AI Agents for Credit Risk: What Each One Does, and Never Does

AI agents for credit risk is usually described as a single capability — "AI reads the loan file" — but the useful question is not whether an agent can read a credit agreement. It is what happens after it does: who, or what, gets to act on what it found. In a loan review built on agents rather than one broad model, the division of labor is the actual design decision, and the limit stamped on each agent is a more honest description of the system than any accuracy percentage a vendor might quote. A model that reads documents well and then quietly updates a risk rating is a different, riskier thing than one that reads documents well and stops at a cited proposal for a person to sign. Botminds' Private Credit Portfolio Monitoring is built the second way: six agents rebuild each loan's amendment, interest and covenant history from its documents and stop at a cited draft. The loans and fund shown from it here are fictional sample data.

The National Institute of Standards and Technology frames exactly this distinction as the core of trustworthy AI use: its framework exists "to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems" (NIST AI RMF). For a loan review, trustworthiness is not an abstract quality. It is a concrete, checkable boundary: what the agent is allowed to decide, and what it is never allowed to touch.

The six-agent division of one loan review

A quarterly loan review has distinct jobs inside it, and treating them as one undifferentiated "read the file" task is how a system ends up with no clear place to put a limit. Split into six: an amendment reader that classifies every change in a credit agreement; an interest and PIK tracker that ties cash and in-kind interest to the administrative agent's own notices; a covenant recomputer that tests a covenant both as reported and on its original definition; a mark and signal watcher that compares marks with peers and flags revolver draws, late reporting and sponsor news; a stress scorer that turns all of it into a ranked, driver-by-driver score; and a committee note writer that drafts the proposal a person will sign. Two people close the loop: the portfolio manager, who signs what the agents draft, and the committee chair, who decides what happens to a rating, a watchlist entry or a non-accrual status.

Can an AI agent change a loan's risk rating?

In a system built around these limits, no. The stress scorer "never puts a loan on the watchlist or non-accrual," and the committee note writer "never sends anything without the portfolio manager's signature." A rating change moves only after the chief investment officer, or the equivalent committee chair, approves a proposal the agents drafted and a person signed. This is the single question worth asking before anything else about an agentic credit tool, because it is the one with the most consequence if the answer is wrong, and the easiest for a vendor to answer vaguely rather than with a flat no.

What each agent reads, and what it is never allowed to decide

Each agent's authority is bounded by what it reads, not just by a stated rule. The amendment reader only classifies what it can cite to a section of an actual document — an asked change is shown differently from an agreed one, and a consent or lender-favourable change is not counted as a concession at all. The interest and PIK tracker never books or reverses income; it ties what the administrative agent already reported. The covenant recomputer never resets a covenant on its own or accepts an add-back above the cap it is testing — it tests, it does not amend. Each limit removes one specific way an agent could overstate its own authority, rather than relying on a single blanket rule to cover every case.

Why six narrow agents beat one broad model here

A single large model asked to "review this loan" has to make implicit choices about what counts as a concession, how to weigh a covenant reset against an interest-in-kind switch, and when to flag something for a person — choices that are invisible unless someone goes looking for them in its output. Splitting the work into six narrow agents makes each of those choices a named, auditable step instead. Research on direct lending itself points at a related reason narrow specialization works: direct lenders, the National Bureau of Economic Research finds, "are more highly specialized by industry than banks" (NBER Working Paper 34500), because specialization lets a lender build real depth in one area rather than shallow competence across many. The same logic applies inside the review itself — an agent that only ties interest to notices does that one job more checkably than a model also trying to judge covenant resets and sponsor sentiment at the same time.

