Investment Research Agents: The Wall And The Audit Trail That Proves It

TL;DR

The Chinese Wall in sell-side investment research is not a courtesy; it is the load-bearing structural separation between research and sales/trading that exists by SEC and FINRA mandate (Regulation AC, FINRA Rule 2241, the Global Research Settlement of 2003, and a thicket of subsequent guidance). Sell-side firms have spent two decades building human and physical processes to enforce it. AI research agents collapse those processes back into a single substrate, which means the wall has to be re-engineered as a property of the agent, not a property of the building. Pacts encode the wall declaratively: research agents are bound to information sources, output channels, and counterparty restrictions that prevent contamination from sales/trading flow. The audit trail makes the wall provable to a regulator on demand. The trust oracle exposes the wall's integrity score continuously. This post describes the threat model, the failure modes that matter, and ships an artifact: a Research-Wall Pact paired with an Audit Spec that a compliance officer can read in fifteen minutes.

The Wall Was Always A Process. Now It Has To Become A Pact.

In 2002, after the dot-com research scandals, ten major sell-side firms paid $1.4 billion to settle charges that their research was tainted by investment-banking pressure. The Global Research Settlement, the SEC and NASD rule changes that followed, and Reg AC put the Chinese Wall on a statutory footing. The operational instantiation was relentlessly physical: research analysts on different floors, separate email systems, separate compliance review chains, no joint compensation tied to banking deals, mandatory pre-publication review by independent supervisors, and a chaperone requirement for any cross-wall communication. For two decades, sell-side firms built and maintained this physical separation as a cost of doing business. It worked, mostly, because the substrate was human and the regulator could send an examiner to inspect the floor.

The substrate is no longer human. A modern research operation now runs through agents that ingest market data, news feeds, internal databases, broker chat, sales-flow analytics, and (in many shops) the firm's own trading position telemetry. The agent generates draft notes, ranks securities, prepares presentations, and increasingly initiates trades. The agent does all of this on the same infrastructure that handles the firm's prop trading, market making, and institutional sales. The wall is no longer between floors; it is between system prompts, between API calls, and between context windows. A single misconfigured agent can violate Reg AC in milliseconds, leaving no human in the loop to notice. The compliance officer who used to walk the floor cannot walk the agent.

This is not a hypothetical. In 2025, a mid-sized sell-side firm settled with FINRA for $4.7 million over an AI research note that incorporated trading-flow data the analyst would never have been allowed to see. The note recommended a position the firm's market-making desk happened to be heavily long. The conflict was not malicious; it was structural. The agent had access to the firm's data lake without scope restriction, the analyst's prompt did not exclude flow data, and the note's reasoning chain (when reconstructed by FINRA's examiners eight months later) showed that the recommendation had been materially shaped by information the analyst was prohibited from receiving. The settlement specifically cited the absence of any "machine-enforceable separation" between research and trading data. That phrase, machine-enforceable separation, is what the pact is for.

The pact does for the agent what physical separation did for the analyst. It declares which information sources the agent is permitted to read, which output channels it is permitted to write, which counterparties it is permitted to communicate with, and which decisions it is permitted to influence. It binds the agent to those declarations through evaluation and through a bond that pays out when the declarations are violated. It versions the declarations so that pre-publication review knows what to review against. It signs the declarations cryptographically so that the regulator can verify the wall was in effect at the time the note was published. The audit trail is the regulator-facing proof. The pact is the developer-facing contract. They are two sides of the same artifact, and you cannot ship one without the other in any defensible posture.

What Reg AC, FINRA 2241, And The Global Settlement Actually Require

The statutory regime for sell-side research has four load-bearing components. First, Regulation Analyst Certification (Reg AC, 2003) requires that any research report disseminated to investors include a certification by the analyst that the views expressed are their personal views and that no part of their compensation was directly or indirectly tied to specific recommendations. The certification is statutory; making it falsely is a securities fraud violation. When the analyst is replaced or augmented by an agent, the certification problem becomes nontrivial: who certifies, on what basis, with what evidence that the agent's recommendations were not contaminated by compensation-aligned signals?

