AI agents for credit agreement review are a narrow, useful thing and a governance problem at the same time. The useful part: reading a credit agreement as amended, following every defined term to its definition, grading each lender protection against a written standard and measuring what a borrower could move today is mechanical work that software does faster and more consistently than a person reading under deadline. The governance problem: the federal banking agencies' own model risk guidance, revised in April 2026, says in terms that generative and agentic AI are outside its scope. LME Protection Review, Botminds' software for private credit funds, answers that by writing the limits into the agents themselves — no finding without its clause, no unsigned document applied, no contact with a borrower, an administrative agent or a sponsor — and leaving every decision that costs something to a named person.
The fund, the loans and the people in the examples are fictional sample data inside the solution: Marrowstone Credit Partners, 64 loans, 216 documents, $4.02 billion held. The regulatory material is quoted from the agencies' and NIST's own publications, linked under each figure.
What six agents divide between them when a book is read
“An AI agent reads the agreement” is not a design. The work splits into tasks with different failure modes, and giving each to a separate agent with a written limit is what makes the output checkable. On the sample book, one question — which loans would let a borrower move assets out of the lenders' reach and also prime them without consent — takes 38 seconds across 216 documents and returns 22 quoted clauses.
One question in LME Protection Review: six agents, one decision
Agent
Agreement stackerApplies every amendment, waiver and joinder in the order it took effect, to give each agreement as it reads today.
Never: applies an unsigned or ineffective document — requests are held as pending
Agent
Definition tracerFollows each defined term to its definition and to every place it is used — 1,412 of them on this book.
Never: infers a definition that is not written
Agent
Blocker graderGrades each of the eight protections strong, weak or missing against the fund's checklist and says exactly why.
Never: grades without quoting the clause
Agent
Basket calculatorMeasures how much value could move to unrestricted or non-guarantor subsidiaries, basket by basket.
Never: uses projected or pro forma earnings the agreement does not allow
Agent
Answer writerWrites the answer in plain words with a numbered source on every finding.
Never: states a finding without its clause, or contacts a borrower, agent or sponsor
A person decides
Portfolio manager, then counselDecides which gaps to raise and on which consent; counsel approves every piece of drafting before it leaves the fund.
The division is not cosmetic. A tracer that cannot find a definition reports an undefined term instead of guessing one, and that report is visible rather than buried in a confident paragraph. A grader that must quote the clause cannot produce a grade from a summary of a clause. Each limit converts a plausible-sounding failure into an explicit one.
Each agent's work in view before an answer is written
Why “AI agents” and “a scoring model” are not the same regulatory question
Most written guidance about AI in lending was drafted for a different object: a model that takes structured inputs and returns a number, which can be back-tested against outcomes. An agent that reads a 400-page document and reports that §7.06(c) covers intellectual property only is not that. There is no distribution of outcomes to compare it against; there is a clause, and either the quotation is accurate and the comparison against the checklist is right, or it is not.
That difference changes what validation means, and it is the reason a fund cannot discharge the question by pointing at an existing policy for its scoring models. The two need different evidence: one needs performance measured against realised outcomes, the other needs its citations checked by someone who can read the agreement.
Does SR 26-2 cover an agent that reads and grades a credit agreement?
On its face, no — and the letter says so itself. SR 26-2, issued on 17 April 2026 by the Federal Reserve, the OCC and the FDIC, replaced the fifteen-year-old SR 11-7 as the agencies' model risk management guidance. Its third footnote draws the boundary.
Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance.
Federal Reserve, OCC and FDIC, SR Letter 26-2, Revised Guidance on Model Risk Management, 17 April 2026
The same footnote does not leave a vacuum behind it: “a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.” In other words, the agencies declined to write the rulebook and told supervised institutions to apply their own judgement — which is a harder instruction than a checklist, not an easier one.
Two further qualifications matter for a private credit fund. The letter is addressed to banking organizations, and the Federal Reserve notes it is “expected to be most relevant to banking organizations with over $30 billion in total assets”; a private credit fund or a business development company is not a banking organization and is not supervised under it. And the guidance states of itself that it “does not set forth enforceable standards or prescriptive requirements”. The honest summary is that the applicability question is open, and that what fills the gap today is the fund's own policy and the product's own limits.
What an AI agent should never be allowed to do in lending, written as prohibitions
A policy written as a list of permissions tends to age badly, because the next capability is not on the list. A policy written as a short list of prohibitions ages better. These are the ones built into this software, one per agent, and they are a reasonable starting point for an internal standard whatever tool a fund uses.
