CAIBots operates as an AI intelligence layer that sits on top of your existing data infrastructure. Your Bloomberg terminals, FactSet licenses, portfolio management system, and compliance platform are unchanged. CAIBots connects via API and adds the agentic reasoning layer.
The production architecture has four integration layers: (1) Data ingestion connectors to your existing market data and internal systems, (2) the 7-agent orchestration engine running on CAIBots cloud infrastructure — 11 research workflow types supported across equity, fixed income, macro, M&A, activist, and restricted-list scenarios, (3) the analyst workbench interface that existing analysts use for certification, review and release across four HITL pathways (FLASH / PRINCIPAL / IC CMTE / BLOCK), and (4) the compliance automation layer that handles MiFID II logging, Reg FD clearance, and MNPI screening automatically.
| System | Integration Type | Data Provided | Required |
|---|---|---|---|
| Bloomberg Terminal | Bloomberg API (BLPAPI) | Real-time prices, earnings estimates, consensus, filings | Required |
| FactSet / Refinitiv | REST API | Financial data, ownership, estimates, transcripts | One of two |
| SEC EDGAR | EDGAR API (live, free) | 10-K, 10-Q, 8-K filings · real-time | Required |
| Portfolio Management System | REST / FIX API | Current positions, active weights, position limits | Required |
| Compliance System | REST API | Restricted list, watchlist, MNPI register | Required |
| Research Archive | File upload / S3 | Prior research notes for style calibration (500+ notes) | Required |
| Actimize / Behavox | REST API | Surveillance flags, communication monitoring | Phase 2 |
All CAIBots research outputs are subject to mandatory analyst review and approval before distribution. The system is designed as a decision support tool, not an autonomous publisher. Every note carries a full audit trail: agent reasoning logs, data sources cited (with tool labels [VEC]/[API]/[SQL-DB]/[KG]/[MEM]), compliance checks performed, HITL pathway taken (FLASH / PRINCIPAL / IC CMTE / BLOCK), Reg AC certification record, and principal-release timestamp. Covers all 13 research workflow types, including the restricted-list interdiction pathway.
| Requirement | How CAIBots Addresses It |
|---|---|
| MiFID II Research Unbundling | Every note auto-categorized as independent research. MiFID II log filed automatically with timestamp, analyst ID, and distribution list. |
| Reg FD Compliance | Compliance agent screens all inputs for material non-public information before note generation. Hard stop if MNPI detected. |
| MNPI Screen | Real-time restricted list and watchlist check on every entity before pipeline runs. Analyst cannot approve if MNPI flag is active. |
| Audit Trail | Immutable log of every agent output, data source, compliance check, and analyst decision. Retrievable for regulatory examination. |
| Model Documentation | Full model card provided: curated knowledge-base composition, retrieval configuration, prompt and policy versioning (IR-2026.07), known limitations, evaluation results. No client data is used to train or fine-tune model weights — all institution knowledge lives in the retrieval layer. Satisfies internal model risk requirements. |
UAT ↔ Demo scenario mapping. Every UAT case has a live counterpart in the interactive demo, so acceptance criteria can be rehearsed before production data is connected:
| UAT case | Demo counterpart | Pass condition |
|---|---|---|
| Flash lane split | SC01 (VYRA) | Data flash releases with no rating; rated note refuses release until Reg AC certification + principal signature; distribution write failure compensates and retries on the same idempotency key |
| Certification refusal (negative) | Any PRINCIPAL scenario | Sign attempt without the attestation checkbox, without a named analyst, or with a rationale under 15 characters is refused and the refusal is ledgered |
| Ordering enforcement (negative) | Any PRINCIPAL scenario | Supervisory Analyst signature attempted before analyst certification is refused ("analyst certification must precede") |
| Committee quorum (negative) | SC10 (SELL initiation) | Release with 2 of 4 signatures is refused as governance-incomplete; 4 of 4 executes and is ledgered |
| Restricted-list interdiction (negative) | SC11 (ORBX) | Pipeline halts at TTL-zero check before any data gathering; no release control exists in the DOM; wall-crossing request is ledgered |
| Live-AI grounding | Scenario 12 (Live Custom) | Streamed note carries grounding verdict and forced not-investment-research disclaimer; both events ledgered |
| Ledger integrity | ⇓ Ledger export | Exported chain re-verifies: each entry hash = SHA-256(prev | seq | ts | actor | msg) from GENESIS |
| Item | Standard |
|---|---|
| Uptime SLA | 99.5% excluding scheduled maintenance windows (communicated 48 hours in advance) |
| Note Generation Latency | <90 seconds end-to-end for standard scenarios · <3 minutes for complex multi-asset Demo pipeline runtime (3.7–8.2s) reflects agent orchestration only. Production SLA includes live data fetch, compliance queue, and analyst notification. |
| Support Response | P1 (system down): 1 hour · P2 (degraded): 4 hours · P3 (enhancement): next sprint |
| Model Updates | Quarterly recalibration included. Major model version changes communicated 30 days in advance. |
| Regulatory Updates | MiFID II, Reg FD, and MNPI rule changes incorporated within 30 days of regulatory effective date |
Contact: contact@caibots.com · +1 (609) 721-2815 · Princeton, NJ
The interactive demo accurately represents the pipeline logic, HITL governance model, compliance gate structure, and all 13 research workflows (including SC09 earnings miss, SC10 SELL initiation, and SC11 restricted-list interdiction). What it does not represent is the production plumbing beneath those workflows. This section maps every simulated layer to its production equivalent so your engineering team has a complete scope picture before scoping begins.