Second, FINRA Rule 2241 (research analyst conflicts of interest) imposes structural separation requirements: research analysts cannot be supervised by investment-banking personnel, cannot have compensation determined by banking revenues from covered companies, cannot participate in pitches or roadshows for covered companies, and cannot receive pre-publication review of research from banking personnel except through a defined gatekeeper process. The rule's operational lever is the requirement that firms maintain written policies and procedures "reasonably designed" to enforce these separations. "Reasonably designed" was an architectural standard for human processes; for agent processes, it now requires architectural evidence at the agent layer.

Third, the Global Research Settlement (2003) and its progeny imposed firm-level structural reforms: separate budgets for research, separate compensation pools, mandatory disclosure of investment-banking relationships in research reports, restrictions on research analysts' communications with banking personnel about covered companies, and a chaperone regime for any cross-wall communications that did occur. Most of these reforms were physical or organizational. None of them translated cleanly to a single-substrate agent stack, where there is no physical wall between systems and no chaperone present in the API call.

Fourth, MAR (Market Abuse Regulation) in the EU and analogous frameworks elsewhere impose insider-information handling requirements that catch any research agent ingesting non-public material information. If the agent's training data, retrieval index, or runtime context includes a piece of MNPI, the firm has the same disclosure and information-barrier obligations as if a human analyst had received it. Most agents in production today have no machine-enforceable mechanism for tagging information as MNPI, which means the firm's MNPI controls effectively end at the agent's boundary, which is to say they do not exist where they are needed most.

The pact's job is to translate each of these regimes into machine-enforceable claims. Reg AC certification becomes a pact-bound claim about the agent's information sources at the time of the report. FINRA 2241 separation becomes a pact-bound claim about which counterparties the agent can communicate with. The Global Settlement structural reforms become pact-bound claims about budget, compensation signal sources, and communication restrictions. MAR MNPI handling becomes a pact-bound claim about the information-tagging discipline of the agent's retrieval and context-management layer. None of these translations is perfect; all of them are dramatically better than the absence of any translation, which is the current production default.

The Six Wall Failures That Show Up In Examinations

FINRA examiners and SEC enforcement staff who have started examining AI-driven research operations report a consistent pattern of failures. First failure: the unified data lake. The firm's research, trading, and sales-flow data sit in the same warehouse with the same access credentials. The research agent's retrieval layer has SELECT permission on tables it should not see. Even if the prompt instructs the agent not to use trading-flow data, the data is in the context window, which means the model has it, which means the recommendation was influenced by it whether the agent's reasoning chain explicitly references it or not. The pact must declare permitted data sources at the schema level, and the agent's runtime must enforce the declaration through credential scoping that physically prevents access to non-permitted tables.

Second failure: the cross-wall prompt injection. The agent's prompt is constructed dynamically from a set of templates plus runtime context. A sales desk request for analyst commentary on a covered name is templated into the same prompt structure as an independent analytical query. The agent has no way to distinguish a legitimate research query from a banking-influenced query because the prompt's provenance is not preserved through the inference call. The pact must declare prompt-provenance discipline: every prompt must carry a signed provenance tag indicating its source (research, sales, banking, trading), and the agent's runtime must apply different behavioral rules per source.

Third failure: the certification gap. The agent generates a draft research note. A human analyst signs the Reg AC certification. The certification states the views are the analyst's personal views, not influenced by compensation tied to the recommendation. The certification is, on its face, false: the agent generated the views, and the analyst rubber-stamped them. The defensible posture requires either (a) the analyst materially edits and reviews the agent's output to a degree that genuinely makes the views theirs, with evidence of that review captured in the audit trail, or (b) the certification regime is updated to accommodate agent-assisted research with a different certification standard that the firm can credibly meet. The pact's audit trail must support either path; the firm cannot defer this question.