The six agents of LME Protection Review, and the six limits written into them
| Agent | What it does | What it may never do |
|---|---|---|
| Agreement stacker | Applies every amendment, waiver and joinder in effective-date order. | Apply an unsigned or ineffective document. A borrower's request is read and held as pending. |
| Definition tracer | Follows each defined term to its definition and every use of it. | Infer a definition that is not written. Undefined terms are reported, not assumed. |
| Blocker grader | Grades each protection strong, weak or missing against the fund's checklist. | Grade without quoting the clause. A change to the checklist needs counsel's approval. |
| Basket calculator | Measures what could move to an unrestricted or non-guarantor subsidiary. | Use projected or pro forma earnings the agreement does not allow, or hide a basket inside a total. |
| Answer writer | Writes the answer with a numbered source on every finding. | State a finding without its clause, or contact a borrower, an administrative agent or a sponsor. |
| Amendment watcher | Reruns the standing questions when a document arrives and reports what changed. | Mark a gap closed before the amendment that closes it is signed and effective. |
The prohibition on contact is the one worth defending explicitly, because it is the one a vendor is most tempted to relax. A message to an administrative agent is a negotiating act. It commits the fund to a position, it can be read as a waiver of rights or as consent, and it is made by a party that cannot be called to explain itself. Asks drafted by the agents reach the other side only after the portfolio manager has decided and counsel has approved the drafting.
Should an AI agent be able to change a loan's risk rating?
It should not, and in this software it cannot. The agents produce findings — a protection graded weak with the clause that makes it weak, a figure for what could move today — and those findings are inputs to a rating decision that a credit professional makes and signs. The distinction holds even when the finding is unambiguous, because a rating is a statement the fund makes to its investors and its auditors, and the accountability for it has to rest on a person.
The useful test when drawing this line in an internal policy is to ask what the output is used for rather than how it was produced. A grade that informs a human decision is a reading. A grade that automatically moves an exposure, releases a payment, or changes a reported number is a decision, and a decision made by software needs the governance a decision gets.
What happens when an agent can't find a source for a clause?
It says so. That sounds trivial and it is the single most important behaviour on the page, because the failure mode of a language model reading a long document is not silence — it is a fluent, specific, wrong sentence. The rule in this software is that a finding without its clause is not a finding: the answer writer states that it could not locate the provision rather than describing one, the definition tracer reports an undefined term rather than supplying a reasonable meaning, and the stacker flags a document it cannot match to a loan instead of leaving it out quietly.
For a reader evaluating any tool in this category, that behaviour is checkable in five minutes. Ask it a question about a protection the agreement does not contain, and see whether what comes back is “there is no such provision in this agreement” or a paragraph describing one.
How NIST's human-oversight principle applies when the reader is an agent
The most usable framework here is not a banking rule at all. The National Institute of Standards and Technology's AI Risk Management Framework asks organisations to be explicit about where a person sits in relation to an automated system, and to write it down rather than assume it. Two of its subcategories do most of the work for a fund drafting a policy for document-reading agents.
Four things to write down before agents read your book
- Define and differentiate the roles
NIST GOVERN 3.2: “Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.” Name who reads, who decides and who approves.
- Document the oversight process itself
NIST MAP 3.5: “Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.” Oversight that exists only in practice cannot be assessed.
- Say what proficiency the reviewer needs
NIST MAP 3.4 asks for processes covering operator and practitioner proficiency with system performance and trustworthiness. Checking a quoted clause requires someone who can read the agreement.
- Fix the scope the system is approved for
A tool approved to grade protections against a checklist has not been approved to value collateral or to advise on strategy. Write the boundary before the first question, not after the first surprise.
NIST also makes a point that is easy to miss and relevant to a grading tool: human-AI configurations “can span from fully autonomous to fully manual”, and some systems “may specifically require human oversight”. The question is not whether oversight exists in principle but at which step it is exercised. In this work the step is the one before anything leaves the fund.
What “effective challenge” looks like when the model is an agent, not a score
The agencies' phrase for independent scrutiny survives the change of object, even though the letter containing it does not cover agentic systems. SR 26-2 describes “effective challenge” as “the critical analysis conducted by objective experts who evaluate model risk and effect appropriate changes throughout the model lifecycle, from model development to ongoing monitoring”, performed by people with the expertise, the independence and the organisational standing to effect change.
