The exact contents of citations.db main_text.text for this paper — one flattened LaTeX string, title through conclusion, appendix excluded, unmodified except for removing email addresses. This is what our citation measures are computed over.
67,999 characters
AI Governance for Institutional Readiness in Finance
\maketitle
\begin{abstract}
Agentic AI is gaining acceptance in asset management, but governance has not kept pace: 88\% of surveyed finance professionals report no operational governance framework for agentic AI despite universal awareness of its deployment, and only 24 of 75 large U.S. money managers disclosing AI use in Form ADV filings report a formal governance policy. We argue this gap is architectural, not cultural: governance built for deterministic systems assumes static validation. However, continuously retrained agentic policies violate static governance by design. We propose a four-layer framework (Policy, Engineering, Composition, Systemic) with computable instantiations: a regret-covariance statistic that detects policy drift from observed data alone, and a calibrated crowding model showing joint drawdown probability rising from 39.2\% to 79.3\% as institutions converge on correlated exposures. We support the framework with a study of a deployed LLM-embedding trading strategy and a contemporaneous discretionary fund blowup, clarifying which controls transfer across agentic and human-directed risk-taking. We also provide a 90-day framework implementation sequence for institutions.
\end{abstract}
Keywords: Agentic AI, AI governance, Algorithmic trading, Model risk management, Policy drift, Crowding risk, Financial regulation
\section*{Data availability statement}
The synthetic data and code used to produce the worked numerical examples in Sections~\ref{subsec:regret-covariance-example} and
\ref{subsec:crowding-example} (the regret-covariance drift-detection
monitor and the two-agent crowding simulation) are fully synthetic,
generated by the code itself. No proprietary or confidential data were used in these experiments. The informal survey data described in Section~\ref{sec:evidence} were collected via a self-selected LinkedIn poll and are summarized in aggregate only; no individual-level responses were retained. The Form ADV filing data referenced in Section~\ref{sec:evidence} are publicly available from the
U.S. Securities and Exchange Commission's Investment Adviser Public
Disclosure database (\url{https://adviserinfo.sec.gov}).
\section*{Declaration of competing interest}
The authors declare that they have no known competing financial
interests or personal relationships that could have appeared to
influence the work reported in this paper.
\section{Introduction: Awareness Without Action as a Systemic Risk}
\label{sec:introduction}
Consider the following hypothetical scenario: a hedge fund desk deployed an LLM-embedding trading signal eighteen months ago. The signal has performed well: a Sharpe ratio north of 2, consistent with the published literature on this class of strategy. The model retrains monthly on an expanding window. It runs against a licensed third-party embedding model that the hedge fund did not build and does not control. No one on the team has looked at the model's internal weights in over a year.
Three questions follow, and this paper is organized around answering all
three:
\begin{enumerate}
\item \textbf{What does the hedge fund need to monitor, and how often?} The model's live behavior six months after deployment is not guaranteed to resemble the behavior the team validated at launch. Furthermore, unlike a rules-based execution algorithm, there is no fixed decision logic to check against.
\item \textbf{Who is accountable if the vendor changes the underlying embedding model?} A vendor-side model upgrade can shift the strategy's return distribution without tripping any single alert that the hedge fund currently has in place. This can happen because no single component of the pipeline, such as the data feed, the embedding model, or the portfolio construction step, is individually broken.
\item \textbf{What happens if other desks or hedge funds are running the same trade?}
If competitors are training similar models on the same public news feed towards similar objectives, the strategy's true risk may depend on decisions being made on unknown desks that one cannot see, in ways that the fund's own risk process cannot detect.
\end{enumerate}
Most governance frameworks currently in use at asset managers were not built to answer these questions. They were built for algorithmic trading systems with fixed, auditable decision rules. As such, the governance frameworks incorporate rigid pre-, intra-, and post-trade controls that assume the model behaves consistently between validation cycles. An agentic or continuously-retrained system violates that assumption by design. This is not a gap in awareness; our survey evidence below confirms that nearly every finance professional we polled already knows that agentic AI is in production somewhere in their firm. It is a gap in \emph{what to build}: a specific, implementable set of monitoring tools, escalation triggers, and disclosure practices matched to how these systems actually behave in production.
This paper proposes four such tools, organized as layers a firm can adopt incrementally rather than all at once:
\begin{itemize}
\item A \textbf{policy layer} treating the reward function driving an
agentic strategy with the same review rigor as any other risk policy.
\item An \textbf{engineering layer} built around two concrete, computable alarms: a statistical test for whether a live strategy has drifted from its validated behavior (Section~\ref{subsec:layer2}), and a kill-switch tied to model-internal confidence signals rather than a model's self-reported confidence.
\item A \textbf{composition layer} for pipelines, like the
embedding-based strategy above, that depends on third-party components no single audit can fully see into.
\item A \textbf{systemic layer} for the crowding risk that emerges only when a unit's governance process is compared against everyone else's.
\end{itemize}
Survey evidence shows that finance professionals are almost universally aware of agentic AI deployment, yet a large majority report having no operational governance process for it. This is not the profile of a technology that institutions have failed to notice; it is the profile of a technology whose governance requirements are not yet well understood enough to act on.
Agentic systems, particularly those incorporating reinforcement learning or continuously retrained statistical learning, update their decision policies in production. The longer a firm operates without governance, the further the live system drifts from whatever baseline was validated at deployment. This paper (i) quantifies the governance gap with survey and regulatory evidence; (ii) identifies, formally, four failure modes that defeat governance frameworks built
for deterministic systems; (iii) proposes a layered governance architecture; and (iv) grounds Layers 2.5 and 3 in a concrete, currently-deployed class of strategy: LLM-embedding-based news trading, as documented empirically by \citet{didisheim2026news}.
For each layer, We present a concrete, currently-deployed example, the
LLM-embedding news-trading strategy sketched above, documented empirically by \cite{didisheim2026news}. Section~2 quantifies
how wide the awareness-to-governance gap actually is, using both survey
evidence and Form ADV disclosure data. Sections~3--4 lay out why existing frameworks fail and what should replace them. Section~5 gives a 90-day implementation sequence. A reader managing the strategy described above should be able to leave this paper with a specific answer to each of the three questions posed here.
\section{Related Work}
\label{sec:related-work}
This paper draws on and departs from four largely separate literature streams:
\begin{itemize}
\item traditional model risk management in finance;
\item market microstructure and systemic crowding risk;
\item AI safety research on reward hacking and policy drift; and
\item the emerging body of regulatory guidance on AI in capital markets.
\end{itemize}
Each stream addresses part of the problem posed in Section~\ref{sec:introduction}; none addresses all of it jointly, which is the gap that this paper's four-layer framework is designed to close.
\subsection{Traditional Model Risk Management in Finance}
\label{subsec:related-mrm}
Model risk management, as currently practiced, traces back to supervisory guidance issued in the wake of the 2007–2009 financial crisis, principally SR 11-7 \citep{sr11-7} and its international analogs. This approach requires independent validation of a model's conceptual soundness, ongoing monitoring, and outcomes analysis. The regime assumes, largely implicitly, that a validated model produces stable, auditable outputs between periodic review cycles. In Section~\ref{sec:why-frameworks-fail}, we argue that this assumption is structurally violated by continuously or periodically-retrained agentic systems. Basel Committee guidance on operational and model risk extends this logic to a broader set of quantitative risk models but shares the same static-validation premise. Pre-, intra-, and post-trade rules engines, the dominant governance technology for algorithmic execution over the past two decades, sit within this same tradition: they constrain \emph{what} a system is permitted to do, not whether the policy generating its decisions has drifted from what was validated.
