阅读说明：本文是产品与技术边界讨论，不构成法律意见、证券投资建议或相关金融业务资质声明。监管要求以现行正式法规和适用主体为准。
让 Agent 查基金资料和让 Agent 替用户决定买基金，表面上可能只差一句提示词：“根据这些资料给出建议。”但从系统设计看，差的不是语气，而是服务承诺、授权对象、事实责任以及最终谁能够产生经济后果。
做个人 ETF 研究助手时，我们始终遇到一个容易被混淆的词：帮助投资决策。它可以是解释公开指数差异、指出组合重复暴露，也可能进一步成为针对某个用户的具体标的、数量和行动建议，甚至是下单执行。若将这些动作全部放进“投资分析”一类工具，模型回答再流畅，也说不清产品究竟在提供什么服务。
一、相似的问题，可能要求完全不同的权利
考虑三句话：
“沪深 300 和中证 500 的指数编制有什么差别？”通常可以在获准公开资料范围内做解释。
“结合我的持仓和期限，比较两种配置风险。”需要当前个人持仓和投资目标的使用许可，输出也应交代来源时点、假设和局限。
“按这个方案替我买入。”则已经要求改变外部账户资产状态。研究权限、用户表达了购买意愿、系统存在某个交易接口，都不能单独授予执行权限。
我们在 ETF Agent 里把模型理解的动作与实际准入分开；研究能力本身没有自动交易的权威。这里讨论的是一种只读研究系统的工程选择，不能被读成我们已经具有证券投资顾问业务的资质，也不能被读成某项“推荐”只要加一句免责声明就一定合规。
二、法律上的业务边界，不能让模型靠关键词判断
中国证监会《证券投资顾问业务暂行规定》自 2011 年起施行，涉及证券投资顾问业务的监管要求；《证券期货投资者适当性管理办法》对向投资者销售证券期货产品或提供相关服务的经营机构提出了解投资者、产品服务分级、风险揭示和匹配等要求。
这里必须尊重它们的主体和业务适用条件。并不是所有公开金融知识问答都自动构成受监管的证券投资顾问业务，也不能据此推出所有场景的 AI 输出都必须转人工。究竟进入哪种业务，取决于提供者身份、服务内容、获利方式、适用司法辖区及具体监管安排，需要业务与法务确认。
工程系统应该先明确产品允许提供的服务类型，然后让相应准入和流程得到落实；不应让模型根据“用户似乎只是在聊聊”来绕过规定，也不应该用几条含有“买入”或“收益”的规则，把所有正常金融教育问题一刀切地拒绝。
三、从金融事实到行动，至少要经过三次不同判断
一条合理的研究路径可以这样拆：研究范围 → 资料读取 → 计算与假设 → 研究交付 → 独立行动边界 → 获准的外部动作。
第一道是数据准入：哪些公开文件可读，私人持仓是否在当前用户的获准范围内，资料是否过期。模型提出检索范围，但不能通过自己写一句“我已获授权”创造权限。
第二道是解释与计算：基金穿透后的风险暴露、费用、日收益率和回撤等量要明确数据窗口和计算方法。确定性计算可以减少某类数值错误，却不能自行决定用户应当持有什么仓位。
第三道才是行动边界：研究正文、一般性风险提示、个性化投资建议和实际执行，不能因为共享了一份报告，就共享相同的审批与确认方式。对于可能需要单独资格或更高授权的业务，必须由独立业务流程处理；没有相应授权的动作不应该被假装提供。
这里的获准外部动作只是边界示意，不是当前 ETF Agent 已经具备交易能力的证明。
四、合规不等于把所有有用回答都挡住
用户问一项公开基金指标，某个私人数据授权失败，不代表公开解释也应终止。对一份资料的来源资格未知，不应自动升级成模型“全文不准回答”。我们在多轮发布和授权治理中学习到：限制应当沿实际数据依赖与动作类型作用，而不是一处拒绝抹去整场研究。
这套做法有两个方向的风险。放得太松，模型会将没有来源、没有当前资格或没有业务授权的结论包装为专业建议；收得太紧，系统只能输出空洞的模板免责声明，用户反而得不到合法且必要的事实解释。
真实运行里仍存在过研究证据不足、数值结论不完整、来源引用未能逐项匹配等问题。我们可以诚实地交付被证实的部分和未知的部分，但不能把“系统拒绝了不确定事实”包装成“投资者获得了更高收益”。
五、监管主体和技术实践也不能混在一起
2026 年 6 月 18 日国家金融监督管理总局公布的《关于银行业保险业人工智能安全开发应用的指导意见》强调使用方责任和分类分级治理，其直接适用对象是所规定的银行、保险等机构，不能无条件代替证券领域监管规则。它与证券行业的要求可以形成技术治理的启示，但不能据一份指导意见宣布所有金融机构承担完全相同的法定义务。
技术团队更值得建立的是可审查的业务能力边界：谁是用户、访问什么资料、输出声明了哪些前提、是否产生了副作用、何时需要另一个合规业务流程。模型负责提议，产品规则负责许可，外部动作必须拥有相应可核验的确认与执行事实。
对于仅面向个人研究的 Agent，认清“我现在只提供研究，不代用户交易”并不是功能弱，而是让服务承诺与真实能力一致。对希望拓展到投顾或交易的团队，这个分界点也恰好告诉你：不能只增加一个买卖工具，而必须先重新确定产品、合规和执行责任。
延伸阅读
阅读原文 · 如果这些思考对你有帮助，欢迎给 ETF Agent 工程手记 点个 Star。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Read: This is a product-technology boundary discussion and does not constitute a legal opinion, a securities investment proposal or a statement of qualifications in the relevant financial business. Regulatory requirements are based on existing formal regulations and the applicable subjects.
