By Andre Nedelcoux, SVP, Head of FSI at Intellias

Ask an asset manager whether their firm uses AI and the answer is almost always yes. Ask whether it lets AI act, and the picture changes.  

A survey by Mercer found 55% of asset managers have integrated AI into at least one investment process, and 91% plan to expand its use. Yet only 5% give AI autonomous or semi-autonomous authority over investment recommendations or trades. 

The capital markets industry was one of the first to embrace, and experiment with AI. As the technology matured, AI adoption progressed from individual productivity (level 1) and process augmentation (level 2), to agentic processes (level 3), and, ultimately, business reinvention through autonomous multi-agent collaboration (level 4). The higher you climb, the greater the potential value. 

The primary challenge we’re observing is that organisations’ data, controls and technology foundations rarely support complex level 3+ use cases. A lot of the disappointment often comes from this complete mismatch between expectation and reality. 

A semantic layer as context for agents 

Levels 1 and 2 tend to be bound in context, and deal with limited ambiguity, such as summarising documents or drafting DDQ responses from an approved library. While more complex use cases usually performed by humans rely on better, broader context and understanding nuances. In capital markets, this involves dealing with unstructured information (plain text documents, email conversations, Bloomberg chats) and alternative sources (satellite imagery, sentiment, job postings), as well as longer running multi-step tasks – think trade break investigation or corporate actions handling. 

This means agents can’t rely solely on specific guides – that requires better context, the right vocabulary and hints on what to look for in these unstructured sources. Organisations successful with level 3+ use cases are investing in a semantic layer that helps agents interpret complex data and understand context, for example, whether “exposure” means gross, net or delta-adjusted, depending on the desk. 

Pertinently, none of this will work if the underlying data is unreliable. Notably, Gartner predicts that through 2026, organisations will have abandoned 60% of AI projects not supported by AI-ready data. 

Shaping actions 

How an action is executed in capital markets matters as much as whether it’s allowed. In 2010, a mutual fund complex hedged a $4.1 billion equity position by selling E-mini futures through an algorithm told to target 9% of market volume, with no limit on price or time. A similar sale had once taken five hours; this one took 20 minutes, and the SEC and CFTC identified it as the trigger for the flash crash.  

Agentic workflows, where agents perform operations on behalf of humans, must know their limits and be constrained by pre-approved actions and tools – for example, querying trusted internal databases rather than searching the open web. Organisations are currently pumping investment into building libraries of approved tools that codify human operations for delegation to agents. 

Limiting the blast radius 

Even with approved tools and clearly defined actions, there’s still a security aspect which must be considered. Many investment firms have relied on coarse-grained permission frameworks for humans, usually based on the role in the organisation which would grant access to a specific set of systems. So an easy route here would be to mirror the exact same RBAC (Role Based Access Control) approach to agents. The challenge is that agents tend to be creative and look for shortcuts which can lead to costly errors. 

Even the smallest of mistakes can have catastrophic consequences. In 2012, Knight Capital lost over $460 million in just 45 minutes after it turned 212 customer orders into more than four million executions. The SEC’s response rested on the Market Access Rule, which requires pre-set controls on erroneous orders and capital thresholds. 

To mitigate this risk, organisations are now deploying policy engines specifically targeted at agents, with fine grained permissions that go beyond what’s done for humans, and a control layer with strict operating windows, for example access granted to agents will only last for the duration of the task they need to perform. 

Bringing it all together: owning your feedback loop 

Regulators are converging towards a common view. FINRA’s 2026 Oversight Report addresses AI agents for the first time, flagging autonomy without human validation and risks around agent access. In the UK, the FCA is relying on existing rules, including SM&CR, which keeps accountability with named individuals. 

To meet these requirements, trace and evaluation need to be present at all levels of the foundational blocks we’ve described (the semantic layer, the approved tools and the security layer). Continuously tracing whilst also evaluating how the system’s performing creates a feedback loop for ongoing improvement. As new workflows migrate over to agentic AI and existing ones are improved, the speed, accuracy and quality of outputs will continually improve. 

Significant focus has been given to frontier models and their capability, but the value organisations can derive from them comes from this feedback loop. It also allows you to compare various models within your own context and business. Agentic systems are not deterministic. That’s their value. They can deal with ambiguity and achieve better outcomes, but they need to be constrained to remain within the boundaries of what’s explainable, legal and correct. Owning the feedback loop – and the foundations that enable it – is becoming the moat.