\subsection{Market Microstructure, Real-Time Risk, and Systemic Crowding}
\label{subsec:related-microstructure}
A separate literature examines how automated and high-frequency trading systems fail in production, independent of any formal governance question. \citet{realtimerisk} argues that the compression of decision and execution into microsecond timeframes has outpaced traditional, periodic risk-management cycles and calls for risk monitoring architected to operate at the same time scale as the trading systems it governs. As such, \citet{realtimerisk} is a precursor, in spirit, to this paper's Layer 2 requirement that policy-stability monitoring be continuous and real-time rather than being reviewed on a fixed audit calendar. \citet{kirilenko2017flashcrash} provide the canonical empirical account of a single-day systemic event (the May 6, 2010 Flash Crash) driven by the interaction of automated trading strategies under stress, showing that intermediaries did not change their behavior as prices fell. This finding is directly relevant to this paper's Layer 2 argument that automated systems can behave exactly as designed at the component level while producing a systemically destabilizing aggregate outcome. \citet{khandanilo2007} document the closest empirical precedent to this paper's Layer 3 crowding mechanism: the August 2007 "Quant Meltdown," in which the forced deleveraging of one or more large quantitative equity portfolios propagated losses across many independently-managed, similarly-constructed long/short equity funds that had no formal connection to one another, through a purely market-mediated (price-impact) channel rather than any shared governance failure. This is the pre-AI, human-strategy analog of the mechanism Section~\ref{subsec:layer3} formalizes for agentic strategies trained on shared public data.
\subsection{AI Safety: Reward Hacking and Policy Drift}
\label{subsec:related-ai-safety} \label{subsec:var-drift}
A distinct literature, originating outside finance, formalizes the failure mode that this paper's Layer 1 and Layer 2 are built to govern. \citet{amodei2016concrete} define frame reward hacking as an agent finding an unintended way to maximize a proxy objective that diverges from the designer's true intent. Reward hacking is one of a small set of concrete, near-term AI safety problems requiring engineering solutions rather than philosophical ones. \citet{skalse2022reward} formalize this concern, providing a precise definition of when a proxy reward function is "hackable" relative to a true objective and showing that, absent restrictive assumptions, most proxy/true reward pairs are hackable in principle. This paper's Layer 1 requirement that a reward function receive the same review rigor as any other risk policy prior to deployment operationalizes this literature's central finding for a financial setting. An unreviewed reward function is not a training-time technicality but a governance object whose specification determines whether the deployed system's incentives are aligned with the institution's actual risk tolerance. This literature has, to date, developed largely independently of financial model risk management (Section~\ref{subsec:related-mrm}); one contribution of this paper is to translate its concepts (proxy objectives, policy drift, hackability) into the vocabulary and institutional structures (SR 11-7-style review, kill-switch architecture) within which finance risk functions already operate.
\subsection{Regulatory and Policy Frameworks for AI in Finance}
\label{subsec:related-regulatory}
Regulators and standard-setters have begun to address agentic and AI-driven financial systems directly, though largely at the level of principles rather than implementable controls. IOSCO's 2021 report on AI and machine learning use by market intermediaries and asset managers \citep{iosco2021} and its 2025 follow-up on AI in capital markets \citep{iosco2025}, the latter explicitly extending its scope to generative and agentic AI, both identify governance gaps consistent with this paper's survey evidence (Section~\ref{sec:evidence}), but stop short of proposing a layered, implementable architecture. The EU AI Act \citep{euaiact2024} introduces a risk-tiered regulatory structure that classifies AI systems by application domain and potential for harm, offering a coarse-grained analog to this paper's Agentic Risk Score (Section~\ref{subsec:taxonomy}), but calibrated for cross-sectoral regulation rather than for the specific dynamics of continuously-retrained financial strategies. The NIST AI Risk Management Framework \citep{nistairmf2023} proposes a general-purpose govern/map/measure/manage lifecycle applicable across industries. This framework is a natural complement to, rather than a substitute for, the finance-specific mechanisms (regret-covariance monitoring, vendor-version attestation, policy-similarity disclosure) this paper develops in Sections~\ref{subsec:layer2}--\ref{subsec:layer3}, since none of these general frameworks specify a computable, model-free statistic for detecting policy drift in a deployed financial strategy.
\subsection{LLM-Native Financial Strategies}
\label{subsec:related-llm-finance}
A recent and fast-growing literature documents financial strategies whose signal generation depends directly on large language models, rather than on LLMs as a research aid. \citet{didisheim2026news} construct and empirically validate the LLM-embedding news-trading strategy (MSRR) used as this paper's Layer 2.5/3 case study (Section~\ref{subsec:msrr-case-study}), and \citet{he2025chronological} establish the chronological-consistency methodology. This methodology ensures that an LLM's apparent predictive power is not an artifact of training-data lookahead. \cite{didisheim2026news} apply this methodology, and we use it as well as evidence that vendor model-version attestation (Section~\ref{subsec:msrr-case-study}) is necessary but not sufficient Layer 2.5 due diligence. \citet{chen2026uncertainty} develop the inner-confidence quantification method we use in Layer 2 kill-switch architecture (Section~\ref{subsec:layer2}). The methodology addresses a problem specific to LLM-based decision systems: that declared model confidence is unreliable. The methodology has no analog in traditional model risk management, since a linear regression or a decision tree has no equivalent "declared confidence" to distrust.
\subsection{Positioning of This Paper}
\label{subsec:related-positioning}
Table~\ref{tab:related-work-comparison} summarizes the coverage gap that this paper's four-layer framework is designed to close: each existing literature or framework addresses one or two of the four governance dimensions this paper identifies (policy-level objective review, engineering-level real-time monitoring, cross-component composition risk, and cross-institutional systemic risk), but none addresses all four jointly, and none provides a computable, finance-specific instantiation of each layer.
\begin{table}[h]
\centering
\caption{Coverage of existing frameworks and literatures against this paper's four governance layers}
\label{tab:related-work-comparison}
\begin{tabular}{lcccc}
\toprule
Framework / literature & Layer 1 & Layer 2 & Layer 2.5 & Layer 3 \\
& (Policy) & (Engineering) & (Composition) & (Systemic) \\
\midrule
SR 11-7 / Basel model risk management & partial & partial & no & no \\
Pre/intra/post-trade rules engines & no & partial & no & no \\
Real-Time Risk \citep{realtimerisk} & no & partial & no & no \\
Flash Crash / crowding literature \citep{kirilenko2017flashcrash,khandanilo2007} & no & no & no & yes (empirical, non-AI) \\
AI safety / reward hacking \citep{amodei2016concrete,skalse2022reward} & yes & partial & no & no \\
EU AI Act \citep{euaiact2024} & partial & no & no & no \\
NIST AI RMF \citep{nistairmf2023} & partial & partial & partial & no \\
IOSCO AI reports \citep{iosco2021,iosco2025} & partial & partial & partial & partial \\
\textbf{This paper} & \textbf{yes} & \textbf{yes} & \textbf{yes} & \textbf{yes} \\
\bottomrule
\end{tabular}
\end{table}
The model risk management literature (Section~\ref{subsec:related-mrm}) supplies the institutional review discipline that Layer 1 borrows, but does not provide a mechanism for real-time drift detection. The market microstructure literature (Section~\ref{subsec:related-microstructure}) documents crowding and systemic propagation empirically, but focuses on human-strategy portfolios rather than agentic systems and lacks a governance response. The AI safety literature (Section~\ref{subsec:related-ai-safety}) formalizes the drift and reward-hacking mechanisms that Layer 1 and Layer 2 are designed to catch, but it was not developed with financial regulatory structures (SR 11-7-style review, kill-switch architecture tied to trading limits) in mind. The regulatory frameworks (Section~\ref{subsec:related-regulatory}) identify the governance gap at the level of principle, consistent with this paper's own survey evidence, but do not provide implementable, computable controls. The LLM-native finance literature (Section~\ref{subsec:related-llm-finance}) supplies the empirical ground truth, which is an economically large, currently deployed strategy class. This is the ground truth against which this paper validates Layers 2.5 and 3, but it was not written as a governance contribution. This paper's four-layer framework is, to our knowledge, the first to unify these strands into a single, computable, finance-specific architecture spanning reward-function review, real-time drift monitoring, cross-vendor composition risk, and cross-institutional crowding disclosure.
