AI Portfolio Assistant Policy

Policy governing authority, controls, and enforcement across APA components.

Policyv0.2.0draft

Policy governing use of the AI Portfolio Assistant across FDC3 desktop applications, including authority-ladder boundaries, human oversight for propose activity, and prohibition of autonomous trade execution. Composes FINOS AIGF guidance and CCC Managed Kubernetes host controls. Suitable for dual use as an ISO/IEC 42001-aligned AI policy statement.

Showing 15 of 15

Assessment Plans

ap-apa-001-authority-ceilingapa-ctl-001-authority-ceiling.ar01

Frequency per-session-action

Description

Session evidence that every assistant action remains at or below the portfolio manager's granted authority level for the session.

Evaluation Methods

automated-authority-ceiling-checkBehavioral · Automated · automated authority ceiling check

ap-apa-002-observe-analyse-allowapa-ctl-002-observe-analyse-allow.ar01

Frequency per-session-action

Description

Evidence that observe and analyse actions are permitted only when the session authority ceiling includes those levels and target portfolio access is authorized.

Evaluation Methods

automated-authority-allowlist-checkBehavioral · Automated · automated authority allowlist check

ap-apa-003-explain-disclosureapa-ctl-003-explain-disclosure.ar01

Frequency per-explanation

Description

Evidence that explanations disclose underlying deterministic sources, uncertainty, and authority context before presentation to the user.

Evaluation Methods

automated-explanation-disclosure-checkBehavioral · Automated · automated explanation disclosure check

ap-apa-005-propose-human-approvalapa-ctl-005-propose-human-approval.ar01

Frequency per-order-proposal

Description

Evidence that no order proposal is released to trading or order-entry applications without a recorded human approval from the accountable portfolio manager.

Evaluation Methods

automated-human-approval-checkBehavioral · Automated · automated human approval check
workflow-approval-checkBehavioral · Automated · workflow approval check

ap-apa-006-execute-prohibitapa-ctl-006-execute-prohibit.ar01

Frequency per-session-action

Description

Evidence that the assistant never invokes trade-execution tools or submits orders autonomously under any authority level.

Evaluation Methods

automated-execution-block-checkBehavioral · Automated · automated execution block check

ap-apa-007-portfolio-access-controlapa-ctl-007-portfolio-access-control.ar01

Frequency per-portfolio-access

Description

Evidence that portfolio reads are limited to entitlements of the authenticated portfolio manager for the active session.

Evaluation Methods

automated-portfolio-entitlement-checkBehavioral · Automated · automated portfolio entitlement check

ap-apa-008-cross-portfolio-isolationapa-ctl-008-cross-portfolio-isolation.ar01

Frequency per-session-action

Description

Evidence that session context, retrieved research, and tool outputs do not mix data across unrelated client or portfolio boundaries.

Evaluation Methods

automated-context-isolation-checkBehavioral · Automated · automated context isolation check

ap-apa-009-deterministic-calc-onlyapa-ctl-009-deterministic-calc-only.ar01

Frequency per-calculation-request

Description

Evidence that exposures, stresses, and other quantitative results are obtained from approved deterministic applications rather than generated as model-invented figures.

Evaluation Methods

automated-calc-delegation-checkBehavioral · Automated · automated calc delegation check

ap-apa-010-tool-allowlistapa-ctl-010-tool-allowlist.ar01

Frequency per-tool-invocation

Description

Evidence that tool calls are restricted to the approved FDC3 and runtime allowlist for the granted authority level.

Evaluation Methods

automated-tool-allowlist-checkBehavioral · Automated · automated tool allowlist check

ap-apa-011-prompt-injection-defensesapa-ctl-011-prompt-injection-defenses.ar01

Frequency per-retrieval-and-tool-call

Description

Evidence that research retrieval and tool arguments are screened for injection and that untrusted content cannot raise authority or bypass approval gates.

Evaluation Methods

automated-injection-defense-checkBehavioral · Automated · automated injection defense check

ap-apa-012-explanation-groundingapa-ctl-012-explanation-grounding.ar01

Frequency per-explanation-or-recommendation

Description

Evidence that explanations and recommendations cite deterministic application outputs or approved research sources and do not present ungrounded financial claims as fact.

Evaluation Methods

automated-grounding-checkBehavioral · Automated · automated grounding check
automated-source-citation-checkBehavioral · Automated · automated source citation check

ap-apa-013-session-loggingapa-ctl-013-session-logging.ar01

Frequency per-session

Description

Evidence that authority level, tool calls, recommendations, proposals, approvals, and enforcement actions are retained in the session log for the required retention period.

Evaluation Methods

automated-session-log-checkBehavioral · Automated · automated session log check

ap-apa-014-model-provider-controlsapa-ctl-014-model-provider-controls.ar01

Frequency per-model-invocation-and-on-change

Description

Evidence that model-provider invocations use approved endpoints, redaction or retention settings, and current supplier-assurance disposition.

Evaluation Methods

automated-provider-control-checkBehavioral · Automated · automated provider control check
manual-supplier-assurance-reviewIntent · Manual · manual supplier assurance review

ap-apa-015-incident-escalationapa-ctl-015-incident-escalation.ar01

Frequency when-triggered

Description

Evidence that authority, confidentiality, or conduct incidents are escalated to Compliance and AI Governance Office with recorded disposition.

Evaluation Methods

automated-incident-signal-checkBehavioral · Automated · automated incident signal check
manual-compliance-reviewIntent · Manual · manual compliance review