User Agents as the New VBA

Widespread adoption of agentic AI creates a new area of concern for operations and technology leaders at investment management firms. They imagine end users easily developing their own agents using no-code builders, copilot studios, or a few lines of script wired into an LLM API, creating a proliferation of ways to access core systems, each of them a new set of risks to manage. The idea is similar to previous concerns about “shadow IT,” now framed as questions about agentic AI governance. A world with each desk running its own bespoke tooling seems conceivable.

Although the technical means are different, in many ways, this is like the situation where any portfolio team or operations analyst can create their own Visual Basic for Applications (VBA) macros in Excel. More seasoned leaders have seen this before. People would build their own Excel workbook loaded up with customized functionality. But ultimately, only the builders understood how they worked. Just one key person leaving could create business continuity risks.

However, that similarity also includes a point of reassurance. As VBA became more common in the industry, new risk and governance practices emerged. Internal audit would review what desks built, determine whether anyone had documented it and how critical each process was, and then risk-rank the answers.

The good news is that these same mechanisms have their analogs in an agentic world. There is no Wild West scenario when firms apply the same level of operational and technical risk scrutiny as they have with any other technology. The most powerful way to look at it can be quite simple. If you don't want it to happen, don't let it happen.

However, there is one noticeable difference. VBA code is fully readable line by line. Its behavior doesn't change unless someone edits it. That makes it easier for another user to interpret or enhance it. But a model-based agent can behave differently across runs. It often will send prompts or data to a third-party model provider outside the firm's walls. These differences add to the governance challenge for agentic AI. Firms also need control over where prompts and outputs travel, whether outside model providers retain anything, and how a decision gets reconstructed after the fact when there's no macro to open and read.

Keeping user-built agents in their place

Agentic AI is not an all-or-nothing proposition. The main distinctions to keep in mind center on the data and systems that agents interact with. Giving users the ability to create an agent to help with daily coordination or communication can be both low-risk and highly efficient. These use cases do not touch live position or transaction data.

For example, consider a sales lead on a private markets team. They might create an agent to deliver a daily digest across email, chat, calendar, and CRM every morning. It's a roundup across disparate systems that does not write any data to them. It might provide a briefing on the current day's tasks and any open tasks from the previous day. A second agent might read weekly marketing signals, deduplicate any repeat data into one profile per prospect, and stage outreach emails based on templates. Even then, the agent only cues drafts. A human still needs to press the send button.

Agents like these change a human worker's capacity. Someone who could previously handle only 10 tasks a day can now handle 50 once agents carry out the low- and mid-level work. The human worker can focus on exceptions and judgment calls. This can even start to get close to portfolio data, such as a hypothetical private spreadsheet of deal flow that shows which analyst sourced what for use during internal performance conversations. You draw the line based on whether the data or workflows are mission critical.

The enterprise line

Other use cases fall clearly on the other side of the mission-critical line. Even within these enterprise-level tasks, there can be some degree of variation. Some workflows may require toggling through several different screens to compose an answer. An agent could streamline interactions with various user interfaces.

For example, you might have a specific procedure for how you handle stock splits, but the details of how corporate actions analysts get there don't matter if they achieve the same final answer. An agent built for this processing could aggregate data across systems, propose the handling of the action, and kick out exceptions to a specialist. A second approver could verify the entries before they lock into the security master and then affect everything from the order management system (OMS) to accounting and investor reporting. The data lands in your golden source once and then egresses to every downstream system.

What firms need to standardize is how they verify that golden entry, including the lineage of the data that flows from the action to live operational systems. We advise clients to draw the line where autonomy ends. A portfolio manager at a large alternative firm might run their pitch book sector analysis and sizing logic in all sorts of ways. But the moment a decision becomes a trade, it enters the firm's system of record in one standard way. The standardization matters because everyone downstream depends on that single entry.

The existing playbook

Holding the enterprise line takes no new discipline. That's where experience with other tools that put technology power in your teams' hands, such as VBA, comes into play. As firms assimilated the use of that technology, controls like audit inventories, documentation requirements, and risk rankings put governance into action. The control inventory hasn't changed. Everything that you already put in place around policies, procedures, entitlements, and segregation of duties can extend to this new agentic world.

These mechanisms split between two owners. The COO draws the operational box, meaning the guardrails a process must stay inside. The CTO sets the technical parameters that make leaving the box impossible, so a firm that trades through one OMS gives a trade nowhere else to go. You could imagine a fleet of delivery vehicles by analogy. Drivers can and should refill the vehicles at any approved gas station, but they can't exceed the speed limit by more than 5 miles per hour.

Something comparable has happened with other technologies, even much simpler ones. One day, CTOs realized that workers could bring thumb drives into the office and potentially copy data. At first, it was a problem; then it became a policy. Once CTOs identified the exfiltration risk, they locked down USB ports to ensure users couldn't copy or steal data.

The most AI-forward firms already run by such a rule. Asked whether Goldman Sachs employees can install their own AI tools on work machines, the bank's Chief Information Officer, Marco Argenti, said the firm remains locked down to its corporate app store, then described how far those controls extend to agents themselves. Although Goldman is a bank, not an asset manager, the underlying principle carries over directly to private markets firms.