Somebody has suggested an agent. Perhaps a principal you respect raised it over lunch, or the person who runs your reporting is tired of assembling the same pack every quarter. The suggestion is sensible and the work it names is real: the deal notes, the quarterly letters, the correspondence that arrives faster than anyone reads it.
You did not ask the question everyone else asks, which is whether it works. You have watched enough software to assume it roughly does. What you want to know is narrower. This office keeps the affairs of several people who are related to each other and whose interests are not identical, and some of what you hold, one family member has never been told. Discretion here is the condition on which the office exists rather than a preference to be weighed against convenience.
The question is separation
The ordinary worry about these systems is that one will do something wrong. That worry is manageable, because a wrong thing leaves a mark: a message somebody did not write, a figure nobody recognises, an apology to make. Your people would catch it within the day.
What should occupy you instead is the case where the system does something entirely right. A family member asks a reasonable question and receives an accurate, well-written answer, and part of that answer was assembled from a sibling’s papers, or from a valuation held on behalf of a trust they are not a beneficiary of. Nothing errors. The prose is correct. There is no incident to open and no symptom to notice, because the output is good. You would learn of it, if you learned of it at all, from a remark in a conversation months later.
That failure is not a failure of judgement, and it will not be fixed by a better model. It is a failure of where material was sitting when the search ran. In ArkOne’s reference design for an executive agent, the Cabinet, stored material is searched through the Library: four shelves kept deliberately apart rather than one pile. House knowledge, meaning how the design goes about executive work. The documents of the company or office it works for. Recorded failures, the occasions something went wrong and somebody wrote it down. And material fetched from outside during a piece of work, which keeps the address it came from and the date. The four are recorded on the Register, the standing page of every setting in the design, and the twelfth paper walks them one at a time.
The limit belongs in the same breath, and for an office of your kind it is the whole of the matter. Separation is a property of how material was loaded. A design can keep apart what arrived apart. It cannot recover a distinction that was lost before it ever saw the documents. If a single shared drive holds two family members’ papers in one folder, and that folder is handed over as one body of material, then no setting on any page will pull them back into two. Somebody in your office has to decide which store each thing belongs in, person by person and entity by entity, and that work is yours. No supplier can do it for you, and a supplier who says otherwise is selling a sorting exercise they have not attempted.
Four shelves, and the cost of one crossing
Suppose an office of the sort this page is written for, invented for the exercise: one family, three generations, a holding company, two trusts and a handful of private stakes taken directly. Here are the four shelves as they would stand, with the consequence if two of them were to run together.
| Shelf | What sits on it here | If it crosses onto another shelf |
|---|---|---|
| House knowledge | How a quarterly letter is assembled, what an investment note contains, which questions counsel is asked before a commitment | It begins carrying one family’s arrangements into a general rule, and the rule is then applied to a second family that never agreed to it |
| The office’s own documents | Entity by entity: the holding company’s accounts, each trust’s deeds and valuations, one family member’s personal correspondence | A beneficiary reads a figure belonging to an entity they have no interest in, in an answer that is accurate and properly written |
| Recorded failures | The commitment made on a verbal assurance; the letter that named a holding it should not have | A warning written about one family member’s affairs is quoted, with its detail, into work being done for another |
| Material fetched from outside | A public filing on a co-investor, a press item about a counterparty, each with its address and date | A paragraph from the open web is read as if it were the office’s own record, and a valuation acquires an authority nobody granted it |
Exhibit 2. Illustrative. Four shelves in an office of this kind, and what a crossing between two of them costs.
The second row deserves the minute. Every other row describes something that eventually looks wrong to a reader. That one describes something that looks right: an accurate figure, correctly quoted, in a sentence that reads as though the office prepared it deliberately, sent to a person who had no entitlement to it. The reader has no reason to question it and every reason to act on it.
The fourth row costs less and happens more often. Material fetched during a piece of work keeps the address it came from and stays where it landed, so it can be cited but never quietly promoted into the office’s own record. Where that separation is absent, a press estimate of what a private stake is worth is used in a letter as a valuation, and the office has published a number it did not produce.
One further protection sits inside the search rather than around it. A match beyond the recorded relevance cutoff is discarded and the work reports that it found nothing, on the reasoning that a weak match is worse than none. Its limit cuts against an office like yours: much of what this office knows is not written anywhere, being held by two people who have been here twenty years, so it gets fewer matches, and a design that answers anyway is more dangerous than one that returns empty. The quiet version of that failure is set out in why the pilot failed.
One question, answered twice
Suppose a question the office would actually receive. A family member, a beneficiary of one trust and a director of the holding company, asks what the office thinks about accepting an offer for a private stake. Both answers below are accurate. Only one is proper.
| The part of the answer | With the shelves apart | With the shelves in one pile |
|---|---|---|
| What the stake is worth | The holding company’s own last valuation, named and dated | The same figure, and beside it a figure from the other trust’s recent transaction in a comparable stake |
| What the office thinks of the price | Assembled from the documents this person is entitled to read | Assembled more persuasively, because it draws on what a sibling’s advisers concluded in a similar case |
| What comparable holdings did | A public filing, cited with its address and its date | The same filing, and a private note about another family member’s exit terms, presented in the same voice |
| What the reader learns beyond the answer | Nothing beyond the answer | That a sibling sold, at roughly what, and on whose advice |
Exhibit 3.