\section{Evidence of the Governance Gap}
\subsection{Survey Evidence}
\label{sec:evidence}
An informal LinkedIn poll of finance professionals (May 2026) found that 88\% report no operational governance framework for agentic AI, while 0\% report being unaware of agentic AI deployment in their institution or industry. The self-selected sample plausibly skews toward AI-attentive respondents, so the true gap across the industry is likely wider, not narrower, than 88\%.
\subsection{Regulatory Disclosure Evidence}
Of 100 of the largest U.S.\ money managers examined via Form ADV filings, 75 disclosed some form of AI use; of those, only 24 (32\%) disclosed an accompanying formal governance policy.
\subsection{What "Governance" Currently Means in Practice}
Pre-, intra-, and post-trade rules engines have governed algorithmic trading for roughly two decades. This is rigorous governance of \emph{deterministic} systems. The current paper discusses the governance of agentic systems. The behavior of agentic systems six months after deployment may not be fully described by the rules that were appropriate at the time of deployment.
\section{Why Existing Governance Frameworks Fail for Agentic Systems}
\label{sec:why-frameworks-fail}
\subsection{The Static Assumption}
Traditional model risk management (SR 11-7 and successors) assumes a validated model produces consistent outputs for consistent inputs between validation cycles. An RL agent, or any continuously or periodically-retrained policy, violates this by design.
\subsection{VaR and the Policy Drift Problem}
VaR-style frameworks bound the loss distribution of systems with fixed decision logic. When the decision logic is not fixed, this is a structural mismatch, not a parameter-estimation problem.
\subsection{Rules Engines Are Necessary but Not Sufficient}
Pre/intra/post-trade controls remain the hard outer boundary on agent behavior, but they do not evaluate \emph{intent}. Reward hacking operates entirely within rules-engine bounds.
\subsection{The Compliance-as-PDF Problem}
Governance is an engineering property, not a compliance document: nothing in an agentic system's execution path enforces a policy document the moment the underlying policy updates.
\subsection{A Formal Agentic Risk Taxonomy}\label{subsec:taxonomy}
We propose four ordinal dimensions, each scored 1--3: Autonomy ($A$), Reversibility ($R$), Blast Radius ($B$), and Policy Mutability Rate ($M$), combined into a composite Agentic Risk Score
\[
\mathrm{ARS}(s) = w_A A(s) + w_R R(s) + w_B B(s) + w_M M(s), \qquad \mathrm{ARS}(s)\in[1,3],
\]
with institution-specific weights $w_A,w_R,w_B,w_M$ summing to one and $\mathrm{ARS}(s)\ge 2.5$ proposed as a provisional threshold for mandatory Layer 2 controls.
\begin{table}[h]
\centering
\caption{Illustrative taxonomy scoring, extended with the news-anomaly case study (Section~4.5)}
\begin{tabular}{lcccc}
\toprule
System & $A$ & $R$ & $B$ & $M$ \\
\midrule
Pre/intra/post-trade rules engine & 1--2 & 2 & 2 & 1 \\
Single RL trading agent, online policy updates & 3 & 2--3 & 2 & 3 \\
Multi-module content pipeline & 2--3 & 3 & 1--2 & 2 \\
\textbf{LLM-embedding news strategy (MSRR)} & \textbf{1--2} & \textbf{2} & \textbf{2--3} & \textbf{2} \\
\bottomrule
\end{tabular}
\end{table}
\subsection{Policy Drift Under Adversarial Input Distributions}
\label{subsec:adversarial-drift}
A model's behavioral guardrails, calibrated against a standard input distribution, can fail once inputs are drawn from an adversarial distribution. We propose an experimental protocol (bypass rate by perturbation type, with confidence intervals) for Layer 2 certification.
\subsection{Compositional Risk: Emergent Failure Across Validated Components}
Even when every individual component of a multi-module pipeline is validated and behaves exactly as specified, the \emph{composition} of components can produce an outcome that no component-level audit would surface, because the unit of analysis that fails is the pipeline,
not any single model.
\section{A Four-Layer Framework for Agentic AI Governance}
\subsection{Layer 1: Policy Layer (What You Intend)}
\label{subsec:layer1}
The reward function is the mathematical expression of institutional intent and should receive the same review, approval, and version control as any other risk policy document.
\subsection{Layer 2: Engineering Layer (What You Enforce)}
\label{subsec:layer2}
We require (a) policy stability monitoring, (b) compliance agents, and (c) kill-switch architecture. Policy stability monitoring can be implemented model-free via the regret-covariance
decomposition of \citet{aldridge2026b}, extending \citet{aldridge2026a}:
\[
\mathrm{Regret}^{(T)}(\Pi) = \sum_{t=1}^{T}\mathrm{Cov}(c_t,\hat\pi_t(c_t)) + \sum_{t=1}^{T}\bar c_t^\top b_t,
\]
computable from observed costs and decisions alone, with no access to an agent's internal state. This approach allows an institution to calculate the regret even when running a vendor-supplied or vendor-embedded strategy (see Section~4.5). Kill-switch triggers should be built on \emph{inner} rather than \emph{declared} LLM confidence, per \citet{chen2026uncertainty}, since declared confidence is biased by the decoding process, while inner (pre-decoding) confidence is empirically informative about realized accuracy.
\subsubsection{Worked Numerical Example: Detecting Policy Drift via Regret-Covariance}
\label{subsec:regret-covariance-example}
The property Layer 2 requires when an institution runs a vendor-supplied or otherwise opaque policy. To demonstrate that Regret$^{(T)}(\Pi)$ is genuinely computable from observed data alone, we construct a synthetic environment with a known, unmonitored change point and show that the statistic detects it.
\paragraph{Synthetic environment.} Over $T=500$ periods, we generate a realized cost shock $c_t \sim \mathcal{N}(0,1)$ and a decision signal $\hat\pi_t(c_t)$. Before $t=300$, decisions are independent of the contemporaneous cost draw, representing a validated, non-reactive policy. From $t=300$ onward, the policy begins reacting to the realized cost signal,
\[
\hat\pi_t(c_t) = \gamma\, c_t + \eta_t, \qquad \gamma = 1.2,\ \ \eta_t \sim \mathcal{N}(0, 0.5^2),
\]
a stylized form of reward hacking: the system has learned to condition its sizing on recently realized slippage in a way that was never validated. This change is invisible to a simple output-level P\&L check since it manifests only as a shift in the \emph{co-movement} between costs and decisions.
