Which identity is acting?
In the profession: IdentityEach acting system should have an identifiable, limited workload identity, not an untraceable shared account.
Before AI becomes useful, decide what it may know and do.
For a family office, fiduciary firm or trusted adviser, AI is most consequential when it interacts with real records and processes. A well-written answer is only part of the test. The organisation must know which sources the system can reach, which boundaries it respects, what actions it may take and who remains responsible for the result.
I find it useful to separate capability from authority. A model may be capable of an action long before the organisation should permit it.
Two AI assignments
What it may do, and what it may know.
Both can be taken up as a bounded independent review. Both start with the workflow, not with the documents.
AI and agent governance
AI can assist fiduciary work. Authority must remain explicit.
Staff may already use AI to search, summarise, draft and organise information. In a trust company or family office, a helpful tool can also reach records relating to different clients, beneficiaries, entities and advisers. The issue is not simply whether AI works. It is whether the organisation can define, enforce and demonstrate what it is permitted to do.
Why a policy is not enough
Policy expresses intent; operational controls determine who or what can access a record, whether information leaves a trusted environment, which action requires approval and whether the outcome can be reconstructed. A system that recommends a reply and one that sends it have different authority. Treating them as the same tool hides the most important decision.
What I examine
Actual use
The tools being used, approved or otherwise, the workflows they affect and who owns the decision to use them.
Data entitlement
Whether access follows existing permissions across clients, entities, mandates and sensitive documents.
Level of authority
Which of the six levels below the system has reached, and whether that was decided or simply happened.
Supplier boundaries
Where prompts and documents travel, retention and subprocessors, contractual terms and practical exit options.
Review and evidence
How answers can be checked against original sources and how material actions are logged and approved.
Intervention
How the system can be stopped, permissions withdrawn and consequential actions corrected or escalated.
The output
- An AI authority and information-boundary view, ranked gaps and a practical adoption sequence. That may recommend limited pilots, stronger identity controls, different provider arrangements or deferring a use case until the underlying records are reliable.
This is technology, architecture and operating governance advice. It does not substitute for a trustee's duty, legal privilege assessment, jurisdiction-specific legal opinion or a professional's judgement on a client matter.
Private AI for sensitive records
Use AI where the information can remain under appropriate control.
An archive of trust documents, correspondence, financial reports or family records may hold enormous operational value. Making it searchable is not only an AI question. It is a decision about who may see each record, how an answer is supported, where data is processed and how the organisation retains control of the arrangement. The right design is not automatically on-premises, cloud-based or hybrid. It depends on the information, the obligations, the use case and the evidence available about each provider.
What private hosting does not settle
Private hosting alone does not create security or compliance. Access, training and retention settings, technical operations, professional obligations and incident arrangements still need independent examination. The objective is not to recommend a fashionable model but to choose an arrangement that people can use, govern and maintain.
Typical starting points
- Finding historical documents while preserving client and entity boundaries.
- Assisted drafting that never bypasses an authorised professional reviewer.
- Search across internally held records with source attribution.
- A controlled pilot for a document-heavy process where a public AI account would be unsuitable.
Start with the information boundary
What information is involved?
Distinguish public, internal, client-confidential, privileged and especially sensitive categories as defined by the relevant organisation and its advisers.
Who may see it?
Account for separation between clients, families, legal entities, roles and external professionals.
Where may processing happen?
Compare controlled external services, dedicated environments and private deployments against actual contractual and operational requirements.
Can an answer be checked?
Prefer traceable references to original documents, clear uncertainty and human approval where consequences are material.
What does the provider retain?
Review retention, logging, subprocessors, access by the provider and the practical ability to retrieve or delete information where required.
Can the arrangement be changed?
Understand the cost of operation and exit, including document formats, connectors, model alternatives and internal skills.
What you receive
- An assessment of use cases and information classifications, a proposed processing boundary, relevant supplier and access decisions, the main trade-offs and a staged route for testing value without casually widening exposure.
How much authority are you giving it?
Six levels of authority, six different decisions.
