneInvestment Research Input Hygiene
Treat retrieved investment research as untrusted input and prevent prompt injection or undue influence on authority and advice.
apa-guidance-research-hygiene.1Research content must be retrieved through approved channels and isolated from system and policy instructions.apa-guidance-research-hygiene.2Instructions found in research must not escalate authority, alter tool arguments, or override governance controls.apa-guidance-research-hygiene.3When research conflicts with deterministic application outputs, the conflict must be disclosed and deterministic outputs take precedence for quantitative claims.
apa-principlessuitability-and-conductdeterministic-calculations
apa-vectorsprompt-injection-via-researchtool-argument-injectionoverconfident-explanation
apa-guidance-demo-intentsDemo FDC3 Intent Allowlist
Bind the assistant's FDC3 surface to the named demo intents and map each intent to an authority level on the ladder.
apa-guidance-demo-intents.1Core allowlist — The assistant may raise demo.GetPortfolioRisk and demo.RunStressScenario at analyse, demo.GetResearch at explain, and demo.CreateOrderProposal at propose when the session entitlement and related controls are satisfied.apa-guidance-demo-intents.2Execute ban — The assistant must not successfully raise demo.SubmitOrders. Governance must return DENY and the Desktop Agent must not forward the intent.apa-guidance-demo-intents.3Responders — Risk App responds to GetPortfolioRisk and RunStressScenario; Research App to GetResearch; Order Entry to CreateOrderProposal; Execution / Order Entry would respond to SubmitOrders if it were permitted.apa-guidance-demo-intents.4Optional View intents — Supporting View* intents (ViewInstrument, ViewChart, ViewNews, ViewResearch, ViewAnalysis, ViewHoldings, ViewOrders) may be allowlisted as low-authority UI helpers and must not grant propose or execute authority.
apa-principlesproportional-authorityprohibited-autonomous-execution
AIR-PRINAIR-PRIN-005
apa-vectorsauthority-escalationexecution-bypasstool-argument-injection
apa-guidance-fdc3-securityFDC3 Security for Demo Contexts
Require cryptographic provenance on demo suite contexts used as evidence for analysis, explanation, recommendation, and proposal.
apa-guidance-fdc3-security.1Signed contexts — demo.portfolioRisk, demo.researchBundle, demo.stressScenarioResult, demo.portfolioRecommendation, and demo.orderProposal must be broadcast with FDC3 Security signatures.apa-guidance-fdc3-security.2Unsigned handling — The assistant must not treat unsigned instances of those contexts as authoritative grounding for explain, recommend, or propose outputs.apa-guidance-fdc3-security.3Evidence chain — Session logs should retain signature verification outcomes alongside the intent that produced or consumed the context.
apa-principlesdeterministic-calculationsevidence-of-authority-use
apa-vectorshallucinated-financial-claimoverconfident-explanationtool-argument-injection
Assurance
Logging, evidence retention, and incident escalation for continuous improvement of AI governance.
apa-guidance-loggingAuthority Use Logging and Evidence
Retain auditable evidence of authority grants, tool use, outputs, and human approvals.
apa-guidance-logging.1Log authority grants, level changes, tool invocations, material outputs by authority level, and human approval or rejection decisions.apa-guidance-logging.2Evidence must be attributable to user, session, portfolio, and guideline or control identifiers where applicable.apa-guidance-logging.3Retention and access to logs must support assurance review, incident investigation, and continuous improvement of the AI management system.
apa-principlesevidence-of-authority-use
apa-vectorsauthority-escalationorder-proposal-without-approvalexecution-bypass
apa-guidance-incident-escalationIncident Detection and Escalation
Detect, escalate, and remediate authority abuse, confidentiality incidents, and decision-quality failures involving the assistant.
apa-guidance-incident-escalation.1Attempted execution bypass, unapproved proposal forwarding, and suspected cross-portfolio disclosure must be treated as reportable incidents.apa-guidance-incident-escalation.2Material hallucinations, stale-data reliance, or injection events that affected recommendations or proposals must be escalated to the AI Governance Office and relevant risk owners.apa-guidance-incident-escalation.3Incident outcomes must feed updates to authority grants, controls, and this guidance where systemic weaknesses are found.
apa-principlesevidence-of-authority-useprohibited-autonomous-executionclient-confidentiality
apa-vectorsexecution-bypassorder-proposal-without-approvalcross-portfolio-context-bleedprompt-injection-via-researchmodel-provider-data-exfiltration
Preventive
Prevention and Risk Mitigation
AIR-PREV-018Agent Authority Least Privilege Frameworkimported
Imported from FINOS-AIR
The Agent Authority Least Privilege Framework implements granular access controls ensuring agents can only access APIs, tools, and data strictly necessary for their designated functions. This preventive control establishes dynamic privilege management, contextual access restrictions, and comprehensive authorization enforcement to prevent agents from exceeding their intended operational scope and causing unauthorized actions or regulatory violations. This framework extends traditional least privilege principles to address the unique challenges of agentic AI systems, where agents make autonomous decisions about tool selection and API usage, requiring more sophisticated controls than static role-based access systems.