\paragraph{Estimator.} Since a single-period covariance is undefined for one draw, we implement $\sum_t \mathrm{Cov}(c_t, \hat\pi_t(c_t))$ as a trailing $W$-period sample covariance, $W=20$:
\[
\widehat{\mathrm{Cov}}_t = \mathrm{Cov}\big(\{c_\tau\}_{\tau=t-W}^{t-1},\ \{\hat\pi_\tau\}_{\tau=t-W}^{t-1}\big),
\]
computed at every $t$ from the observed cost and decision series only. The baseline drag term $\bar c_t^\top b_t$ is held fixed at a small constant (0.02) in this example, isolating the drift-detection behavior of the first term. Algorithm~\ref{alg:layer2-monitor} summarizes the resulting Layer 2 monitor.
\begin{algorithm}[h]
\caption{Layer 2 policy-stability monitor (regret-covariance)}
\label{alg:layer2-monitor}
\begin{algorithmic}[1]
\STATE \textbf{Input:} observed cost series $\{c_t\}$, decision series $\{\hat\pi_t\}$, window $W$, baseline drag $\bar c_t^\top b_t$, validated-regime calibration window
\STATE Compute $\{\widehat{\mathrm{Cov}}_t\}$ via trailing $W$-period sample covariance of $(c_t, \hat\pi_t)$
\STATE $\mathrm{Regret}_t \leftarrow \widehat{\mathrm{Cov}}_t + \bar c_t^\top b_t$
\STATE Calibrate trigger level $\tau \leftarrow \mu_{\text{validated}} + k\cdot\sigma_{\text{validated}}$ from a known-validated calibration window
\FOR{each new period $t$}
\IF{$\mathrm{Regret}_t > \tau$}
\STATE raise drift alarm; escalate to Layer 1 review
\ENDIF
\ENDFOR
\end{algorithmic}
\end{algorithm}
\paragraph{Result.} The statistic remains flat and near zero throughout the validated regime and rises sharply immediately after the change point at $t=300$ (Figure~\ref{fig:layer2-regret}). Table~\ref{tab:layer2-results} reports the summary statistics. With a trigger threshold set at the validated-regime mean plus $k=4$ standard deviations, the monitor raises its first alarm 11 periods after true drift onset. Importantly, the drift onset is detected purely from the observed cost/decision time series, with no access to the policy's internal parameters.
\begin{table}[h]
\centering
\caption{Regret-covariance monitor: summary statistics}
\label{tab:layer2-results}
\begin{tabular}{lc}
\toprule
Quantity & Value \\
\midrule
Mean statistic, validated regime ($t<300$) & 0.124 \\
Mean statistic, drifted regime ($t\geq300$) & 1.154 \\
Ratio (drifted / validated) & 9.3$\times$ \\
Trigger level ($\mu_{\text{validated}} + 4\sigma_{\text{validated}}$) & 0.913 \\
True drift onset & $t = 300$ \\
First alarm at or after onset & $t = 311$ \\
Detection latency & 11 periods \\
\bottomrule
\end{tabular}
\end{table}
\begin{figure}[h]
\centering
\includegraphics[width=0.85\textwidth]{figures/layer2_regret_covariance.png}
\caption{Top: observed cost shock $c_t$ and decision signal $\hat\pi_t$; the true (monitor-unobserved) drift onset at $t=300$ is marked. Bottom: the resulting rolling regret-covariance statistic, computed from the observed series alone, rises sharply at drift onset.}
\label{fig:layer2-regret}
\end{figure}
This synthetic example is a calibrated illustration, not a claim to reproduce any specific vendor model's internal behavior; the parameters ($W$, $\gamma$, $k$) are stated explicitly and can be re-swept against real cost/decision data by an adopting institution.
\subsection{Layer 2.5: Interface and Composition Validation}
Compositional risk does not fit cleanly into Layers 1, 2, or 3, each defined at the level of a single agent. Layer 2.5 takes the \emph{pipeline} as its unit of governance, with four requirements: (1) pipeline-level adversarial red-teaming at the entry point, evaluated at the exit point; (2) interface contracts with explicit exclusion lists; (3) joint-output sampling in production, scaling with the pipeline's ARS; and (4) a named accountable owner for the composition, distinct from component owners.
\subsection{Layer 3: Systemic Layer (What You Contribute To)}
\label{subsec:layer3}
Firm-level governance cannot mitigate risks that manifest only at the market level. When multiple firms train agents on similar, heavily overlapping data toward a similar Sharpe-style objective, position correlation is roughly stable across regimes, but \emph{joint drawdown
risk} rises sharply under stress, from 39.2\% to 79.3\% in our calm-vs-stress simulation. This change is caused by a common stress signal overwhelming small differences in independently learned policy
parameters.
\subsubsection{Worked Numerical Example: Calibrating the Calm-versus-Stress Crowding Simulation}
\label{subsec:crowding-example} \label{subsubsec:msrr-layer3}
We construct a minimal structural model reproducing the calm-vs-stress joint drawdown figures reported in Section~\ref{subsec:layer3} (39.2\% calm, 79.3\% stress) to make explicit both the mechanism and the parameters underlying the claim.
\paragraph{Structural model.} Two agents' per-period returns are driven by a shared public factor plus idiosyncratic noise.
\[
r_{i,t} = \mu + \beta\, F_t + \sqrt{1-\beta^2}\,\varepsilon_{i,t}, \qquad i \in \{1,2\},
\]
where $F_t \sim \mathcal{N}(0,1)$ represents a shared public signal (e.g., a common news feed that both agents' strategies condition on), $\varepsilon_{i,t}\sim\mathcal{N}(0,1)$ are independent idiosyncratic shocks, $\mu$ is a regime-level mean shift, and $\beta \in [0,1]$ is each agent's loading on the shared factor. Since $\mathrm{Corr}(r_1,r_2)=\beta^2$, $\beta$ is the model's crowding parameter: it captures the share of each agent's return explained by the same signal that other agents are also trading on. A drawdown is defined as $r_{i,t}<0$.
\paragraph{Calibration.} We solve for $(\mu,\beta)$ in each regime so that the analytic bivariate-normal joint-breach probability matches the target figures exactly, then confirm the match via Monte Carlo simulation ($n=10^6$ draws) of the structural model above. I.e., the simulation is mechanistic (shared-factor loading), not merely a probability calculation. Individual (marginal) breach probability is set higher in the stress regime (0.85 vs.\ 0.60), reflecting that a genuine stress regime is, by construction, one in which the shared factor itself is realized adversely for a crowded position. Table~\ref{tab:layer3-calibration} reports the calibrated parameters and the resulting Monte Carlo match to target.
\begin{table}[h]
\centering
\caption{Two-agent crowding simulation: calibration and results}
\label{tab:layer3-calibration}
\begin{tabular}{lccccc}
\toprule
Regime & $\mu$ & $\beta$ & Implied corr.\ ($\beta^2$) & Target joint prob. & MC joint prob. \\
\midrule
Calm & $-0.253$ & $0.460$ & $0.212$ & 39.2\% & 39.1\% \\
Stress & $-1.036$ & $0.901$ & $0.812$ & 79.3\% & 79.2\% \\
\bottomrule
\end{tabular}
\end{table}
\paragraph{Result.} Going from the calm to the stress regime, each agent's loading on the shared public signal rises from $\beta\approx0.46$ to $\beta\approx0.90$ (implied return correlation from $\approx0.21$ to $\approx0.81$), compounding with a regime-level mean shift to produce the reported jump in joint drawdown probability (Figure~\ref{fig:layer3-scatter}). This is the mechanism described narratively in Section~\ref{subsec:layer3}: it is not that either agent's idiosyncratic behavior changes, but that a larger share of each agent's return becomes explained by the \emph{same} shared signal. Training on a common public news feed toward similar objectives produces this result (Section~\ref{subsec:msrr-case-study}).