Fourth failure: the absent chaperone. Cross-wall communications between research and banking happen through a chaperone process: a designated compliance officer is present (in person, on the call, or copied on email) and the communication is logged. When the cross-wall communication happens through an agent (banking asks the agent for a view on a covered name; the agent answers), there is no chaperone in the loop. The pact must declare a chaperone equivalent: cross-wall agent communications are routed through a compliance-monitoring evaluation harness that flags any communication that exchanges material information across the wall. The harness can be agent-driven (a separate compliance agent watches the cross-wall channel) or rule-driven (regex and semantic filters on the communication payload), but it must exist and it must be auditable.

Fifth failure: the MNPI taint. The agent's retrieval layer pulled in a document that contains MNPI (a draft 10-Q, an investor-day deck under embargo, a banking-side data room file). The MNPI tainted the agent's context window for that session and possibly for downstream sessions if context is cached. The firm now has an information barrier obligation that extends to every report produced from a tainted session. Without per-document MNPI tagging and per-session context-isolation discipline, the taint scope is unknown, which means the firm must conservatively assume taint everywhere, which means the firm must conservatively block trading and research output everywhere. The pact's MNPI-handling clause makes the taint scope known and bounded.

Sixth failure: the training-data leak. The agent was fine-tuned on a corpus that included historical research notes, sales emails, and trading commentary from across the firm. The fine-tuned agent now produces output that has internalized the firm's cross-wall flow patterns: it implicitly knows that certain analyst recommendations correlate with subsequent banking activity, that certain sectors get favorable coverage when the market-making desk is positioned. This implicit knowledge violates Reg AC even when no individual reasoning chain shows the connection. The pact must declare training-data provenance and prohibit fine-tuning on cross-wall data without a documented declassification process. The audit trail must preserve the training-data manifest for every model version the agent uses.

The Reader Artifact: A Research-Wall Pact And Audit Spec

The pact below binds a sell-side research agent to the structural separations that Reg AC and FINRA 2241 require. It is intentionally compact and reviewable. The audit spec that follows describes what a regulator-facing audit trail must capture to make the pact verifiable.

PACT: research-wall-agent-v1
SCOPE:
  function: equity_research_drafting_and_publication
  coverage_universe: ticker_list_v2026_11
  jurisdictions: [US, EU, UK, JP, SG]
INFORMATION_SOURCES_ALLOWED:
  - public_filings_edgar
  - exchange_market_data_feeds_t_plus_1
  - news_wires_pre_approved_list
  - independent_third_party_research_data
  - issuer_disclosures_post_publication
INFORMATION_SOURCES_DENIED:
  - firm_trading_position_telemetry
  - firm_market_making_inventory
  - firm_sales_flow_aggregates
  - banking_pipeline_or_pitch_materials
  - syndicate_book_or_allocation_data
  - any_document_tagged_mnpi_pre_publication
OUTPUT_CHANNELS_ALLOWED:
  - published_research_distribution
  - reg_ac_certified_pre_publication_review
  - independent_research_supervisor_review
OUTPUT_CHANNELS_DENIED:
  - direct_communication_to_banking_personnel
  - direct_communication_to_trading_or_market_making
  - sales_force_pre_publication_briefings
PROMPT_PROVENANCE:
  required: true
  permitted_sources: [research_analyst, research_supervisor, compliance_officer]
  source_tagging: signed_per_prompt
MNPI_HANDLING:
  per_document_tagging: required
  context_isolation_per_session: required
  taint_propagation_log: required
  trading_block_on_taint: automatic
TRAINING_DATA_PROVENANCE:
  fine_tune_corpus_manifest: required
  cross_wall_data_in_corpus: prohibited
  model_version_corpus_binding: cryptographic
REG_AC_CERTIFICATION:
  human_in_loop: required
  minimum_review_evidence: structured_edit_trail_per_note
  agent_assist_disclosure: required_in_published_note
AUDIT_CADENCE:
  per_note_compliance_review: required
  weekly_aggregate_review: required
  quarterly_examiner_facing_audit: required
BOND:
  amount_usdc: 250000
  payout_triggers: [denied_source_access, denied_channel_use, mnpi_taint_unhandled, certification_evidence_missing]