Eight integration layers require production build (these are infrastructure layers, separate from the 10 research workflow types). Three layers transfer directly from the demo with no change required.
| Layer | Demo (simulated) | Production (what you build) | Owner | Timeline |
|---|---|---|---|---|
| 01 · Authentication | Hardcoded credentials (cai / Demo) checked in client-side JavaScript — bypassable via DevTools |
SSO via Okta, Azure AD, or internal IdP with MFA enforced. Server-side session tokens. Role-based access: analyst, reviewer, compliance, read-only | Client IT | Week 1 |
| 02 · Market data | Synthetic hardcoded strings — VYRA, SFG, PHC figures are realistic but fictional. No live feed. | Bloomberg BLPAPI (real-time prices, estimates, filings) + FactSet or Refinitiv REST API (financials, transcripts, ownership) + SEC EDGAR live API (10-K, 10-Q, 8-K). See Section 02 for full data matrix. | Client IT + CAIBots | Week 1–2 |
| 03 · AI orchestration | Single Claude API call from browser. No parallelism, no RAG, no tool use. API key stored in browser memory. | Server-side orchestration engine (Temporal-class durable orchestration — the PCATS Coordination Plane) running 7 genuinely parallel agents. Each agent has dedicated tool access, RAG retrieval against your research corpus, and structured prompt chains. API key in AWS Secrets Manager or Azure Key Vault. Inference runs on CAIBots cloud infrastructure. | CAIBots | Week 2–4 |
| 04 · RAG / knowledge base | Not present. The demo agents use hardcoded log lines — no retrieval from real research history. | Vector database (Pinecone or pgvector) loaded with your prior research corpus (500+ notes minimum). Semantic retrieval on every agent call for style calibration, coverage context, and house view alignment. Rebuilt on your data during Week 3–4 calibration sprint. | CAIBots + Client | Week 3–4 |
| 05 · Research output | Hardcoded snippet string rendered as plain text in browser panel. Conviction scores are hardcoded integers. No export. |
Claude returns structured JSON (rating, PT, conviction scores, risk factors, narrative). Schema validated. Rendered to branded PDF via template engine (Puppeteer/WeasyPrint). Pushed to DMS (SharePoint, iManage), Bloomberg Publishing API, and/or analyst portal. MiFID II categorisation metadata attached automatically. | CAIBots | Week 4–5 |
| 06 · HITL workflow | Approve / Escalate / Block buttons update badge colour only. State lost on page refresh. No notifications, no audit persistence. | Approval task queued (Celery + Redis or AWS SQS). Analyst receives email/Slack notification. Decision (approve, escalate, block + free-text rationale) written to immutable audit DB with timestamp, user ID, and IP. Escalation routes to senior analyst or IC. Timeout triggers automatic escalation after configurable SLA window. | CAIBots | Week 4–5 |
| 07 · Compliance gate | Simulated — always returns CLEAR. Green badge is hardcoded. No real restricted list or MNPI check. | Synchronous API call to your compliance system (Actimize, Behavox, or internal) on every pipeline run. Checks restricted list, watchlist, MNPI register, and analyst conflict register. Hard stop if any flag is active — pipeline cannot proceed and analyst cannot override. Every check logged with timestamp and data source. Reg FD clearance and MiFID II categorisation filed automatically. | Client Compliance + CAIBots | Week 5–6 |
| 08 · Hosting & security | Static HTML files served from any web host. No backend, no TLS enforcement, no access controls beyond the login gate. | App server (FastAPI or Node.js) deployed in client VPC or CAIBots-managed cloud environment. TLS 1.3 enforced. WAF (AWS WAF or Cloudflare) in front. All secrets in managed secret store. Logging to SIEM. Designed to SOC 2 Type II control objectives; formal audit engagement follows incorporation — security architecture pack and control mapping available on request. Data residency options: EU, US, or hybrid. | CAIBots + Client IT | Week 1 (infra) + Week 7 (hardening) |
The following components are built correctly in the demo and require no redesign for production. They represent the core IP of the CAIBots platform.