\begin{figure}[h]
\centering
\includegraphics[width=0.95\textwidth]{figures/layer3_crowding_simulation.png}
\caption{Joint return distribution of two agents under the calm regime (left) and stress regime (right), $n=4{,}000$ simulated draws shown. Points in the lower-left (joint drawdown) quadrant are highlighted; the increase in density there reflects the rise in shared-factor loading $\beta$, not a change in either agent's marginal risk in isolation.}
\label{fig:layer3-scatter}
\end{figure}
\paragraph{Sensitivity.} To show that the calibration is not a two-point artifact, Figure~\ref{fig:layer3-sensitivity} sweeps $\beta$ continuously (holding the stress-regime mean shift fixed) and plots the resulting joint drawdown probability. Joint tail risk is sharply convex in crowding intensity: a moderate increase in shared signal reliance produces a disproportionate increase in systemic joint-loss probability. This probability is the empirical basis for Layer 3's disclosure requirement: a firm's own risk process cannot observe $\beta$ directly, since it depends on how many other institutions are exposed to the same shared signal.
\begin{figure}[h]
\centering
\includegraphics[width=0.75\textwidth]{figures/layer3_crowding_sensitivity.png}
\caption{Joint drawdown probability as a continuous function of the common-factor loading $\beta$ (stress-regime mean shift held fixed). The two calibrated calm/stress points from Table~\ref{tab:layer3-calibration} are marked.}
\label{fig:layer3-sensitivity}
\end{figure}
As with Section~\ref{subsec:regret-covariance-example}, this is a transparent, calibrated reconstruction of the reported figures under explicitly stated assumptions. This is consistent with our characterization of the Section~\ref{subsec:layer3} simulation as illustrative (Section~\ref{sec:limitations}), rather than being a claim to recover an unpublished original methodology.
\subsection{Case Study: The LLM-Embedding News Anomaly as a Layer 2.5/3 Illustration}
\label{sec:newscase}\label{subsec:msrr-case-study}
Sections 4.3 and 4.4 motivate Layer 2.5 and Layer 3 with, respectively, a stylized multi-module pipeline and a minimal simulated two-agent market. \citet{didisheim2026news} provide a real, economically large, and fully documented instance of exactly the system these layers are
designed to govern, which we use here to make both layers concrete.
\subsubsection{System description and taxonomy scoring}
\citet{didisheim2026news} construct a long-short equity strategy ("MSRR") that trades on the residual, or "pure," component of LLM-derived news-article embeddings after purging the embeddings of content predictable from standard stock characteristics. The strategy is
periodically retrained on an expanding window (an initial 24-month window, refit monthly thereafter), achieves an out-of-sample Sharpe ratio of 3.1 over 1996--2022, which is roughly twice the
strongest individual anomaly in the \citet{jensen2022replication} (JKP) universe. The strategy is also \emph{monotonically increasing in the parameter count of the underlying embedding model}, rising
from a Sharpe ratio of 1.5 with a 110-million-parameter BERT encoder to 4.1 with a 405-billion-parameter Llama3 model. Turnover is 75\%, exceeding every JKP factor.
Scored against our taxonomy (Table~1): autonomy is low-to-moderate ($A=1$--$2$) in the paper's own implementation, since portfolio weights are generated for trade decisions rather than being auto-executed. However, $A$ rises to 3 the moment an institution wires MSRR output directly into an execution algorithm, which is the natural deployment path for a signal of this magnitude. Reversibility is moderate ($R=2$): positions can be unwound, but only at a cost that scales with time-to-detection, and the strategy's own turnover and trading-cost analysis shows that net performance is highly sensitive to embedding-lookback choices because rapid signal decay makes timely unwinding economically important. Blast radius is firm-wide at a minimum and plausibly market-wide ($B=2$--$3$) once multiple institutions adopt the same class of strategy, for the reason developed below. Mutability is periodic ($M=2$): the policy updates on an auditable, expanding-window cadence rather than continuously within the production loop, placing it between the static rules engine and the online RL agent in Table~1. Note that $M=2$ rather than $M=1$ is sufficient to defeat a governance regime built only for static models, since the embedding model itself (Section~4.5.2 below) can change on a vendor's schedule that the deploying institution does not control and may not observe.
\subsubsection{Layer 2.5: a concrete instance of multi-vendor compositional risk}
The MSRR pipeline is structurally a multi-module composition that motivates Layer 2.5: a data-retrieval/ingestion stage (news feed), an embedding stage (a third-party LLM: the paper itself documents results across BERT, GPT-2, Mistral-7B, and the Llama3 family at
8B/70B/405B parameters), a residualization stage (regression against stock characteristics), and a portfolio-construction stage (the MSRR optimization). \citet{didisheim2026news} treats the choice of embedding model as a robustness check; from a governance perspective, it is the
clearest illustration available of why Section~3.7's component-level audit is structurally insufficient. Each stage, audited in isolation, is unremarkable: the embedding model is a standard third-party encoder used as advertised, the residualization is an ordinary panel
regression, and the portfolio optimization is a textbook mean-variance estimator. The \emph{composed} pipeline, however, produces a return stream whose magnitude and behavior depend materially and nonlinearly on a component that the deploying institution typically does not control
and frequently cannot inspect: the internal weights of the vendor's embedding model. A vendor-side model upgrade, the kind of change a deploying institution would not necessarily be informed of, let alone approve, can alter the joint output distribution of the pipeline without
tripping any single-component drift monitor, exactly the failure mode Layer 2.5's joint output-sampling requirement (Section~4.3.2, item 3) is designed to catch. We therefore add a fifth Layer~2.5 requirement, motivated directly by this case: \emph{vendor model-version attestation}, under which any agentic pipeline that depends on a third-party foundation model must log the vendor's model identifier and version for every production inference, so that a performance discontinuity can be traced to a vendor-side update rather than misattributed to market regime change.
A second, related observation concerns lookahead bias. \citet{didisheim2026news} show, following \citet{he2025chronological}, that point-in-time and full-foresight versions of a chronologically
consistent LLM produce statistically indistinguishable strategy performance, while replacing a small academic model with an industrial-scale model roughly doubles the Sharpe ratio. This is direct evidence for a claim Layer 1 and Layer 2 make on first principles: an agentic financial system's behavior is not fully characterized by testing its training data provenance alone; two models with identical training data vintage but different scales produce materially different live performance, so model-card-style attestation of training data cutoff, while necessary, is not sufficient Layer 2 due diligence for a vendor-supplied component.
