Prototype · 2026 · Claude agents
Fund Ops governed agent workflow
A local fund-administration prototype that delegates document review to Claude subagents while keeping permissions, exact calculations, drafting, and approval under explicit control.
Problem
Agentic document workflows need useful delegation without allowing untrusted files, shared reasoning, or a convenient tool call to bypass review and human accountability.
My role
Agent architecture, skills, subagent boundaries, hook guardrails, deterministic scripts, tests, and local operator dashboard
Stack
How the work moves
- Step 01CommandA human starts a scoped workflow
- Step 02Main sessionSkills coordinate deterministic scripts
- Step 03Isolated subagentsRead, review, and compliance roles
- Step 04Human approvalExact draft is approved; nothing is sent
The control problem
Fund administration combines untrusted documents, exact financial facts, judgment calls, and communications that may leave the organization. Fund Ops is a portfolio prototype for exploring that workflow with Claude Code without collapsing every responsibility into one powerful agent.
The governing rule is simple: the model may prepare work, but it cannot approve or send it. The local application uses fictitious demo data, and every run remains inspectable through its drafts, decisions, and audit records.
Three subagents, three reasons
The document reader is a read-only extractor. It receives untrusted files with only the tools needed to read and search them. A prompt-injection guard runs before an agent opens a document, and document content is treated as data rather than instructions.
The reviewer performs an independent second check. It never sees the drafter's reasoning, so its verdict is not anchored to the first pass. Its shell access is restricted to a narrow allowlist of deterministic checks.
The compliance gate reviews the exact text that is about to become a draft. It can inspect only the inputs required for that decision and cannot rewrite the content it is judging. This separates preparation, independent review, and final policy checking instead of asking one context to police itself.
Guardrails that execute
Prompt instructions describe the intended behavior; PreToolUse hooks enforce the boundary in code. reviewer_bash_allowlist permits only the approved checking scripts and rejects command chaining. compliance_gate_guard restricts both commands and readable paths for the gate. human_only_guard prevents the model from invoking the real approval path or starting the application in a mode that could blur human and simulated actions.
Exact work stays deterministic. Scripts calculate amounts and dates, lint drafts, persist approved artifacts, and record task state. Skills and slash commands coordinate the workflow, while tests exercise the permission boundaries and the local dashboard exposes runs, approval queues, quality checks, and the audit trail.
Approval is a separate authority
The /approve command is human-only. It records who approved the exact draft and when, but it does not send anything. Fund Ops never sends messages; it prepares traceable work for a person to review and carry forward.
Private repository; walkthrough available on request.