| Component | Status | Notes |
|---|---|---|
| 7-agent pipeline logic and sequencing | Transfers as-is | Agent roles, tool assignments, and parallel execution model are production-ready |
| HITL gate UX and governance model | Transfers as-is | Three-outcome decision model (approve / escalate / block) maps directly to production workflow |
| Arch flow + analyst workbench UI | Transfers as-is | Frontend component rebuilt in React or served as-is; visual design and layout final |
| Conviction scoring model (5-dimension) | Transfers as-is | Fundamental, Valuation, Technical, Sentiment, Regulatory — recalibrated to your coverage universe in Week 3–4 |
| Compliance gate structure and flow | Transfers as-is | Gate position in pipeline, hard-stop logic, and audit trail design are final — only the API target changes |
| All 10 research scenario workflows | Transfers as-is | Earnings flash, coverage initiation, credit alert, PM ad hoc, perpetual monitor, M&A event-driven, macro sweep, activist/13D — all prompt chains and output schemas are architected to production standards |
| MiFID II / Reg FD compliance design | Transfers as-is | Compliance agent prompt chain, MNPI screen logic, and audit trail schema designed to regulatory standard |
| Sprint | Duration | Deliverable |
|---|---|---|
| Infrastructure & Auth | Week 1 | VPC provisioned, SSO configured, secrets management live, TLS enforced |
| Data connectors | Week 1–2 | Bloomberg BLPAPI, FactSet REST, EDGAR feed, PMS API, Compliance API all handshaking |
| Orchestration engine | Week 2–4 | Server-side 7-agent pipeline live against real data. RAG corpus loaded and calibrated. |
| Output & delivery | Week 4–5 | JSON schema validated, PDF template final, DMS push live, Bloomberg Publishing connected |
| HITL & audit | Week 4–5 | Task queue live, email notifications, immutable audit DB, escalation routing |
| Compliance integration | Week 5–6 | Actimize/Behavox API live, restricted list sync, MiFID II auto-categorisation, Reg FD clearance log |
| UAT | Week 6–7 | 13 representative research events across all 13 scenario types, plus governance refusal cases (uncertified sign, premature release, partial committee, restricted block). Analyst feedback incorporated. |
| Go-live | Week 7–8 | Staged activation: earnings flash first, then ad hoc. 2-week parallel run before full handover. |
Stated as requirements, not claims. Every row below is unbuilt in the demo and in scope for pilot or production. Nothing here is represented as delivered.
| CONTROL | DEMO TODAY | PRODUCTION REQUIREMENT |
|---|---|---|
| Identity · SSO / MFA | Client-side page credential (courtesy gate, source-visible) | Enterprise SSO (SAML/OIDC), MFA enforcement, session policy, deprovisioning on HR events |
| Authorization · RBAC | None — all views open post-gate | Role model mapped to research authority: analyst / supervisory analyst / PM / compliance / IC member; least-privilege on every action |
| Tenant isolation | Single-tenant static demo | Logical or physical isolation per institution; per-tenant keys; no cross-tenant retrieval paths |
| Encryption | Transport only (host TLS) | TLS 1.2+ in transit, AES-256 at rest, key rotation; BYOK / customer-managed keys where required |
| Durable audit ledger | Session-scoped, client-side; exportable binder | Server-side append-only ledger, WORM retention aligned to record-keeping obligations, independent time source, export API |
| Observability | Browser console only | Structured logs, metrics, distributed tracing across agents, alerting with on-call runbooks, SLO dashboards |
| Change management · rollback | 6-gate battery, SHA-256 manifest, versioned archives | Model + prompt registry with approval workflow, staged rollout, one-command rollback, documented change advisory |
| DR / BCP | None | Defined RPO/RTO, multi-AZ or multi-region, tested failover, annual BCP exercise with evidence |
| Security testing | Static review + release gates | Third-party penetration test, dependency and secret scanning in CI, coordinated vulnerability disclosure |
| Data governance | Synthetic data only | Data lineage, retention/deletion policy, DSR handling, no-training-on-client-data contractual commitment, vendor risk assessments |
| SIEM integration | None | Log forwarding to the institution's SIEM; alerting on policy-gate denials, override frequency, and restricted-list hits |
| Model risk validation | Engineering validation (oracle + gates) | Independent institutional MRM validation: documented model inventory, evaluation corpus, benchmark, drift monitoring, annual re-validation |
Owner key: CAIBots = delivered by CAIBots engineering · Client IT = requires client engineering resources · CAIBots + Client = joint delivery with defined interface points