The second column is the better answer, and that is the difficulty: more complete, more useful, and graded higher by anybody scoring the writing. Its fourth row is why it cannot be sent, and the fourth row is the only one nobody asked for.
Three smaller parts matter here, each with its limit. Anyone not on the named roster is dropped without a reply, though a roster is a list somebody maintains, and a person who has left is on it until somebody takes them off. Approval rights are named per person rather than per role, with exactly one person able to approve anything at all, which works only while that list is short enough to hold in your head. Nothing is sent outside a person’s working hours and no more than five messages reach one person in an hour, and both rules govern what leaves rather than what was read in order to write it.
The last part is the one your counsel will care about. The Record, the ledger of every action and the reason beside it, is append only: a correction is a new entry and the old one stands. The Minutes, the decisions from a piece of work, are written afterwards by a separate hand. For an office that may be asked in three years what it knew and when, that ledger is the only instrument that answers, and its cost is that a mistaken entry stays visible, corrected beside rather than removed.
What the answers tell you about the vendor
The questions below are worth putting in writing. What follows each is less about the answer being right than about what the shape of the answer reveals. A supplier who has worked with private capital before answers these differently from one who has not, and what differs is which parts they treat as already settled.
Where does each family member’s material sit, and can a single search reach across two of those places. The answer you want names the stores and says plainly that a search is pointed at one of them. What arrives instead, from a supplier who has only ever sold to companies, is that permissions are handled by the platform, or that access is controlled at the document level. Both may be true and neither answers the question, because a permission decides who may open a file and a search decides what is read in order to write a paragraph. The follow-up is one sentence: show me a question asked as one family member where the material that would have answered it best sits on another’s shelf, and let me see what comes back.
Listen for what the answer takes for granted. The number of separate bodies of material is the first thing an office of this kind has to state, and a supplier for whom that is a familiar opening asks for it before discussing anything else. One for whom it is not has assumed a single company with a single set of documents, and hears the question as an unusual requirement rather than as the starting position. Which of those two you are speaking to tells you where your kind of office sits in their experience, and it says nothing at all about their intentions.
Who may the system write to, and what is written down about what it read rather than what it sent. A good answer produces the roster and distinguishes the two ledgers; the twentieth paper is the mechanism behind the first half. The weaker answer describes full audit logging, which is a category rather than a value, and a category cannot be breached. Ask who inside the vendor’s own organisation can open that ledger, and whether their doing so appears in it.
Who may change the instructions, and does the change carry a name. Instructions being editable without a redeployment is a genuine strength, and the reason a tone problem can be corrected the morning after somebody notices it. It also makes them the softest surface in the arrangement. If an unnamed person at the vendor can edit them, every other assurance you hold sits on top of that.
What happens to all of it when we stop. Press for a file, in a stated format, within a stated window, and confirmation of what is destroyed and when. A supplier who has served an office like yours has been asked this on the first call and has a paragraph ready. One who has not treats it as a question for later, which tells you where you sit in their experience.
Where the files already sit
Nothing here needs a supplier or a decision. What would be useful, whenever there is an hour for it, is to look at where this office’s material actually sits today: which drive, which folder, under which set of permissions. Entity by entity, and person by person.
Two things are worth looking for while doing it. Whether the separation this office describes to its counsel is a separation of documents or a separation of storage, because those can stop matching quietly, on the afternoon somebody helpful consolidates a drive, and nothing about the arrangement looks different afterwards. And whether anybody currently holds the whole picture, or whether one person knows where the trusts’ valuations went, another knows the personal correspondence, and nobody has been asked to put the two together.
That picture is worth more than a demonstration. A demonstration shows what a system does with material already sorted. The picture tells you how much sorting this office has never done, and that quantity is the real scope of the work, whatever is eventually built above it. Before you sign is the next thing worth an evening, whenever an evening is free.
component: null
Asked plainly
Can an AI agent keep one family member's affairs separate from another's?
Only if the material was loaded separately in the first place. Separation is a property of how documents were stored, not something a system infers afterwards from names or headings. Ask which store each family member's papers sit in, whether a search can reach across two of them, and what the system returns when nothing on the permitted store matches the question. A design that can come back empty is a design whose confident answers mean something.
What is the real risk of using an AI agent in a family office?
Not a wrong answer, which somebody notices. The risk is an accurate answer built partly from material the reader was not entitled to see. Nothing errors, the prose is correct, and there is no symptom to investigate. That is why the useful questions are about where material sits and what the system writes down, rather than about how well it writes.
Who should be allowed to approve what an AI agent does in a family office?
Name the rights per person rather than per role, and keep the list short. In a well-built design each named person holds specific approval rights, spend bands, onboarding, legal signature among them, and exactly one person may approve anything at all. Write who holds each right, who deputises during leave, and make sure a change to that list appears in the ledger with a name against it.