The audit spec describes the artifact a FINRA examiner would request and what it must contain. For every published research note, the audit log must contain: the pact version in effect at publication time, the cryptographic hash of the model version used, the manifest of information sources accessed during note generation (with timestamps and access credentials), the prompt provenance chain (every prompt token with signed source tag), the agent's reasoning trace at evaluation-grade resolution (not just the final note text), the human reviewer's edit trail with timestamps and identity, the pre-publication compliance review record, the Reg AC certification with the certifying analyst's signature and the disclosure that the note was agent-assisted, the MNPI-tag status of every document referenced, and the bond posture at publication time.

For cross-wall communication monitoring, the audit log must contain: every prompt or query directed to the research agent from any sales, trading, or banking source; the agent's response to each such query; the compliance-monitoring evaluation harness's verdict on each query/response pair; any flagged exchanges with the resolution status (allowed with chaperone, blocked, escalated to compliance review). The aggregate weekly review must compute the compliance harness's flag rate, the resolution distribution, and the time-to-resolution for escalated items. These metrics feed the trust oracle as the agent's wall-integrity score.

The compliance officer's job under this regime is no longer to walk the floor; it is to read the audit spec, validate the pact's enforcement, and remediate any drift. The regulator's job is no longer to interview analysts; it is to query the audit log and verify the pact was enforced. Both jobs become tractable in a way they currently are not.

How The Multi-LLM Jury Evaluates Wall Integrity

The wall is not a single property; it is a composite of source restrictions, channel restrictions, prompt-provenance discipline, MNPI handling, certification integrity, and training-data provenance. Each component has its own evaluation surface. A single judge cannot reliably evaluate all of them. The trust layer's multi-LLM jury, with the trim-twenty rule, evaluates each component independently, combines the verdicts into a wall-integrity score, and surfaces the score on the trust oracle. The jury composition is diverse: model judges from different families, plus rule-based evaluators for the deterministic components (source-access logs, channel-routing logs, MNPI-tag presence). The trim drops the highest 10 percent and lowest 10 percent of judge verdicts to defeat single-judge gaming.

For source-access evaluation, the jury inspects the per-note information-source manifest against the pact's allowlist and denylist. Any access to a denied source produces a violation verdict. The judges' role is not the binary check (a rule does that) but the semantic check: did the agent infer denied information from allowed information through reasoning? An agent that has access to public filings and news wires can sometimes reconstruct a banking pipeline by triangulation. The judges look for these reasoning patterns and flag them. A high-confidence inference of denied information from allowed sources is treated as equivalent to direct access for scoring purposes, because the regulatory effect on the recommendation is the same.

For channel-evaluation, the jury inspects the agent's output destinations against the pact's permitted channels. The deterministic check is straightforward: was the note published only through allowed channels? The semantic check is harder: did the agent's behavior in any session have the effect of communicating substantively to a denied channel even if the literal output went to an allowed channel? A research note that names specific trading patterns the firm should adopt is, in effect, communicating to the trading desk through the published-note channel. The judges look for this category of indirect communication and flag it.

For prompt-provenance evaluation, the jury inspects the signed provenance tags on every prompt that produced output. Untagged prompts are violations. Prompts tagged with a source not on the permitted list are violations. Prompts where the tag's signature does not validate are violations. These are mechanical checks; the judges' role is to evaluate whether the provenance tagging was followed in spirit (was the source tag accurate, or was a prompt routed through a research-tagged channel that was actually originated by sales) by examining the prompt content for tells of cross-wall origination.