AIR-PREV-018.1Agent Role and Privilege Definition —AIR-PREV-018.2Dynamic Privilege Management —AIR-PREV-018.3API and Tool Access Enforcement —AIR-PREV-018.4Business Logic and Approval Workflow Enforcement —AIR-PREV-018.5Monitoring and Auditing —AIR-PREV-018.6Integration with Existing Security Systems —
AIR-PRINAIR-PRIN-003Agents operate with the minimum authority requiredAIR-PRIN-004Privilege enforcement and approval workflows provide layered controlAIR-PRIN-005Privilege decisions and agent actions are auditable
AIR-VECAIR-SEC-024-01AIR-SEC-024-02AIR-SEC-024-03AIR-SEC-024-04AIR-OP-018
AIR-PREV-019Tool Chain Validation and Sanitizationimported
Imported from FINOS-AIR
Tool Chain Validation and Sanitization implements comprehensive validation mechanisms for agent tool selection decisions, API parameter sanitization, and safe tool execution sequences. This preventive control ensures that agents cannot be manipulated into selecting inappropriate tools, injecting malicious parameters into API calls, or executing dangerous tool combinations that could result in unauthorized actions or system compromise. This mitigation addresses the unique attack surface created by agentic systems' autonomous tool selection and execution capabilities, extending beyond traditional input validation to cover the complex decision-making processes that determine which tools agents use and how they sequence multiple tool calls.
AIR-PREV-019.1Tool Selection Validation Framework —AIR-PREV-019.2API Parameter Validation and Sanitization —AIR-PREV-019.3Tool Sequence and Workflow Validation —AIR-PREV-019.4Real-time Monitoring and Alerting —AIR-PREV-019.5Validation Rule Management and Updates —AIR-PREV-019.6Integration with Agent Architecture —
AIR-PRINAIR-PRIN-001Tool inputs and parameters are sanitized before executionAIR-PRIN-004Validation forms a defensive layer around agent tool useAIR-PRIN-005Validation events are monitored and logged
AIR-VECAIR-SEC-025-01AIR-SEC-025-02AIR-SEC-025-03AIR-SEC-025-04AIR-SEC-025-05AIR-SEC-010-01AIR-SEC-010-02AIR-SEC-010-03AIR-SEC-024-01AIR-SEC-024-02AIR-SEC-024-03AIR-SEC-024-04
AIR-PREV-012Role-Based Access Control for AI Dataimported
Imported from FINOS-AIR
Role-Based Access Control (RBAC) is a fundamental security mechanism designed to ensure that users, AI models, and other systems are granted access only to the specific data assets and functionalities necessary to perform their authorized tasks. Within the context of AI systems in a financial institution, RBAC is critical for protecting the confidentiality, integrity, and availability of data used throughout the AI lifecycle – from data sourcing and preparation to model training, validation, deployment, and operation. This control ensures that access to sensitive information is strictly managed based on defined roles and responsibilities.
AIR-PREV-012.1Define Roles and Responsibilities for AI Data Access —AIR-PREV-012.2Data Discovery, Classification, and Inventory —AIR-PREV-012.3Develop and Maintain an Access Control Matrix —AIR-PREV-012.4Implement Technical Access Controls —AIR-PREV-012.5Employ Strong Authentication and Authorization Mechanisms —AIR-PREV-012.6Conduct Regular Access Reviews and Recertification —AIR-PREV-012.7Manage Access for Non-Human Identities —AIR-PREV-012.8Log and Monitor Data Access —
AIR-PRINAIR-PRIN-002Access decisions are driven by data classificationAIR-PRIN-003Least-privilege access limits exposure of AI dataAIR-PRIN-005Access logging and recertification provide auditability
AIR-VECAIR-RC-001-01AIR-RC-001-02AIR-RC-001-03AIR-RC-001-04AIR-RC-001-05AIR-SEC-008-01AIR-SEC-008-02AIR-SEC-008-03AIR-SEC-008-04AIR-SEC-008-05AIR-SEC-009-01AIR-SEC-009-02AIR-SEC-009-03AIR-SEC-009-04
AIR-PREV-002Data Filtering From External Knowledge Basesimported
Imported from FINOS-AIR
This control addresses the critical need to sanitize, filter, and appropriately manage sensitive information when AI systems ingest data from internal knowledge sources such as wikis, document management systems, databases, or collaboration platforms (e.g., Confluence, SharePoint, internal websites). The primary objective is to prevent the inadvertent exposure, leakage, or manipulation of confidential organizational knowledge when this data is processed by AI models, converted into embeddings for vector databases, or used in Retrieval Augmented Generation (RAG) systems. Given that many AI applications, particularly RAG systems, rely on internal knowledge bases to provide contextually relevant and organization-specific responses, ensuring that sensitive information within these sources is appropriately handled is paramount for maintaining data confidentiality and preventing unauthorized access.