Translated to a reading-and-grading tool, that is an uncomfortably practical list. The objective expert is counsel, or an outside firm. The critical analysis is rereading a sample of graded clauses against the agreements and asking whether the grade follows from the quotation. The standing to effect change is the authority to alter the checklist, which in this design counsel already holds. None of that requires a statistical validation exercise, and all of it requires someone to actually open the agreements.
How do you validate an AI model used for credit risk?
For a conventional credit risk model the agencies describe components that have been stable for years: conceptual soundness, outcomes analysis comparing outputs to real-world results, and ongoing monitoring, with a further expectation that vendor products are understood and monitored rather than taken on trust. For a document-reading agent, the same three headings still organise the work, but what fills them changes.
Validating a scoring model and validating a reading agent: the same headings, different evidence
A credit risk scoring model: Design, assumptions, data selection and developmental testing, documented and critically reviewed.
An agent that reads and grades clauses: Is the grading standard written down, owned by counsel and versioned? A grade is only as sound as the checklist behind it.
A credit risk scoring model: Outputs compared with realised outcomes against performance thresholds.
An agent that reads and grades clauses: A sample of findings reread against the agreements: does the quoted clause exist, and does the grade follow from it?
A credit risk scoring model: Performance tracked over time; material errors or persistent deviations escalated.
An agent that reads and grades clauses: Every new signed document reruns the standing questions, and what changed is reported to the people who own the loans.
A credit risk scoring model: Understand the vendor model's soundness, design and performance; monitor it rather than rely on it.
An agent that reads and grades clauses: The same, plus: can the tool be graded against your checklist rather than the vendor's?
A credit risk scoring model: A number that is reliably wrong in one direction.
An agent that reads and grades clauses: A confident sentence about a clause that is not there.
If a fund takes one procedural idea from this page, make it the second row. A quarterly reread of twenty graded clauses by someone who can open the agreement is worth more than any amount of vendor documentation, and it is the only test that catches the failure mode that matters.
Where the person still has to decide
The agents end their work at a list of findings with the clauses behind them. Everything after that is judgement: whether a weak protection is worth a consent, which of six asks to make, how hard to push a sponsor the fund wants to do more business with, and whether a loan's rating should move. Those are the decisions that make money and lose it, and they were never the slow part.
Where the reading stops and the decision starts
That is the whole claim of an agentic design done carefully: the mechanical reading gets faster and more complete, the decisions stay exactly where they were, and every finding can be traced back to the words that produced it. What to ask a vendor turns the same principles into questions for a buying process, and LME Protection Review shows the agents running on a sample of your own agreements.
Questions people ask
Do AI agents read credit agreements as amended, or only the original?
It depends entirely on the tool, and it is the first thing to test. In this software the agreement stacker applies every signed amendment, waiver and joinder in the order each took effect, and every finding is reported against the agreement as it reads today. A tool that answers from the original document will confidently describe protections that an amendment removed years ago.
Is an agent that grades credit agreements covered by model risk guidance?
Not by SR 26-2 as written: its third footnote places generative and agentic AI outside the guidance's scope, while telling banking organizations to apply their own risk management and governance practices to tools it does not cover. A private credit fund is in any case not a banking organization. The practical answer is that the fund's own policy, plus the limits the tool enforces on itself, is what governs today.
Can an AI agent sign off on an amendment ask?
No. In this design the agents draft asks from the fund's model clauses, the portfolio manager decides which to raise, and counsel approves the drafting before anything reaches a borrower, an administrative agent or a sponsor. No agent contacts the other side at any point, which keeps every negotiating act attributable to a person.
What stops an agent inventing a clause that isn't there?
Two rules, and the fact that both are visible in the output. A finding must carry the document, section and page it rests on, and a term that is not defined in the agreement is reported as undefined rather than given a reasonable meaning. Neither rule removes the possibility of error; they make the error checkable in seconds by a person who opens the agreement at the cited page.
How many agents should a system like this have?
As many as there are tasks with different failure modes, and no more. Here there are six because stacking documents, tracing definitions, grading against a standard, calculating basket capacity, writing the answer and watching for new documents fail in different ways and need different limits. A single general agent doing all six is harder to constrain and much harder to audit.
What should an internal AI policy for this work actually contain?
Four things, at minimum: who decides and who approves, written down rather than assumed; what the system is approved to be used for; what evidence of accuracy is collected and how often; and the prohibitions — in this case, no unquoted finding, no unsigned document applied, and no contact with the other side. NIST's framework is a useful scaffold for the first two because it was written for systems that do not fit an existing supervisory category.