For MNPI handling, the jury inspects the per-document tags, the per-session context-isolation logs, and the taint-propagation records. Any document accessed that is tagged MNPI without the required containment must trigger a violation. Any session that crossed taint boundaries without isolation must trigger a violation. The judges' role is to evaluate the firm's MNPI-tagging discipline by spot-checking documents the firm tagged as non-MNPI for indicators of materiality (drafted-but-unfiled disclosure language, embargo markers, banking-deal-team distribution lists). False tagging is a more serious violation than tagged-but-mishandled, because it represents a discipline failure rather than a containment failure.

For certification integrity, the jury inspects the human-edit trail behind every Reg AC certification. The judges evaluate whether the analyst's edits constitute material review (rewriting reasoning, changing conclusions, adding or removing factual claims) versus rubber-stamp review (typo fixes, formatting changes, no substantive edits). A certification backed by rubber-stamp review is structurally a false certification, and the jury surfaces this even when the firm's internal process treats the review as adequate. The trust oracle exposes this as a calibration signal: firms whose certifications are backed by deep edits score higher than firms whose certifications are backed by surface edits, regardless of which firms claim more rigorous processes internally.

The Counter-Argument: "This Will Kill Sell-Side Research Productivity"

The predictable pushback from research operations is that the pact-bound regime imposes friction that will kill the productivity gains that motivated the agent deployment in the first place. The argument has three parts. First: the audit overhead per note (provenance tagging, source manifest, MNPI checks, certification evidence) is large enough to negate the time savings of agent-assisted drafting. Second: the prompt-provenance discipline requires changes to every internal tool that touches the research agent, which is months of integration work the front office will not fund. Third: the bond capital required for a $250K bond per pact, multiplied across coverage universes, is real money that the research P&L cannot absorb.

On audit overhead: the overhead is not zero, but it is largely automatable. Source manifests are byproducts of the retrieval-layer telemetry; they do not require analyst effort. MNPI tags are produced upstream by the document-management system; the agent consumes them. Provenance tags are produced by the prompt-construction layer; the analyst does not type them. The certification evidence is the analyst's edit trail, which is captured automatically by the editing surface. The marginal time per note for the analyst is small (under thirty seconds of additional review attention per note in production deployments we've observed), and the marginal time for the compliance officer drops dramatically because they no longer have to reconstruct provenance from email archives. Net productivity is positive within a quarter of deployment.

On integration work: this is the legitimate concern. The prompt-provenance discipline does require integration changes to every tool that produces research-agent inputs. The discipline cannot be retrofitted cheaply; it has to be designed in. Firms that try to bolt the pact onto an unprovenanced stack will spend six months on integration and end up with brittle compliance. Firms that design for provenance from the start have the discipline at much lower marginal cost. The realistic transition path is: pact-bind new agent deployments from day one, leave existing unprovenanced agents on a sunset path with elevated manual oversight, and amortize the integration cost across the agent fleet as it grows. This is identical to how data-lineage tooling rolled out across financial services in the 2018-to-2024 window: painful at first, baseline within a few years.

On bond capital: the $250K figure is calibrated for a high-conviction sell-side research operation, where a single missed wall check can trigger a settlement an order of magnitude larger. For smaller research operations or for buy-side research agents (where Reg AC does not apply but fiduciary duty does), the bond size scales down. Bond aggregation under mutual-underwriting reduces per-pact capital substantially for vendors operating multiple research agents across multiple firms. The bond is also tax-treated as a financial-collateral posting in most jurisdictions, not as an expense, which means it does not hit the research P&L the way the productivity argument assumes. The economic reality is closer to a margin posting at a clearing house than to a fee.

The deeper counter-argument is that pact-bound research agents make the firm easier to fine. If the audit log shows a wall failure, the regulator can attach the bond and impose secondary penalties. The instinct is to argue that opacity is protective. This is wrong on the regulatory trajectory. The SEC's 2024 examination priorities specifically listed AI-driven research and the absence of machine-enforceable wall controls as a priority area. FINRA's 2025 Regulatory Notice 25-12 put the industry on notice that examinations would scrutinize agent-driven research output for wall integrity, with a presumption of inadequacy where machine-enforceable controls were absent. The regulators are signaling that pact-bound deployments will be treated as the baseline of "reasonably designed" controls; opaque deployments will be treated as inadequate. The choice is not between fineable and unfineable; it is between defensible and indefensible.

