MAKR — AI & Technology Operations Framework

Three Architecture Options

Each option represents a different answer to the question: "How many AI agents does each partner need, and how do they interact with shared fund resources?"

Side-by-Side Comparison

Beyond Agents: Platform & Infrastructure Considerations

The architecture options above address agent-level segregation. But agents operate within a broader technology stack, and each layer carries its own governance requirements.

Platform Layer (e.g., PureBrain)

The platform is where agents live, conversations persist, and memory accumulates. Governance questions at this layer:

• Administration: Who controls user accounts, permissions, and platform settings? Is there a single admin or per-partner control?
• Data residency: Where does the platform store conversation history, uploaded files, and agent memory? Which jurisdiction applies?
• Platform updates: When the platform provider pushes updates, who reviews them for impact on fund operations? How are breaking changes managed?
• Multi-tenancy: Does the platform natively separate partner workspaces, or is everything in a shared environment?
• Backup & recovery: If the platform goes down, what is the recovery process? Who owns the data export?

Infrastructure Layer (Connected Systems)

Fund operations rely on systems beyond the AI platform — cloud hosting, document management, communication tools, and purpose-built infrastructure. Each integration point is a potential data flow that requires governance.

Data Flow Mapping

A complete governance framework requires mapping how data moves across the entire stack — not just within the agent layer:

Without this mapping, governance is applied in silos — agent access is controlled but the same data flows freely through infrastructure with no oversight.

Practical Governance: What Must Be True Regardless of Architecture

Whichever option the partners choose, the following governance elements are non-negotiable for institutional credibility:

1. Centralized Audit Log

Every AI agent action that touches MAKR data must be logged to a shared, tamper-proof audit trail:

• What data was accessed (file name, classification tier)
• Which agent/partner initiated the action
• What was produced (deliverable, analysis, communication)
• Timestamp and session identifier

2. Data Classification Enforcement

The four-tier classification from the AI Ethics paper must be enforced technically, not just by policy:

• Tier 1 (Restricted): Technical block — AI agents cannot access. Stored in separate, encrypted repository. Human-only access with 2FA.
• Tier 2 (Confidential): AI can access with logging. Automatic redaction prompts for names/numbers when producing external-facing documents.
• Tier 3 (Internal): AI has full access. All actions logged.
• Tier 4 (Public): No restrictions.

3. Monitoring & Alerting

Someone or something must watch the watchers:

• Automated alerts for: agent accessing data outside its authorized zone, unusual volume of data exports, access to Tier 2 data outside business hours
• Weekly digest to the designated AI governance owner summarizing all agent activity across the MAKR workspace
• Quarterly review of audit logs as part of standard compliance cycle

4. RAG Architecture (Retrieval-Augmented Generation)

A shared document repository with intelligent search would solve multiple problems simultaneously:

• Efficiency: Agents query a central knowledge base instead of each loading full documents into their context window. Reduces token consumption by 60-80%.
• Access control: The RAG layer enforces who can search which documents. Tier 1 documents excluded entirely.
• Consistency: All agents reference the same source of truth for fund documents, policies, and precedents.
• Audit: Every query is logged — who searched for what, when, what was returned.

RAG is not a separate system — it is the middleware layer that serves as access controller, search engine, and audit logger in one.

5. Platform Governance

The platform hosting AI agents requires its own governance layer, separate from agent-level controls:

• Platform administrator role: A designated individual (may overlap with AI Governance Owner) responsible for user management, permission settings, and platform configuration
• Change management: Platform updates reviewed before adoption. Configuration changes logged with before/after state
• Vendor management: Annual review of platform provider's security posture, certifications, and terms of service. Push for SOC 2 / ISO 27001
• Data portability: Regular export of critical data (conversation history, agent memory, deliverables) to fund-controlled storage. Prevents vendor lock-in and ensures business continuity

6. Infrastructure Register & Integration Authorization

Every system that touches fund data must be inventoried and authorized:

7. Partner Boundaries Agreement

All partners must explicitly agree on:

Questions Requiring Partner Alignment

These cannot be decided unilaterally. Each requires explicit agreement from all GPs.

Platform & Technology

Q1: Does PureBrain support multi-tenant access controls?

If not, Option A requires custom middleware development. Option B becomes more practical despite its higher friction. This is a factual question to put to PureBrain's team before the partners meeting.

Q2: Should MAKR pursue its own AI infrastructure (self-hosted) or rely on PureBrain?