AIR-PREV-002.1Rigorous Data Cleansing and Anonymization at Ingestion — Identify and remove or appropriately anonymize sensitive details to ensure that data fed into the AI system is free from information that could pose a security or privacy risk if inadvertently exposed.AIR-PREV-002.2Segregation for Highly Sensitive Data —AIR-PREV-002.3Filtering AI System Outputs (Secondary Defense) —AIR-PREV-002.4Integration with Source System Access Controls —AIR-PREV-002.5Monitoring and Continuous Improvement — Periodically audit the effectiveness of data filtering processes by sampling processed data and checking for any sensitive information that may have been missed.
AIR-PRINAIR-PRIN-001Filtering and anonymization applied before data enters AI pipelinesAIR-PRIN-002Filtering strategies respect source data sensitivity and access controlsAIR-PRIN-003Only necessary data included in AI systems, de-identified where possibleAIR-PRIN-004Multiple filtering layers at ingestion, processing, and outputAIR-PRIN-005Audit trails document what filtering has been applied and why
AIR-VECAIR-RC-001-01AIR-RC-001-02AIR-RC-001-03AIR-RC-001-04AIR-RC-001-05AIR-SEC-009-01AIR-SEC-009-02AIR-SEC-009-03AIR-SEC-009-04
Detective
Detection and Continuous Improvement
AIR-DET-021Agent Decision Audit and Explainabilityimported
Imported from FINOS-AIR
Agent Decision Audit and Explainability implements comprehensive logging, documentation, and explainability mechanisms for agent decisions to support regulatory compliance, security incident investigation, and decision accountability. This detective control ensures that all agent actions, reasoning processes, and decision factors are captured in sufficient detail to meet regulatory requirements and enable effective forensic analysis when incidents occur. This mitigation is critical for financial services where regulatory bodies require detailed audit trails for automated decision-making systems, and where the ability to explain and justify agent decisions is essential for customer protection and compliance verification.
AIR-DET-021.1Comprehensive Decision Logging Framework —AIR-DET-021.2Explainability and Reasoning Capture —AIR-DET-021.3Regulatory Compliance Integration —AIR-DET-021.4Real-time Monitoring and Alerting —AIR-DET-021.5Incident Investigation Support —AIR-DET-021.6Reporting and Analytics —
AIR-PRINAIR-PRIN-004Audit trails form a detective layer over agent decisionsAIR-PRIN-005Decision logging and reasoning capture provide auditability and transparency
AIR-VECAIR-SEC-024-01AIR-SEC-024-02AIR-SEC-024-03AIR-SEC-024-04AIR-SEC-025-01AIR-SEC-025-02AIR-SEC-025-03AIR-SEC-025-04AIR-SEC-025-05AIR-RC-022-01AIR-RC-022-02AIR-RC-022-03AIR-RC-022-04
AIR-DET-013Providing Citations and Source Traceability for AI-Generated Informationimported
Imported from FINOS-AIR
This control outlines the practice of designing Artificial Intelligence (AI) systems—particularly Large Language Models (LLMs) and Retrieval Augmented Generation (RAG) systems that produce informational content to provide verifiable citations, references, or traceable links back to the original source data or knowledge used to formulate their outputs. The primary purpose of providing citations is to enhance the transparency, verifiability, and trustworthiness of AI-generated information. By enabling users, reviewers, and auditors to trace claims to their origins, this control acts as a crucial detective mechanism. It allows for the independent assessment of the AI's informational basis, thereby helping to detect and mitigate risks associated with misinformation, AI "hallucinations," lack of accountability, and reliance on inappropriate or outdated sources.