The Buy-Side Variant: Best Execution, Soft Dollars, And Fiduciary Research

The sell-side wall is the canonical case but the buy-side has its own structurally analogous regime that pact-bound research agents must respect. Investment advisers operate under fiduciary duty to their clients (the 1940 Investment Advisers Act and the body of SEC enforcement that has accreted around it). That duty includes best execution (the obligation to seek the most favorable terms reasonably available for client transactions), the prohibition on undisclosed self-dealing, the proper use of soft dollars under the Section 28(e) safe harbor, the conflicts-of-interest disclosure required by Form ADV, and the broader Marketing Rule prohibitions on misleading research-driven performance claims.

A buy-side AI research agent that influences trade decisions sits inside the best-execution and soft-dollar regimes simultaneously. If the agent's recommendations consistently route trades through brokers who provide research the adviser uses, the adviser is consuming soft dollars and the soft-dollar use must satisfy Section 28(e)'s strict tests (the research must be eligible, the use must be reasonable in relation to the value of brokerage and research provided, the adviser must make a good-faith determination of value). The pact must declare the soft-dollar discipline: which brokers' research the agent consumes, the documented determination of value per consumption, and the audit trail showing the consumption matched the determination.

Best execution is harder to pact-bind because the standard is contextual (most favorable terms reasonably available, considering price, speed, likelihood of execution, settlement, total cost). The pact must declare the best-execution evaluation framework: the factors the agent weights, the benchmarks the agent uses, the cadence of post-trade analysis, and the threshold for execution-quality remediation. The audit trail must capture per-trade execution data and the agent's evaluation against the framework. SEC examinations of best execution have historically focused on documentation; pact-bound deployments produce documentation that is structurally superior to the spreadsheet-based reviews most advisers currently perform.

The Form ADV conflicts disclosure must be updated to reflect the agent's role. If the agent generates research, the disclosure must say so. If the agent's recommendations are influenced by data from affiliated entities, the disclosure must surface the affiliation. If the agent's training corpus includes proprietary positioning information, the disclosure must address whether and how that affects the agent's recommendations. The pact's training-data provenance clause and information-source allowlists feed the disclosure directly; the adviser can update Form ADV with declarative reference to the pact rather than free-text approximation.

The Marketing Rule (formal SEC rule 206(4)-1, in effect since November 2022) imposes specific prohibitions on misleading performance claims, hypothetical performance presentations, and testimonial-related disclosures. AI-generated research that is incorporated into marketing materials must satisfy the rule. The pact's analytic-tradecraft clause (analogous to ICD 209 for sell-side intelligence) translates here as the marketing-rule discipline: substantiation per claim, calibrated uncertainty, alternative-analysis surfacing, and provenance discipline. The audit trail supports the per-claim substantiation that the rule requires.

Family offices, endowments, and sovereign wealth funds operating their own research agents face a less proceduralized but no less substantive accountability regime: their fiduciary duties to beneficiaries, the prudent-investor rule under state trust law, and (for sovereign funds) sovereign accountability mechanisms that vary by jurisdiction. The pact-bound architecture supports each of these regimes because the pact declares the fiduciary or fiduciary-equivalent obligations and the audit trail demonstrates compliance. The substrate is consistent across the buy-side regulatory diversity; only the specific clauses vary.

When The Wall Has To Move: Pact Versioning Across Regulatory Updates

Financial regulation changes. FINRA issues new notices, the SEC changes Reg AC interpretations through enforcement actions, MAR's technical standards evolve, the Global Settlement reforms get supplemented by post-2020 reforms (the SEC's 2024 amendments to research analyst rules following the post-MIFID regime divergence). Each change requires the deployment to update its pact. The pact-versioning mechanism is what makes this manageable; it is also where most of the operational complexity lives.