Self-hosting (e.g., private Claude API deployment) eliminates third-party data concerns entirely but adds operational complexity and cost. At what AUM does this become justified? The AI Ethics paper noted PureBrain lacks SOC 2 and ISO 27001 certification — does this matter pre-first-close or only post-institutional scale?

Q3: Who administers the platform, and is that the same person as the AI Governance Owner?

Platform administration (user accounts, permissions, settings) is a technical role. AI Governance (policy, audit review, incident response) is a compliance role. They may be the same person in a lean team, but the responsibilities are distinct. Which partner takes this on?

Q4: How are new tools and integrations approved?

If a partner wants to connect a new research tool, analytics platform, or third-party API to their workflow, does that require GP approval? What if the tool touches MAKR data indirectly? A lightweight approval process prevents shadow IT without creating bureaucratic overhead.

Q5: What is the data residency position across the full technology stack?

Different systems may store data in different jurisdictions. The AI Ethics paper identified this as a gap for PureBrain specifically, but the same question applies to every system in the stack. What is the fund's position on acceptable data residency jurisdictions?

Q6: How does purpose-built infrastructure fit into the governance framework?

Systems built specifically for fund operations may serve as the middleware/RAG layer discussed in this paper, or may operate independently. The governance framework needs to account for these systems — who builds them, who maintains them, how they connect to the agent and platform layers, and how data flows through them.

Partner Alignment

Q7: Is each partner comfortable with their AI agent operating in a shared workspace?

Some partners may prefer complete separation (Option B) for peace of mind, even at the cost of efficiency. This is a values question, not a technical one.

Q8: What happens to AI-generated work product if a partner leaves?

If a partner's personal AI produced a deal memo that became a MAKR deliverable, does MAKR retain it? What about research notes? Strategic analyses? This needs to be addressed in the partnership agreement.

Q9: How should partners handle research that crosses personal/MAKR boundaries?

Example: A partner researches a topic for personal interest that turns out to be directly relevant to MAKR's thesis. Under the chosen architecture, how does that research move from personal zone to MAKR zone? Automatically? By explicit publication? With attribution? This is a common real-world scenario and needs a clear, low-friction process.

Governance & Roles

Q10: Who should be the AI Governance Owner?

This person reviews audit logs, handles incidents, updates the AI Use Policy, and answers LP questions about AI governance during ODD. It should be someone who understands both the technology and the regulatory landscape.

Q11: What is the budget for AI governance infrastructure?

Options range from ~$1,200/year (policy + basic tools) to $50K+ (custom middleware, RAG infrastructure, compliance tooling). The Ethics paper estimated $5-15K for outside counsel review. Where does this sit in the fund's operational budget?

Implementation

Q12: Timeline — what must be in place before first close vs. can evolve after?

Minimum before first close: AI Use Policy, LP disclosure language, NDA provisions, partner boundaries agreement. The full technical architecture (RAG, middleware, audit system) can be phased.

Tarin's Recommendation

Why Option A

The competitive advantage of MAKR's AI-first operating model comes from context richness. Each partner's AI has been learning for months — understanding their thinking patterns, research preferences, communication style, strategic instincts. Splitting that into two agents (Option B) doesn't just double the cost — it halves the intelligence. The MAKR agent starts from zero while the personal agent retains everything.

The cross-pollination between personal research and fund thinking is not a bug — it's the feature. The partner who explores a topic for personal interest and then brings that knowledge to a MAKR deal discussion is exactly the behavior we want to encourage, not architect around.

Why Not Option C

Option C (one agent, two portals) is the lowest-friction approach but relies on the agent correctly identifying which mode it's in. Consider a scenario where a partner's content is accidentally published to the shared fund workspace through a default configuration. The failure mode isn't malice; it's defaults. Option A's technical zone enforcement is a harder boundary than Option C's trust-based approach.

Why Option B as Fallback

If PureBrain cannot support access zones and custom middleware is not justified pre-first-close, Option B provides the cleanest separation. The context loss is real but manageable — partners can explicitly share relevant research with their MAKR agent. The key advantage: when an LP asks "how is partner data segregated?", the answer is simple and auditable: "separate agents, separate data stores, logged interactions."

Phased Implementation

What This Paper Is Not

• This is not a final policy document — it is a working paper for partner discussion
• This does not prescribe a single answer — it presents options with trade-offs for collective decision
• This does not replace legal counsel — the chosen architecture should be reviewed by fund formation counsel
• This does not commit to any platform — the framework is platform-agnostic