AIR-DET-013.1Designing AI Systems for Citability (Especially RAG Systems) —AIR-DET-013.2Presentation of Citations to Users —AIR-DET-013.3Quality, Relevance, and Limitations of Citations —AIR-DET-013.4Maintaining Citation Integrity Over Time —AIR-DET-013.5User Education and Guidance (as per ISO 42001 A.8.2) —AIR-DET-013.6Technical Documentation (as per ISO 42001 A.6.2.7) —
AIR-PRINAIR-PRIN-004Source grounding is a detective check against unsupported outputsAIR-PRIN-005Citations make AI outputs traceable to their sources, supporting transparency
AIR-VECAIR-OP-004-01AIR-OP-004-02AIR-OP-004-03AIR-OP-004-04AIR-OP-017AIR-OP-020AIR-RC-022-01AIR-RC-022-02AIR-RC-022-03AIR-RC-022-04
AIR-DET-011Human Feedback Loop for AI Systemsimported
Imported from FINOS-AIR
A Human Feedback Loop is a critical detective and continuous improvement mechanism that involves systematically collecting, analyzing, and acting upon feedback provided by human users, subject matter experts (SMEs), or reviewers regarding an AI system's performance, outputs, or behavior. In the context of financial institutions, this feedback is invaluable for: Monitoring AI System Efficacy: Understanding how well the AI system is meeting its objectives in real-world scenarios; Identifying Issues: Detecting problems such as inaccuracies, biases, unexpected behaviors (ri-5, ri-6), security vulnerabilities (e.g., successful prompt injections, data leakage observed by users), usability challenges, or instances where the AI generates inappropriate or harmful content; Enabling Continuous Improvement: Providing data-driven insights to refine AI models, update underlying data (e.g., for RAG systems), tune prompts, and enhance user experience; Supporting Incident Response: Offering a channel for users to report critical failures or adverse impacts, which can trigger incident response processes; Informing Governance: Providing qualitative and quantitative data to AI governance bodies and ethics committees. This control emphasizes the importance of structuring how human insights are captured and integrated into the AI system's lifecycle for ongoing refinement and risk management.
AIR-DET-011.1Designing the Feedback Mechanism —AIR-DET-011.2Types of Feedback and Collection Methods —AIR-DET-011.3Processing and Utilizing Feedback —AIR-DET-011.4Advanced Feedback Integration: Reinforcement Learning from Human Feedback (RLHF) —AIR-DET-011.5Integration with "LLM-as-a-Judge" Concepts —AIR-DET-011.6Feedback Review, Actioning, and Governance Process —
AIR-PRINAIR-PRIN-004Human review forms a detective layer over automated outputsAIR-PRIN-005Captured feedback and governance processes document model quality over time
AIR-VECAIR-OP-005-01AIR-OP-005-02AIR-OP-005-03AIR-OP-005-04AIR-OP-006-01AIR-OP-006-02AIR-OP-006-03AIR-OP-006-04AIR-OP-014-01AIR-OP-014-02AIR-OP-014-03AIR-OP-014-04AIR-OP-014-05AIR-OP-016-01AIR-OP-016-02AIR-OP-016-03AIR-OP-016-04AIR-OP-020
AIR-DET-001AI Data Leakage Prevention and Detectionimported
Imported from FINOS-AIR
Data Leakage Prevention and Detection (DLP&D) for Artificial Intelligence (AI) systems encompasses a combination of proactive measures to prevent sensitive data from unauthorized egress or exposure through these systems, and detective measures to identify such incidents promptly if they occur. This control is critical for safeguarding various types of information associated with AI, including: Session Data: Information exchanged during interactions with AI models (e.g., user prompts, model responses, intermediate data); Training Data: Proprietary or sensitive datasets used to train or fine-tune AI models; Model Intellectual Property: The AI models themselves (weights, architecture) which represent significant intellectual property. This control applies to both internally developed AI systems and, crucially, to scenarios involving Third-Party Service Providers (TSPs) for LLM-powered services or raw model endpoints, where data may cross organizational boundaries.
AIR-DET-001.1Proactive Measures: Preventing Data Leakage —AIR-DET-001.2Detective Measures: Identifying Data Leakage —
AIR-PRINAIR-PRIN-001Input/output guardrails sanitize data before it leaves the AI trust boundaryAIR-PRIN-003Minimizes sensitive data exposed to third-party model servicesAIR-PRIN-004Layered preventive and detective controls across transmission, storage, and model layersAIR-PRIN-005Canary tokens, fingerprinting, and monitoring provide audit evidence of leakage
AIR-VECAIR-RC-001-01AIR-RC-001-02AIR-RC-001-03AIR-RC-001-04AIR-RC-001-05