\subsubsection{Layer 3: crowding as observed cross-institutional correlation}
Section~4.4's worked example is a toy simulation because no firm observes another firm's live agent. The news-anomaly literature offers an observable proxy for that unobserved correlation. \citet{didisheim2026news} report that the rolling five-year Sharpe ratio of the pure news strategy, which ranged between roughly 2.1 and 4.5 over the full sample, drifts down from peaks near 4.5 to the 2.1--2.5 range in the years following the introduction of widely available
transformer-based embedding models (post-2018), and attribute this decline to LLMs aiding the integration of news-based information into asset managers' portfolios more broadly, i.e., to crowding. This is the mechanism formalized in Section~4.4: as more institutions deploy
agents trained on the same public news feed toward closely related Sharpe-style objectives, the strategies' returns become more correlated in aggregate even though no single firm observes the others' agents, and the market-level consequence (return decay, and by the logic of
Section~4.4.1, synchronized drawdown risk in stress regimes) is not visible to, or addressed by, any individual firm's governance process. A firm evaluating its own MSRR-style strategy in isolation, using only Layers 1 and 2, would correctly validate the reward function and the
execution controls, but would have no mechanism for detecting that its strategy's true risk profile depends on how many \emph{other} institutions are running a similar strategy against the same news feed. This is the gap Layer 3's policy-similarity disclosure regime is designed to close. We propose that the disclosure regime of Section~4.4 explicitly include as a reportable field the identity and provider of any third-party news or embedding feed on which a firm's agentic strategies depend. Shared upstream data (not merely a shared reward objective) is an independent and observable channel of cross-institutional correlation that this case study makes newly visible.
\subsubsection{Implications}
Taken together, the news-anomaly case study demonstrates that Layers 2.5 and 3 are not just speculative extensions motivated only by hypothetical multi-agent pipelines. The strategy class that is already deployed, economically large (Sharpe ratios exceeding 3, net of realistic trading costs after lookback smoothing), dependent on opaque third-party foundation models, and exhibiting the return decay signature of crowding has positioned itself inside the taxonomy's $M=2$, $B=2$--$3$ region this paper identifies as requiring mandatory Layer~2 and Layer~2.5 controls under a $w$-weighting that gives any material weight to vendor dependency or blast radius.
\subsection{Case Study Three: The Situational Awareness Blowup as a Layer 1/3 Illustration, and the Limits of Layer 2}
\label{subsec:sa-case-study}
Section~\ref{subsec:msrr-case-study} positioned Layers 2.5 and 3 in an agentic pipeline. Here, we consider a contemporaneous event that impacts Layers 1 and 3 from a different angle. It is instructive because the process shows where this paper's Layer 2 controls \emph{do not} apply, which sharpens the case for treating Layer 2 as a distinct, non-substitutable layer.
\subsubsection{System description}
Situational Awareness LP, founded in 2024 by former OpenAI researcher Leopold Aschenbrenner, is a discretionary hedge fund built around a single thesis: that the continued scaling of compute and algorithmic efficiency makes AGI by approximately 2027 sufficiently plausible to justify concentrated, leveraged exposure to the AI infrastructure buildout — long chips, memory, data centers, and power; short software incumbents viewed as vulnerable to AI-driven disruption.\footnote{Disruption Banking, July 30, 2026.} The fund is not an agentic or algorithmic trading system in the sense governed by Layers 1–2.5 of this paper: positions are set by human portfolio managers on a discretionary, thesis-driven basis, not generated by a retrained policy or an autonomous agent. This distinction matters for what follows.
By early July 2026, the fund had grown to a reported peak of roughly \$45 billion in assets under management, up approximately 450\% year-to-date, with a Financial Times-reviewed investor letter reporting a 439\% net return for H1 2026.\footnote{Disruption Banking, July 30, 2026, citing Financial Times investor letter dated July 24, 2026.} Reported leverage on the public book ran as high as 4x (400\%).\footnote{CNBC, July 31, 2026; social-media reporting on the fund's timeline.} A sharp reversal in AI infrastructure names began around July 10 and was variously described as triggered or signaled by the SK Hynix U.S. IPO. Th reversal produced a two-week selloff in which many AI-adjacent equities fell 30\% or more.\footnote{CNBC, July 31, 2026.} The leveraged book generated margin calls on both the long and short legs simultaneously, and the fund was forced to sell its entire public equity portfolio in a block trade to Citadel at a discount; reported AUM fell from \$45 billion to approximately \$10 billion within weeks.\footnote{Bloomberg, July 30, 2026; CNBC, July 30--31, 2026.} The fund retained its unlevered and private holdings (including stakes in Anthropic and other AI infrastructure names) and remained up substantially year-to-date despite the forced sale.\footnote{CNBC, July 31, 2026.}
\subsubsection{Taxonomy scoring, and why it differs in kind from the MSRR case}
Scored against the taxonomy of Section~\ref{subsec:taxonomy}, Situational Awareness sits almost nowhere near the MSRR strategy of Section~\ref{subsec:msrr-case-study}, and the difference is the point:
\begin{table}[h]
\centering
\caption{Taxonomy scoring extended with the Situational Awareness case study}
\label{tab:taxonomy-extended}
\begin{tabular}{lcccc}
\toprule
System & A & R & B & M \\
\midrule
Pre/intra/post-trade rules engine & 1--2 & 2 & 2 & 1 \\
Single RL trading agent, online policy updates & 3 & 2--3 & 2 & 3 \\
LLM-embedding news strategy (MSRR) & 1--2 & 2 & 2--3 & 2 \\
Situational Awareness (discretionary, levered thesis fund) & 1 & 2--3 & 3 & 1 \\
\bottomrule
\end{tabular}
\end{table}
Autonomy is low ($A=1$): a human sets and can override every position. Mutability is low ($M=1$): the thesis itself did not update in production the way a retrained policy does. The fund's problem was a thesis that was held too \emph{steadily} through a regime change, not one that drifted unpredictably. Blast radius is high ($B=3$): a \$45 billion book with 4x leverage and a single-factor concentration (the AI-capex-continues trade) creates firm- and market-relevant loss potential regardless of how the positions were generated. Reversibility is impaired ($R=2$--$3$) not because the strategy was opaque, but because forced deleveraging under margin calls compresses the exit price below any orderly-unwind estimate. The realized loss is a function of \emph{when} you are forced to sell, not just \emph{what} you hold.
The practical upshot: the ARS-style score we propose is built only from $(A, M)$: autonomy and mutability, the two dimensions this paper's Layer 2 is most directly built to address. As such, the proposed score would significantly under-flag this fund, making it seem safer than the MSRR pipeline. It was not. This is direct evidence that ARS's four dimensions are not interchangeable and that a firm (or an investor doing due diligence) that governs only for autonomy and policy drift, while leaving blast radius and leverage-driven reversibility ungoverned, has a real gap.
\subsubsection{Layer 1: the thesis as an ungoverned reward function}
Section~\ref{subsec:layer1} argues that a reward function is the mathematical expression of institutional intent and should receive policy-document-grade review. The Situational Awareness thesis functioned as exactly this kind of governing objective for a \$45 billion book, without the formal review Layer 1 proposes for an agentic system's reward function. Three questions Layer 1 would have forced onto the table, and that a reward-function-style review checklist would surface for a discretionary thesis fund as readily as for an RL agent:
\begin{itemize}
\item \textbf{What is the objective actually optimizing, and under what regime does it fail?} "AGI by ${\sim}2027$ justifies concentrated AI-infrastructure exposure" is a directional thesis, not a risk-bounded objective. It says nothing about position sizing, leverage limits, or what evidence would falsify it in the short-to-medium term versus the long term. This is the same gap that Layer 1 identifies in an unreviewed reward function that specifies a goal but not the guardrails around pursuing it.
\item \textbf{Is the objective's time horizon mismatched to the vehicle's liquidity structure?} The thesis is a multi-year structural call; the vehicle carried 4x leverage in liquid public equities, which is a short-horizon tolerance instrument. A reward-function review process, applied by analogy, would ask whether the \emph{implementation} (leverage, concentration, liquid public names) is consistent with the \emph{objective's} actual time horizon, flagging the mismatch that produced the forced sale.
