Controls, risk and limitations

Short answer

No capital moves without human approval.

The portfolio manager reviews the strategy before it is assigned to a client, and reviews the allocation and cash reserve before orders are generated.

Work is divided between three roles (Stock Analyst, Portfolio Manager, Operations), five access roles limit who can read, write or approve, and every user action is timestamped, attributed and immutable.

Machine learning is used in two bounded places and makes no capital-affecting decision.

The platform is built and running. It has not yet executed in a live account, and an institutional maker/checker approval gate for order generation and execution is listed as coming next.

What we can show

• Strategy Review, Step 05: ten instruments with weights, assigned indicators and optimisation status, reviewed by the portfolio manager before any client assignment.
• Asset Allocation, Steps 07-08: the portfolio manager reviews the allocation and cash reserve before orders are generated.
• Order Management: symbol, side, quantity, status and full timestamp for each order.
• Permission Matrix: five roles, seven resources, Read, Write and Approve permissions. Compliance has read-only access to the Audit Log and Orders, with no write permission anywhere. Permissions are seeded by database migration and are immutable once deployed; a change needs a new migration file.
• Audit Log: every user action is timestamped, attributed and immutable, with IP address and correlation ID, readable by the Admin and Compliance roles. The screen shown holds seven events from a single day.
• Signal notifications: approved, ML-blocked and low-confidence signals are reported to the operator after each execution cycle.

Status date: WP-06 and WP-09 are current as of 4 August 2026.

What this means

The control you can inspect today is a trail: who reviewed what, in which role, and when. It is a record of human review, held in a platform that has not yet run a client account.

Whether role separation and review steps are enough for order release, without a second-person gate, is for your risk committee to decide.

Vektor does the work. You still own the outcome.

What remains unproven

• Live operation: no live account has run. Live order submission begins with the first Proof Partner’s first production period.
• Maker/checker: listed as coming next. BW-01 states the architecture is designed for it and implementation is in progress.
• Post-trade: WP-06 covers the pre-trade compliance workflow only. Post-trade monitoring, automated breach detection and regulatory reporting are on the roadmap.
• Risk mitigations: WP-09 identifies fourteen risks, and several mitigations are on the roadmap, not working today.
• Regulatory alignment: the match to the AI governance principles of five regulators is our own statement (BW-04). Regulatory responsibility remains with the licensed entity using it.