What happens when a source doesn't say — the refusal path

The honest answer to "what if a document doesn't say" is not to guess and move on. The amendment reader "never counts a change it cannot cite to a section," which means a change it cannot pin to specific language is left out of the count rather than inferred from context. The same discipline runs through the other agents: the mark and signal watcher sends evidence, not a conclusion it has filled in; the covenant recomputer flags a missing figure rather than estimating one. A system that always produces a confident-sounding number, even when its underlying documents are silent or ambiguous, is optimizing for the appearance of completeness over the fact of it — a known failure mode in applied machine learning for exactly this kind of decision, where interpretability tools exist precisely because a model's confident output and its actual basis can diverge (one applied study on machine-learning credit scoring, not peer reviewed, describes "addressing the challenges of model interpretability using SHAP and LIME" as a necessary part of building a usable system, not an afterthought; arXiv 2506.19383).

Tracing one driver back to the document it came from

A score is only as trustworthy as its least-traceable driver. Take the fourteen points a loan carries for interest in kind added by amendment: the figure behind it is 29% of one quarter's interest income, capitalised under a specific amendment rather than designed into the loan at closing, and the document behind that figure is the administrative agent's own interest notice for the quarter, read against the amendment's language. Every other driver works the same way — a number, a document, and the section of that document the number came from.

Six agents working lane by lane on one loan, 69 seconds end to end

Where a person signs, and what the signature means

Two signatures close every loop the agents open. The portfolio manager signs a watchlist proposal or an amendment reply with a recorded meaning — "proposed as portfolio manager" — which is a different act from simply forwarding what an agent drafted. The committee chair's approval is a second, separate decision: on a rating change, a watchlist addition, or non-accrual status, nothing moves until they act. Who monitors a private credit loan book, seat by seat, follows both roles through what their week looks like once the agents are doing the reading first.

What should an AI agent never be allowed to do in lending?

Three things, at minimum, based on the limits above: it should never change a valuation mark, since that is a judgment the valuation team is positioned and accountable to make; it should never move a rating, place a loan on the watchlist, or declare non-accrual without a named person's approval; and it should never present a figure it cannot trace to a specific document as if it were equivalent to one it can. The banking agencies' April 2026 model risk guidance makes the stakes plain: model risk "can lead to financial loss, errors in financial statements and reporting, and flawed financial and risk management decisions," and "even a fundamentally sound model producing accurate outputs consistent with the model's design objective can exhibit high model risk if it is misapplied or misused" (SR 26-2). A model whose output can move a rating without a person checking it first is a model whose misuse has already happened by the time anyone notices.

Explainability: why every score links to its source, not just a number

A score with no path back to a document is a number a committee has to take on faith, and faith is not a defensible position when an examiner asks how a rating came to be what it is. Explainability here does not mean a general statement that the model is interpretable; it means every driver in a stress score opens the specific amendment, notice or certificate that produced it, the way validating a score before you trust it describes testing the model itself. A system built this way turns a vendor's claim into something a credit committee can check, loan by loan, rather than something it has to believe.

To see six agents and two signatures work through one loan's amendment request end to end, start from Private Credit Portfolio Monitoring.

Questions people ask

How do AI agents work for credit risk?

By dividing a review into narrow, specific jobs — reading amendments, tying interest, recomputing covenants, watching marks and signals, scoring, drafting — rather than asking one model to do all of it at once. Each agent's output is checkable because each one's job is small enough to trace back to a document.

What is the difference between one AI model and multiple agents?

One broad model makes many implicit judgment calls inside a single output, which are hard to inspect after the fact. Multiple narrow agents make those same judgment calls explicit and separately checkable — a reader to classify, a tracker to tie figures, a scorer to rank, and so on — each with its own stated limit.

Do AI agents read credit agreements?

Yes — the amendment reader's whole job is reading the credit agreement and every amendment, waiver, consent and forbearance letter, classifying each change and citing the section it came from, rather than summarizing the agreement in general terms.

Can an AI agent sign off on a watchlist proposal?

No. An agent can draft the proposal with its reasons cited; the portfolio manager signs it before it reaches the committee, and the committee chair decides whether the loan is actually added to the watchlist.

What happens when an agent can't find a source for a fact?

It leaves the fact out or flags it for a person, rather than estimating a figure and presenting it the way it would present a cited one. The amendment reader, for instance, never counts a change it cannot cite to a specific section of a document.