\item \textbf{Who signed off on leverage as an amplifier of the thesis, separate from signing off on the thesis itself?} This is the discretionary-fund analog of Layer 1's requirement that the reward function receive independent review distinct from the strategy that pursues it.
\end{itemize}
\subsubsection{Layer 2: why the engineering layer's specific controls do not transfer here and why that is informative}
It would be a stretch to claim that policy-stability monitoring or an inner-confidence kill-switch (Section~\ref{subsec:layer2}) "would have prevented" this blowup because there was no model policy to monitor and no LLM decision confidence generating the trades. Claiming otherwise would be exactly the kind of category error this paper spends Section~\ref{sec:why-frameworks-fail} warning against: applying an agentic-system control to a system that is not agentic.
What \emph{transfers} is the underlying design principle behind Layer 2, restated at the right level of abstraction: \textbf{a governed system needs a mechanism that can force de-risking before the system's own dynamics do so involuntarily, at a worse price.} For an RL policy, that mechanism is a kill-switch on inner confidence. For a leveraged discretionary book, the equivalent mechanism is a pre-committed, leverage-tiered de-risking schedule (e.g., automatic deleveraging at defined drawdown or margin-utilization thresholds, set and reviewed independently of the portfolio manager, before a crisis). Reporting indicates that Situational Awareness's forced sale was a margin-call-driven event, not a voluntary risk-reduction one. That is, de-risking arrived through the market's mechanism (the prime broker's margin desk) rather than through the fund's own. This is the discretionary-fund equivalent of a kill-switch never firing until an external actor pulls it. The lesson for governance design is that Layer 2 is not "the LLM-specific layer" so much as "the layer where a forcing function for de-risking is pre-committed rather than improvised", a principle that generalizes even to systems with no model in the loop, though its \emph{implementation} does not.
\subsubsection{Layer 3: crowding, observed directly}
This case is a cleaner, faster-moving instance of the crowding mechanism Section~\ref{subsec:layer3} models and Section~\ref{subsubsec:msrr-layer3} evidences via a five-year Sharpe drift. Situational Awareness's long book was concentrated in widely-held names such as chip, memory, data-center, and power supplier companies. These names were, by 2026, a widely-held consensus trade across the market, not a proprietary position. The reversal was sharp because many participants were positioned the same way: when infrastructure-adjacent names turned, the unwind was not idiosyncratic to one fund's book. It was correlated selling across a crowded trade, which is what produced 30\%+ two-week moves in "most AI stocks," not just Situational Awareness's holdings. A market commentator characterizing the forced sale as potentially "a clearing event" for the broader AI trade is, in this paper's terms, an informal statement of exactly the Layer 3 mechanism: firm-level risk that is only legible at the market level because it depends on how many other participants hold the same exposure.
Layer 3's proposed disclosure regime (Section~\ref{subsec:layer3}) would not have prevented the reversal: crowding is a market-structure fact, not a single firm's governance failure. However, Layer 3's regime would have given both the fund's own risk function and its counterparties (prime brokers extending 4x leverage) better information about how correlated the book's true risk was with the rest of the market's AI-infrastructure exposure, which bears directly on whether 4x leverage was ever an appropriate facility to extend against a single-factor, crowded trade.
\subsubsection{Implications}
The two case studies in this paper are complementary rather than redundant. Section~\ref{subsec:msrr-case-study}'s MSRR pipeline shows what governance failure looks like when the \emph{system} is agentic but low-autonomy on paper ($A=1$--$2$): the risk hides in composition and vendor dependency, which is why Layer 2.5 exists. Section~\ref{subsec:sa-case-study}'s Situational Awareness case shows what governance failure looks like when the system has \emph{no} agentic component at all ($A=1$) but scores maximally on blast radius through leverage and crowding. This is why Layer 3 and a leverage-aware reading of Layer 1 matter even for a firm with nothing "agentic" in production. A firm that reads this paper as "a framework for AI trading agents" and concludes it has no application because its book is human-managed would be making the precise category error Section~\ref{subsec:sa-case-study} warns against: the specific engineering controls of Layer 2 are model-specific, but the underlying governance discipline, reward/thesis review, pre-committed de-risking, and crowding disclosure are not. This case is evidence that the gap it closes is not hypothetical.
\subsection{Discretionary Risk vs. Governed Algorithmic Risk: Why "AI-Native" Is Not Automatically Safer, But Can Be Made Structurally Safer}
\label{subsec:ai-native-vs-discretionary}
Section~\ref{subsec:sa-case-study} documented a discretionary fund whose risk was entirely based on human judgment, leverage, and thesis. Nothing about the fund's failure was specific to AI. A natural question follows: would a genuinely algorithmic, model-driven fund, one whose research inputs \emph{and trading decisions} are generated by a governed system, have been structurally less prone to this kind of blowup? We argue yes, but only conditionally, and the condition is precisely the governance apparatus this paper proposes. An ungoverned algorithmic fund is not safer than Situational Awareness; it is differently dangerous, in ways this paper's own taxonomy predicts.
\subsubsection{The structural case for AI-native governance}
A true AI-native trading system is one where position sizing, leverage, and risk limits are enforced in code rather than held as intentions. When built as such, a true AI-native trading system has three advantages that a discretionary fund structurally lacks, corresponding directly to Layers 1, 2, and 2.5 of this framework:
\textbf{Risk limits are enforced, not just observed.} In a discretionary fund, a leverage cap is a policy that a human is supposed to respect under stress. Unfortunately, this is the condition under which humans are least reliable, and exactly the condition under which Situational Awareness's book was not deleveraged until a prime broker's margin desk forced the issue.
In contrast, in a governed algorithmic system, Layer 2's kill-switch architecture (Section~\ref{subsec:layer2}) can be wired directly into the execution path: a leverage or drawdown threshold breach halts new position-taking or triggers automatic deleveraging as a hard constraint, not a discretionary call made in the middle of a panic by the person with the most career and psychological investment in the thesis being right. This is the sharpest version of the argument: code does not get emotionally attached to a thesis it wrote, but a founder-PM can.
\textbf{The reward function can be inspected and reviewed before capital is at risk.} Layer 1 requires that the objective a system optimizes for be written down and reviewed with the rigor of a risk policy \emph{before deployment}. A discretionary thesis ("AGI by ${\sim}2027$ justifies concentrated leveraged exposure") is rarely forced through this discipline. The thesis resides in an investor letter and the PM's conviction, not in a document with a defined failure condition, position-sizing rule, and independent sign-off. An algorithmic system's objective function has to be written down by construction; it can be reviewed, red-teamed, and stress-tested against the adversarial input distributions Section~\ref{subsec:adversarial-drift} describes in a way that a human's evolving conviction cannot.
\textbf{Drift is measurable.} Section~\ref{subsec:layer2}'s regret-covariance decomposition gives a governed algorithmic system a model-free, continuously computable signal for whether live behavior has diverged from validated behavior. A discretionary fund has no equivalent instrument for detecting that a PM's decision-making has quietly shifted. The fund can become more concentrated, more levered, more convinced by disconfirming evidence rather than updated by it, until the P\&L reveals it, which is the most expensive possible place to detect drift.
On this reading, an AI-native fund with Layers 1 and 2 actually implemented has a real structural edge: its risk controls are properties of the system's architecture rather than promises about the operator's future behavior under stress.
