Drafts everything, sends nothing: the rule that makes agentic work deployable.

One wrong message to an LP. One premature document to an allocator. One reply to a counterparty that contradicts the last letter. These are not productivity problems; they are franchise problems, and they are why the fear that keeps agentic systems away from client-facing work is a correct reading of the stakes.

Any deployment that asks the firm to suppress that fear is asking the wrong thing. The system has to deserve the trust structurally, not request it culturally.

Everything up to that line is the system’s job. It writes the reply in house voice. It stages the document in the shared drive. It checks the distribution list. It routes the draft through the review chain and tracks every comment as an item with an owner. It holds the finished artifact at distribution.

Then a named human presses send. Always.

The distinction matters because it converts an anxiety into an architecture. “What if it contacts an investor?” gets the answer it cannot, in place of it probably won’t. That is why the system can be put near investor communication at all: it does every part of the work up to the send button, and it is incapable of pressing it.

None of which anyone has to take on trust. Every action an agent can request exists as a registered contract in Daimon, the boundary each request has to cross, and Daimon’s registry holds no contract for an outbound send to a third party. A reviewer reads the same list the agents read, finds every permitted action named in it, and finds that one absent.

Personal account dealing is the classic case. A policy flow chart exists. The process is slow because a human re-derives the same checks every time, and it is risky because occasionally a human does not.

Run as pre-flight, the request comes in, the asset is checked against the restricted list and the pre-approval list, the policy flow chart is applied, every condition is pre-filled, and a ready draft is produced into the compliance chain with the checks recorded. Drafted, never sent.

This is worth stating carefully, because it is the part operational due diligence teams lean forward on. The same policy applied the same way every single time, with a record that it was applied, is a better control than the manual process it replaced. The automation is not a concession the compliance function makes to the front office. It is an upgrade to the control environment.

Every item raised, every decision and its disposition, every control that passed or blocked lands in Shuin, Genba’s append-only record. Months later the answer is still available with its context intact. Where an action reached a live system, its receipt comes from Daimon, so the evidence and the execution share one lineage.

This closes the loop on the first two sections. The boundary states what the system may never do. The pre-flight states what it does identically every time. The record demonstrates both, continuously, to anyone with standing to ask: a regulator, an auditor, an allocator’s operational due diligence team, or the firm’s own management company.

The usual AI conversation there is defensive. Here are the ways we limit it, here is the human in the loop, here is the policy document. The structural version is affirmative: external contact is impossible by construction, regulated checks run identically on every request with the evidence attached, and the full decision history of the system is reconstructable on demand.

What it can do, what constrains it, what proves the constraint held. In that order, because that is the order the questions come in.