Most discussion of AI agents is still a discussion about instructions — how to phrase the task, how to structure the request, which model to point at it. That is the part you can do in an afternoon, which is why it gets the attention. It is also the part that matters least once an agent is doing real work inside a fund.
An agent reads something, decides something and does something. Each of those verbs rests on machinery that either exists before any model is chosen, or does not. Three questions settle whether an agent will be useful: what can it read, what is it allowed to do, and can anyone check its work afterwards. Answer those well and an ordinary model becomes useful. Answer them badly and the best model available produces output nobody is willing to put their name to.
1. Read — grounding
An agent's answer is worth exactly what its retrieval was worth. Grounding is not a model feature; it is a property of the systems the agent is pointed at.
One system of record
If the commitment schedule exists in three places, the agent's first act is to choose between them, and it will make that choice without telling you. A single authoritative record is not a tidiness preference. It is the thing that makes an agent's output reproducible, which is the precondition for anyone relying on it twice.
Structured fields, not pictures of fields
Commitment, drawn, distributed, unfunded, NAV, valuation date — these need to be typed fields with definitions attached, not values embedded in a rendered statement. An agent can read a number off a PDF. What it cannot do is know whether that number was computed before or after the accrual, or which of two similar labels the fund actually means. Structure is what converts reading into computing.
The unstructured documents indexed alongside them
Private markets keep half their meaning in prose. The limited partnership agreement, side letters, subscription packs, board minutes, portfolio company updates written as paragraphs. An agent that can read the register but not the side letter overriding it will be wrong in precisely the situations where being right matters. Documents have to be indexed against the entities they concern — this investor, this vehicle, this company — so that retrieval is scoped rather than hopeful. That indexing is a data and integrations problem, and it is usually the longest pole in the tent.
Retrieval that can cite the record it came from
Every figure an agent produces should arrive with a pointer to where it came from: the row, the document, the version, the date it was last changed. This is the difference between an answer and an assertion. It is also what makes review cheap — a reviewer who can click through to the source spends seconds, while a reviewer who has to reconstruct the calculation spends as long as doing the work themselves. Verification cost, not accuracy, is what usually determines whether an agent survives contact with a busy quarter.
An uncitable answer cannot be used in anything that leaves the building — which means, in a fund, that it cannot be used at all.
2. Act — permissioning
This is the substrate most often skipped, because a demonstration works without it and the cost of skipping it only appears later.
An agent inherits a role, not a superuser key
The convenient way to give software access is to give it everything. Do that and the agent's blast radius is the whole platform, permanently, regardless of how narrow the task was. The correct model is duller: an agent acting on behalf of the fund accountant sees what the fund accountant sees and can do what the fund accountant can do — no more. The same role structure that governs your people should govern your software, with the same controls and access logs behind it. If a vendor cannot show you where an agent's permissions are set, the answer is that they are not set.
Proposing and executing are different products
An agent that proposes computes each investor's share, drafts the notice, flags the two investors whose details have changed, assembles the pack — and then stops, with everything ready and nothing sent. An agent that executes sends it. The engineering gap between those is small. The governance gap is enormous, and it should be an explicit decision per class of action rather than a default that emerges from whichever permission somebody granted first.
Anything that moves money or reaches an investor needs a human
Not because agents are unreliable — people misfile wires too — but because these actions are one-way doors. A payment instruction that has settled cannot be recalled by apologising. A statement that has reached four hundred inboxes cannot be unsent. The test is not how confident the software is; it is whether the action can be reversed at acceptable cost. Where it cannot, a named person approves it, and the approval is recorded next to the action.
Four decisions to write down before any agent goes live: which classes of action may run without a human; which need one approver; which need two; and what happens when an approval is not given — does the item wait, expire, or escalate? These are policy choices, not technical ones, and they take an afternoon to make once somebody insists on making them.
3. Verify — auditability
The third substrate is a single audit log. Every agent action should be written to the same log as the equivalent human action, in the same shape: actor, timestamp, the value before, the value after, and the instruction or event that caused it. Not a separate model log in a separate console.
The reason is practical. When an auditor, an investor or your own finance team asks why a valuation changed, the answer must be a single readable sequence of events. If human actions are in one system and agent actions in another, reconstructing a quarter means merging two timelines by hand — and every incentive will push people toward keeping agents out of anything that matters, which defeats the purpose.
When the agent is unsure, it escalates rather than guesses
A model asked for a number will produce a number. Fluency is not correctness, and an uncertain answer is formatted identically to a confident one. So the agent needs a legitimate third option beyond answering and refusing: hand the item to a person, with what it found, what it could not reconcile, and where it looked. Escalation has to be a designed path with a queue and an owner. Left to itself, plausible output is always the path of least resistance.
What this means when you are buying
Agent demonstrations look alike. The chat window is convincing in every one of them, because the hard parts are invisible in a demo. Two questions separate the products, and both can be asked in a first meeting:
- Where do the agent's permissions come from? A good answer points at the same role and access configuration your users have, and shows you the screen where it is set. A poor answer describes an API key.
- Where are the agent's actions logged? A good answer shows you a row in the same audit trail as a human action, with the before and after values. A poor answer offers a transcript of the conversation.
Three more worth asking: what does the agent do when it cannot resolve something; can every figure it produces be traced to a source record; and who in your firm can switch it off, immediately, without a support ticket. Agents built for private markets should have unremarkable answers to all five. If the answers are interesting, that is usually a warning.
The argument, briefly
Prompting is the visible part of agent work and the smallest part of it. Everything that decides whether an agent is safe to run in a fund — one record to read, roles it can inherit, an approval step where reversal is impossible, one log where its actions land, and a defined route for admitting it does not know — is ordinary software infrastructure. It is also work that improves the fund whether or not an agent ever touches it.
Done properly, the result is undramatic. The agents become part of the furniture, doing the chasing and the drafting and the first-pass reconciliation, while people spend their attention on the judgements that were always theirs. Boring is the target. Boring is what an investor is entitled to expect.