Let Agent check the Fund's information and let Agent decide to buy the Fund on behalf of the user, which may appear to be only one sentence short of prompt: “Proposal based on this information.” In terms of system design, however, it is not rhetoric, but service commitments, mandate holders, factual responsibilities and ultimately who can have economic consequences.
When we're personal ETF research assistants, we've always come across a word that is easily confused: helping investment decisions. It can be an explanation of the differences in the open index, an indication of the double exposure of the portfolio, or it can further become a specific target, number and recommendation for action for a user, or even the next line of action. If all of these actions are placed in a tool such as “investment analysis”, the model answers flow smoothly and it is not clear what the product is providing.
I. Similar issues, which may require entirely different rights
Consider three words:
What difference does it make between the indexing of 沪 300 and 深 500?” This is usually explained in the context of authorized public information.
“By comparing the two configuration risks with my hold and duration.” Permits are required for current personal hold and investment targets, and the output should also account for the timing, assumptions and limitations of the source.
“Buy for me under this programme.” A change in the status of the external account assets has been requested. The study of permission, the expression of the user ' s willingness to purchase, and the existence of a transactional interface in the system, cannot be separately awarded for the execution of permission.
We separate the actions that models understand from actual access in ETF Agent; the research capability itself does not have the authority to trade automatically. What is being discussed here is the engineering option of a read-only research system, which cannot be read as having the qualifications of a securities investment adviser or as having the status of a “recommended” statement of exemption.
II. Legal business boundaries that do not allow models to be judged by keywords
The CSRC Provisional Regulations for the Operations of Securities Investment Consultants, which have been in force since 2011, address regulatory requirements for the operations of securities investment advisers; and the Measures for the Regulation of the Appropriateness of Securities Futures Investors, which require operators selling securities futures products to investors or providing related services to know investors, product service ratings, risk disclosure and matching.
Their subject matter and operational conditions must be respected here. Not all publicly available financial literacy questions and answers automatically constitute regulated portfolio investment advisers, and not all AI outputs that are launched on this basis must be manual. The type of business to be entered depends on the identity of the provider, the content of the service, the manner in which it is made available, the applicable jurisdiction and specific regulatory arrangements, and requires operational and legal confirmation.
Engineering systems should first identify the types of services that products allow to provide and then allow corresponding access and process to be implemented; models should not be allowed to circumvent regulations on the basis of “user seems to be just talking” and should not be systematically rejected with rules containing “buy-in” or “proceeds”.
III. At least three different judgments from financial facts to actions
A reasonable research path can be broken down as follows: the scope of the study, the reading of information, the calculation and the assumption of the study, the delivery of the independent operational boundary, the authorized external movement.
The first is access to data: which public documents are readable, whether the private hold is within the limits of the current user approval, and whether the information is outdated. The model proposes a search range, but it cannot create permission by writing “I am mandated”.
The second is the interpretation and calculation: the risk exposure, cost, daily rate of return and the return equivalent of the Fund's penetration need to be clear about the data window and calculation method. The calculation of certainty would reduce the number of numeric errors in a given category, but would not be able to determine for itself what slot the user should hold.
The third is the boundary of action: the body of the study, the general risk alert, the personalized investment recommendations and their actual implementation, and the same approval and confirmation modalities cannot be shared by sharing a report. For operations that may require separate qualifications or higher delegation of authority, they must be handled in an independent business process; actions without corresponding delegation of authority should not be pretended to be provided.
The authorized external action here is only a border indication, not a proof that ETF Agent is trading capability.
IV. Compliance does not block all useful answers
Users ask about an open fund indicator, a private data authorization that fails and does not represent a public explanation should be discontinued. The origin of an information is unknown and should not automatically be upgraded to a model “unable to answer the whole text”. We learned from multiple rounds of publish and delegated governance that restrictions should function along the lines of actual data dependency and action type, rather than a single refusal to erase the entire study.
There are two risks to this approach. To be too loose, the model will package conclusions that have no source, no current qualifications or no business authorization as professional recommendations; to be too tight, the system will only be able to export empty template exoneration statements and the users will not have the legal and necessary factual explanations.
Insufficient research evidence, incomplete numerical conclusions and the failure of source references to match items still exist in real operations. We can deliver the proven and unknown in good faith, but we cannot package the “systemic rejection of uncertainty” as “higher returns for investors”.
V. Regulatory subjects and technical practices cannot be mixed
The Guidance on the Application of Artificial Intelligence Security Development in the Banking Industry, published by the General Directorate of Financial Supervision on 18 June 2026, emphasizes user responsibility and hierarchical governance, which is directly applicable to the required banking, insurance and other institutions and cannot be an unconditional substitute for regulatory rules in the area of securities. It and the requirements of the securities industry can be a source of inspiration for technical governance, but it cannot be declared that all financial institutions have exactly the same legal obligations under one guidance.
What is more worthwhile for the technical team is to establish a reviewable operational capability boundary: who are the users, what information is visited, what preconditions are stated, whether there are side effects and when another compliance business process is required. Models are proposed, product rules are licensed, and external movements must have corresponding verifiable confirmation and enforcement facts.
For Agent, which is solely for personal research, it is clear that “I now offer only research, not trading on behalf of users” is not a weak function, but rather an alignment of service commitments with real capabilities. For those who wish to reach out to investors or traders, this point of demarcation is also just as good as telling you that there must be no more than an additional tool to buy and sell, but that product, compliance and enforcement responsibilities must be redefined.
Extended reading
Read the originals. If these thoughts help you, welcome to the ETF Engineering Handwritten by Star.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.