\subsubsection{The counter-case: this paper's own evidence that "AI-native" is not sufficient}
The argument above describes a \emph{governed} algorithmic fund. This paper's central empirical claim (Section~\ref{sec:evidence}) is that governance of exactly this kind is rare: 88\% of surveyed finance professionals report no operational governance framework for agentic AI, and only 32\% of money managers disclosing AI use in Form ADV filings disclose a formal governance policy. An algorithmic fund without Layers 1--2.5 in place does not inherit the structural advantages of Section~\ref{subsec:ai-native-vs-discretionary} by virtue of being algorithmic. A fund without these risk control layers inherits a different, and in some respects less visible, set of failure modes:
\begin{itemize}
\item \textbf{Policy drift is silent where discretionary drift is at least eventually legible.} A PM's growing overconfidence shows up in position sizing that a risk committee can observe and question. A retraining agent's policy drift (Section~\ref{subsec:var-drift}) can shift the system's effective risk-taking without any human decision that anyone could have vetoed. There was no moment analogous to Aschenbrenner choosing 4x leverage that a compliance officer could have flagged because no human chose the updated policy.
\item \textbf{Compositional risk (Layer 2.5) has no discretionary analog at all.} Situational Awareness's failure was legible in principle to any experienced risk officer: concentrated, leveraged, single-factor exposure is a recognizable pattern. The MSRR case study (Section~\ref{subsec:msrr-case-study}) shows a failure mode: a vendor-side embedding model update silently reshapes a pipeline's return distribution. This failure mode is \emph{not} recognizable to conventional risk review because every individual component looks fine in isolation. An AI-native fund is more exposed to this class of failure than a discretionary one, not less, precisely because it depends on components that a human trader's judgment never had to depend on.
\item \textbf{Crowding may be worse, not better, among algorithmic strategies.} Section~\ref{subsubsec:msrr-layer3} provides evidence that Sharpe ratios on the LLM-embedding news strategy were compressing from the 4+ range toward 2--2.5 as the underlying embedding technology became widely available. This shows that algorithmic strategies trained on similar data toward similar objectives converge in a way discretionary managers, whose theses and information sources are more heterogeneous, may not. If every AI-native fund's risk model is built on similar foundation-model embeddings and similar training objectives, Layer 3 crowding risk could be \emph{structurally worse} for a population of AI-native funds than for a population of discretionary ones. Correlated model architecture is a new, additional channel of correlation beyond correlated conviction.
\item \textbf{A governed system can enforce the wrong policy just as reliably as the right one.} Layer 2's advantage is that risk limits are enforced in code, not merely observed, and it cuts both ways. An algorithmic system with a flawed or unreviewed reward function will pursue that flawed objective with the same mechanical reliability it would apply to a sound one. Layer 1 review is what makes hard-coded enforcement an advantage rather than a liability; absent it, "the code does not get emotionally attached to its thesis" becomes "the code will drive the position to zero without a moment of doubt," which is a worse property, not a better one, in the specific case where the thesis is wrong.
\end{itemize}
\subsubsection{The synthesis: the advantage is real but earned, not structural}
The defensible version of the claim is therefore: \textbf{a fund whose trading decisions are generated by a system with Layers 1--2.5 actually implemented has risk controls a discretionary fund cannot match, because those controls are architectural rather than behavioral.} The unqualified version of "AI hedge funds are inherently sounder than discretionary ones" is not supported by this paper's own evidence, since it is precisely the population of agentic financial systems this paper studies that shows an 88\% governance gap and a real, currently-observed compositional and crowding failure mode (Section~\ref{subsec:msrr-case-study}) that has no discretionary equivalent.
Put differently, the failure of Situational Awareness was a \emph{known, well-understood} risk management problem (leverage against a concentrated, crowded trade) that traditional risk management has fifty years of tools to address, deployed too weakly or too late. A poorly-governed AI-native fund's failure mode was a silent policy drift compounded by opaque vendor dependency, which is further compounded by algorithmic crowding invisible to any single firm's risk process. This is a \emph{novel} risk-management problem that this paper argues the industry does not yet have the tools, or in 88\% of cases the process, to address at all. Whether AI-native funds are "more sound" than discretionary ones is therefore an empirical question that resolves in favor of AI-native funds only after the point where Layers 1--2.5 are actually built, and resolves against them, in a harder-to-detect way, on every day before that point.
\subsubsection{Implication for the paper's argument}
This case strengthens rather than weakens the paper's core thesis in Section~\ref{sec:introduction}: the risk is not AI-native trading itself, and the answer is not "prefer discretionary managers." The answer is that the structural advantage of AI-native systems is their capability for enforced limits, inspectable objectives, and measurable drift. The advantage is not automatic; however, it is unlocked only by the governance architecture this paper proposes. A firm that adopts an AI-native strategy without adopting Layers 1--2.5 has not reduced its exposure to a Situational-Awareness-style blowup; it has traded a visible, well-understood failure mode for a set of less visible ones that this paper's evidence suggests the industry is not yet equipped to see coming.
\section{Implementation Roadmap: From Awareness to Governance in 90 Days}
\textbf{Days 1--30:} Inventory all agentic systems, including embedding-model-dependent
strategies; document vendor model identifiers per Section~4.5.2. \textbf{Days 31--60:} Implement policy stability monitoring and kill-switch architecture; extend Layer~2.5 red-teaming and vendor-version attestation to any pipeline identified in the inventory that depends on a third-party LLM, foundation model, or embedding service. \textbf{Days 61--90:} Submit the reward function governance to model risk management; assess policy-similarity \emph{and shared} data exposure to likely competitor deployments; present the systemic-layer assessment, including any material dependence on widely-used public news or embedding providers, to the CRO and board risk committee.
\section{Discussion: The Literacy Problem Underneath the Governance Gap}
The survey evidence in Section~2.1 points to an institutional failure that no framework can resolve on its own: the people responsible for governing these systems do not yet possess the technical literacy to specify governance for them. The news-anomaly case study sharpens this point: literacy sufficient to govern an in-house RL trading agent is not sufficient to govern a strategy where the risk profile depends on a foundation model that an institution licenses but does not build, evaluated against a news feed shared with competitors.
\section{Limitations}
\label{sec:limitations}
The survey evidence is self-selected and likely understates the true governance gap. The adversarial-input protocol (Section~3.6) and the systemic-layer simulation (Section~4.4) remain illustrative rather than fully empirically populated. The taxonomy and ARS are a triage
instrument, not a validated risk metric. The news-anomaly case study in Section~4.5 is drawn from a single strategy family and asset class (U.S.\ equities, Reuters/Dow Jones news, 1996--2022). The magnitude of vendor-dependency and crowding effects documented there should not be read as a calibrated estimate of these channels for other agentic strategy classes, though the qualitative mechanisms (opaque vendor-model dependency, undisclosed vendor-side updates, and shared-feed
crowding) generalize directly.
\section{Conclusion}
The governance gap documented in Section~2 is an architectural literacy gap, not a compliance gap. Across four failure modes (endogenous policy drift, adversarial input-distribution drift, compositional risk, and cross-institutional policy correlation), frameworks built for
deterministic systems do not transfer to agentic systems. The news-anomaly case study of Section~4.5 shows these are not abstract future risks: a currently deployed, economically large, vendor-dependent, periodically retrained agentic strategy already exhibits compositional fragility to vendor model updates and a market-level crowding signature consistent with our Layer~3 mechanism. Institutions that build governance capability for systems of this kind now will not be
retrofitting it under regulatory pressure in 2027.
\bibliographystyle{plainnat}
\bibliography{AIRiskMgmt}