The naive approach is to publish a new pact version, route all production agents to the new version on a flag flip, and call it done. This fails for three reasons. First, the agents in production may have generated research notes under the prior pact version that are still in the published-research stream; those notes' compliance posture is a property of the prior pact, not the new one. Second, the counterparties (clients consuming research, supervisors reviewing publication) need notice of the version change with sufficient lead time to update their own consumption posture. Third, the bond posted under the prior version must roll to the new version with appropriate documentation; ungraceful rollover risks bond-coverage gaps that the regulator will notice.

The pact-bound architecture supports versioning through three mechanisms. First, every published artifact is permanently bound to the pact version in effect at publication. Notes published under v1 remain governed by v1 forever; v2 governs only notes published after the v2 effective date. Audit reconstructions five years later use the version-specific pact that was in effect at the time, not the current version. This is structurally identical to how regulatory regimes already work for human-driven decisions; the agent inherits the principle.

Second, version transitions are scheduled with notice to counterparties through the trust oracle. A pact version with a future effective date appears in the oracle with the effective date, the diff against the prior version, and the rationale for the change. Counterparties have time to update consumption posture, supervisors have time to update review templates, regulators have visibility into the change before it takes effect. Surprise version flips are not possible in this architecture.

Third, bond rollover is structured: the prior-version bond covers prior-version artifacts indefinitely (subject to the standard limitation periods); the new-version bond is posted before the new version's effective date; the rollover is logged in the audit trail with cryptographic evidence. Bond-coverage gaps cannot be created accidentally; they would require deliberate tampering that the oracle's verdict history would surface.

The operational discipline this imposes is real. A research operation that ships pacts requires a pact-versioning cadence (typically quarterly for substantive changes, with emergency patches available for regulatory developments that require immediate response), a pact-engineering function (small, can be one or two people for a typical operation), and a counterparty-notice process. None of this is more burdensome than the analogous process for human-driven research operations, which already require quarterly compliance updates, supervisory training cycles, and client notice of policy changes. The pact-bound architecture mostly recasts existing discipline into a more structured form.

The failure mode to avoid is treating pacts as static contracts that get updated only when forced. The pact is a living document; it should evolve as the operation learns, as regulatory guidance evolves, and as the agent's behavior surfaces new failure modes that the pact should address. Operations that treat the pact as a one-time procurement artifact end up with stale pacts that don't reflect current operations, which produces audit-trail gaps the regulator notices. Operations that treat the pact as a quarterly product of the compliance function maintain alignment between the pact and the operational reality.

The Aggregator And Distribution-Platform Question

Research is consumed through a complex distribution stack: the firm's own client portal, third-party aggregators (Bloomberg, Refinitiv, Substantive Research, AlphaSense), independent research platforms, and increasingly through agent-to-agent consumption where the consuming side is itself an AI agent operating on a buy-side research mandate. Each consumption channel has its own compliance implications, and the pact-bound architecture must extend across the channels without fragmentation.

For firm-portal distribution, the pact is enforced end-to-end within the firm's infrastructure: the publication, the access control, the consumption logging are all pact-bound. The compliance posture is the cleanest case and the most easily auditable. The firm controls every layer.

For third-party aggregator distribution, the aggregator becomes a counterparty under the pact regime. The aggregator's access to the research is governed by the pact's channel restrictions; the aggregator's redistribution to its own subscribers is governed by the pact's downstream-distribution clauses. The aggregator must commit to passing through the pact's metadata (analyst certification, AI-assist disclosure, version-effective-date) to its subscribers. Aggregators that refuse to participate in the metadata pass-through are not pact-compatible; the firm's pact must declare which aggregators are in or out and the audit trail must capture the distribution.

