Most conversations about AI in wealth management stall on the same objection: LLMs are probabilistic, advice must be defensible, therefore LLMs can’t advise. I think that framing gets the problem wrong. The fiduciary bar has never been prescience; it’s a reasonable basis formed through a sound process. For a human adviser, that basis rests on licensure and supervision. For an AI system, it can rest on something arguably stronger: a reproducible, versioned audit trail and committee ownership of the methodology.
The framework I developed makes that concrete through a small number of design commitments.
The LLM is one component in a deterministic pipeline.
Verified data goes in. A codified rule set governs what the model may say and how. A compliance agent scores every output before it renders. Disclosures render deterministically, outside the model’s control. Everything is logged. The model never touches the customer directly; the pipeline does.
Model judgment reaches outcomes only through sanctioned channels.
Upstream of the advice engine, model judgment is decomposed into bounded, single-purpose sub-agents, each fully traced: a rating engine that scores every name in a bounded universe and writes a citation-grounded rationale, exposure tags drawn from a committee-owned registry of risk themes, and event flags for known pending catalysts. That judgment can then influence position sizing through exactly three routes, each sampled and reviewed by the investment committee: the rating score inside the optimization objective, an upward-only risk adjustment, and exposure limits the user has explicitly directed. Tags never size a position on the engine’s own initiative.
Risk itself is scored mechanically first. Every name carries a base risk tier computed from market data: realized volatility, beta, market-cap band, profitability, drawdown history. The model may move a name up a tier, never down, to capture risk the mechanical inputs can’t yet see, such as pending litigation, accounting red flags, or binary-event exposure. The asymmetry is deliberate: if the model is wrong, the system becomes more conservative, never less. Everything else is deterministic, with hard eligibility gates that no instruction, mandate, or preference can override, and allocation solved as a constrained optimization against a per-user reference portfolio, where every deviation must be paid for in rating conviction and transaction cost.
A run is a pure function.
Identical inputs, meaning the data snapshot, client profile, compiled constraint set, rating snapshot, parameter version, and engine version, produce identical output. When someone asks “why is this position 4.2% and not 6%?”, the answer exists as a record, not a reconstruction. That solve record, with its constraint set and solution status, is the fiduciary artifact, and it satisfies books-and-records obligations by construction rather than by after-the-fact documentation.
Rules police verdicts, not language.
Writing a compliant rule set for generative output is closer to drafting a statute than writing a style guide. A descriptor like “volatile” is permitted only when tied to a defined in-app metric with inline attribution. Evaluative verbs can’t pair with conditionals that imply a call to action. The design goal isn’t to make the model sound cautious; it’s to make it structurally impossible for the system to render a verdict the user didn’t reach themselves.
Regulatory posture is a design input, not a disclaimer.
The framework distinguishes, turn by turn, between a fiduciary advisory posture, where recommendations are permitted subject to the full suitability, concentration, conflict-disclosure, and recordkeeping stack, and a non-recommendation posture where they are not, with ambiguity defaulting out of scope. If a regulator asks “on what basis does the system conclude X,” the answer is a specific layer, a specific gate, and a specific citation.
Compliance authority is designed into the architecture.
The CCO holds kill-switch authority over the engine. Guardrails run on 100% of outputs, with a second model gating the first. Defect tolerances are set in advance, and sampled findings are triaged into a defined taxonomy. Supervision isn’t a review that happens to the system; it’s a subsystem.
None of this makes AI advice risk-free. It makes it supervisable, which is the actual regulatory standard humans are held to.