The question is not simply whether to use AI. It is how much authority the tool has been given, and each level should be approved as its own decision. Reading a document is not the same as disclosing it in an answer. Preparing a draft is not the same as sending it. Recommending a transfer or approval is not the same as carrying one out. The distinction becomes critical where the record concerns a different client, entity or family member. Open a step to see what it buys and what it costs.
-
1 ReadIt can see information.
What changes
The system can retrieve permitted information.
What new risk appears
It may see material the user should not see, even if it cannot change anything.
What control it needs
Enforce the requester's entitlements at retrieval and minimise data exposure.
-
2 SummariseIt can explain what it found.
What changes
The system condenses or transforms source material into an answer.
What new risk appears
Omission, distortion and false certainty can travel further than the source.
What control it needs
Retain traceable sources, review requirements and appropriate confidence boundaries.
-
3 RecommendIt can suggest what someone should do.
What changes
The system suggests a decision or next step.
What new risk appears
Advice can acquire unearned authority when it looks definitive.
What control it needs
Define decisions requiring independent evidence or human challenge.
-
4 PrepareIt can draft the email, the payment or the change.
What changes
The system drafts an operational change, message, instruction or transaction.
What new risk appears
Approval can become a reflex if the action is already assembled.
What control it needs
Show exact proposed effects and require meaningful review.
-
5 Act with approvalIt can carry it out once a person agrees.
What changes
The system can execute within a workflow after explicit human authorisation.
What new risk appears
Weak approvals or shared identities make accountability hard to reconstruct.
What control it needs
Action-specific authority, distinct system identity, logging and rollback where feasible.
-
6 Act within limitsIt can carry it out on its own, inside defined boundaries.
What changes
The system may execute permitted actions without case-by-case approval.
What new risk appears
Mistakes repeat quickly, possibly across several connected systems.
What control it needs
Narrow scope, rate and spending limits, monitoring, interruption and tested recovery.
The point is not that every application should remain at the first level. It is that advancement between levels requires a deliberate decision about authority and evidence.
Read the essay: Before an AI agent is allowed to act
Six questions
The questions before the connection is made.
Identity, authority, data, providers, observation, recovery. Not a maturity model and not a certification: six things that have to have answers before a system is allowed to act on anything that matters.
What action requires human approval?
In the profession: AuthorityMake the distinction between viewing, drafting, recommending and executing explicit.
Which client, entity or record may it access?
In the profession: DataTreat retrieved documents, email, web content and other external material as potentially untrusted instructions.
Which provider processes or stores the information?
In the profession: ProvidersMap subprocessors, retention, processing locations and changes in supplier arrangements.
Can a responsible person reconstruct the answer and action?
In the profession: ObservationRecord sufficient evidence of requests, tools, data access, approvals and resulting changes, with appropriate safeguards for sensitive logs.
Can the authority be withdrawn and the consequences reversed?
In the profession: RecoveryTest revocation, limits, interruption, recovery and the handling of irreversible actions.
Positions
Positions I would use to test a proposal.
An acting agent is privileged infrastructure
Review its access with the care given to an account that can change business records.
Identity is no longer only about people
Permissions, ownership and evidence must cover non-human actors.
The information layer should outlive a model choice
Organise authoritative content so switching a model does not mean losing institutional knowledge.
Confidentiality can require more than one architecture
Some tasks suit external services; others need tighter containment or should not be automated at all.
An exit path is a governance decision
Supplier portability matters most when systems become embedded in day-to-day work.
Value is visible in changed work
Measure usefulness by service quality, time saved, errors prevented or decisions improved, not demonstrations alone.
My working position
The best AI programme is not the one with the most agents. It is the one that produces useful work within an authority model the organisation understands, can test and can change. In sensitive environments, that is what allows adoption to become sustainable rather than experimental.
In an ongoing CIO or CTO role, the same authority questions become decisions about system identity, supplier contracts, engineering architecture, approvals and who can stop a workflow once it is in use.
Begin with the workflow and the authority question, not with client documents.
If you are evaluating an AI workflow involving confidential records, an outline of the workflow and the decision is enough.