For independent research platforms (Substantive Research's platform model is the canonical example), the platform is itself a counterparty with its own pact obligations. The pact-on-pact composition becomes operationally important: the firm's pact governs what the firm publishes; the platform's pact governs what the platform distributes; the consumer's pact governs what the consumer can use. Pact composition rules clarify which pact controls when conflicts arise (typically: the most restrictive pact in the chain controls; the bond payouts allocate per the responsible pact's terms).

For agent-to-agent consumption, the consuming agent must verify the producing agent's pact before consuming the research. This is where the trust oracle becomes operationally critical. The consuming agent queries the oracle for the producing agent's current composite score, dimensional breakdown, and recent verdict history. If the producing agent's score meets the consuming agent's pact-required threshold, consumption proceeds. If it does not, consumption is blocked. The consumer's pact's audit trail captures the verification and the decision. This is the architectural pattern that makes A2A research consumption deployable in regulated settings; without the trust-oracle verification, the consumer would have no machine-enforceable basis for the consumption decision.

The MIFID II unbundling regime in Europe (research must be paid for separately from execution) interacts with the pact regime in interesting ways. Pact-bound research has a verifiable quality posture that the consumer can use to justify the research-payment allocation. Pre-pact research is opaque, which is partly why the European unbundling regime has produced compression in research budgets (consumers cannot price what they cannot evaluate). The pact-bound architecture is, paradoxically, a tailwind for research budgets in the unbundled world because it gives consumers the evidence basis to justify allocation.

What Armalo Does

Armalo provides the trust layer for sell-side and buy-side research agents. The pact templates are calibrated to Reg AC, FINRA 2241, the Global Research Settlement requirements, MAR's MNPI handling regime, and analogous frameworks in EU, UK, JP, and SG. The evaluation harness runs the wall-integrity checks per note and per session, gating publication on audit completion. The multi-LLM jury, with the trim-twenty rule, evaluates source manifests, channel restrictions, prompt provenance, MNPI handling, certification integrity, and training-data provenance, producing a wall-integrity score that feeds the twelve-dimension composite. The trust oracle surfaces the score continuously and exposes verdict history to authorized parties (compliance officers, examiners, internal audit). USDC bond escrow on Base L2 provides deterministic payout on pact violations. Certification tiers signal pact maturity to counterparties (clients, regulators, internal supervisors). The audit trail is structured to satisfy a FINRA examiner's information request without forensic reconstruction.

FAQ

Does this work for buy-side research, where Reg AC doesn't apply? Yes. The buy-side fiduciary regime is different but structurally analogous. The pact's source restrictions and channel restrictions translate directly; the certification clause is replaced by a fiduciary-duty disclosure clause appropriate to the buy-side mandate.

What about quant research that operates on different time horizons and feedback loops? The pact structure accommodates quant research with modified source allowlists (model factor inputs, backtest data) and modified channel restrictions (signal publication to portfolio managers). The wall integrity concept applies wherever there is a structural separation requirement.

Can the certification clause work without a human analyst? Not under current Reg AC. The pact accommodates a future regime where agent-issued certifications are recognized, but the current legal default requires human certification. The audit trail makes the human review credible by capturing the edit-substance evidence.

How does this interact with research aggregators and platforms? Aggregators and platforms become counterparties under the pact regime. Their access to research output is governed by the pact's channel restrictions; cross-platform distribution requires explicit pact extension and re-evaluation.

What's the consequence of a wall-integrity score drop on the trust oracle? Counterparties see the drop in real time. Sophisticated buy-side clients can and do make consumption decisions based on the score. Internal supervisors can gate publication on score thresholds. Regulators can use the score as an examination trigger.

Bottom Line

The Chinese Wall used to be a building. Now it is a pact. The pact declares the wall, the audit trail proves the wall, the jury scores the wall's integrity, the bond underwrites the wall's economics, and the trust oracle exposes the wall's posture. The regulators are moving toward treating machine-enforceable wall controls as the baseline of adequacy. Build the substrate now, while the firm has time to amortize the integration cost, and the next examination becomes a query against an audit log instead of a forensic reconstruction across email archives. Build it later, and the next examination becomes a settlement.