AI intelligence
Models that advise. Humans that decide.
Language models summarise, compare and argue. Deterministic code ranks, sizes and checks risk. People approve.
Research council
Seven roles with explicit capabilities
CIO synthesis
ImplementedWeighs disagreements, states assumptions and confidence, produces a thesis with evidence.
Agents agree on quality, disagree on valuation. Confidence: moderate. Thesis: HOLD.
Illustrative only — not a live recommendation for any security. Real theses cite source documents with as-of timestamps.
- Implemented
Fundamental
Reads SEC XBRL facts as of their filing date: profitability, cash conversion, leverage, valuation.
- Implemented
Technical
Trend, momentum and volatility from daily bars; explains rather than predicts.
- Implemented
Quantitative
Factor exposures, realized risk, relative strength and drawdown context.
- Implemented
Macro
Rates, curve shape, dollar and credit context from stored series.
- Implemented
Sentiment
Recent headlines, insider activity and short interest — with an injection filter on all untrusted text.
- Implemented
CIO synthesis
Weighs disagreements, states assumptions and confidence, produces a thesis with evidence.
- Implemented
Portfolio construction
Turns a thesis into a sized proposal that still has to pass the risk engine and a human.
Assistant permissions
Four tiers, enforced in code
READ
Portfolio, orders, theses, strategies, risk, quotes, news, filings, history, audit log, research-lab evidence. Read-only tools; results are slimmed and labelled as data.
ACT
Safe actions executed directly and audited: run research, propose an order (which goes to the risk engine and the approval queue), run validations or backtests, ENGAGE the kill switch.
CONFIRM
Prepared by the assistant but executed only when the operator clicks Confirm: approve or reject orders, promote or suspend strategies, toggle autonomy, RELEASE the kill switch.
NEVER
Broker credentials, bypassing risk, editing risk limits, code or raw rows, running the locked research holdout. No such tools exist.
services/api/src/hf_api/assistant.py
Safeguards
Source grounding
Agents receive only point-in-time data with provenance; theses store a snapshot hash and per-agent outputs, so every claim can be traced to its inputs and as-of time.
Prompt-injection defences
News, filings and tool results are treated as data, never instructions. An injection neutraliser flags imperative patterns in untrusted text before it reaches a model, and no tool reachable from untrusted content can execute trades.
Human oversight
Every order needs a named human approval — or a human-granted autonomy envelope with hard notional, count and ticker limits — and is re-checked by the risk engine at submission. Strategy promotion is human-only.
Model limitations
- Models can be confidently wrong; their stated confidence is never used as a probability or position size.
- The default model runs locally and may be slower or less capable than hosted models.
- Outputs are research, not investment advice.