Implementation Guide: Generate personalized financial plan narratives and investment proposal documents

# blocks consumer AI endpoints, allows Azure OpenAI, enables deep TLS
# inspection

config system interface
  edit port1
    set ip 192.168.1.1 255.255.255.0
    set allowaccess ping https ssh
  next
end

config webfilter urlfilter
  edit 1
    set name 'Block-Shadow-AI'
    config entries
      edit 1
        set url 'chat.openai.com'
        set type wildcard
        set action block
      next
      edit 2
        set url 'claude.ai'
        set type wildcard
        set action block
      next
      edit 3
        set url 'gemini.google.com'
        set type wildcard
        set action block
      next
      edit 4
        set url 'bard.google.com'
        set type wildcard
        set action block
      next
    end
  next
end

config firewall address
  edit 'Azure-OpenAI-Endpoints'
    set type fqdn
    set fqdn '*.openai.azure.com'
  next
end

config firewall ssl-ssh-profile
  edit 'deep-inspection-financial'
    config https
      set ports 443
      set status deep-inspection
    end
  next
end

# Login to Azure CLI
az login

# Set subscription (use client's or MSP managed subscription)
az account set --subscription 'ClientName-Financial-AI'

# Create resource group
az group create --name rg-clientname-ai --location eastus2

# Create Azure OpenAI resource
az cognitiveservices account create \
  --name oai-clientname-finplan \
  --resource-group rg-clientname-ai \
  --kind OpenAI \
  --sku S0 \
  --location eastus2 \
  --custom-domain oai-clientname-finplan

# Deploy GPT-4.1 model
az cognitiveservices account deployment create \
  --name oai-clientname-finplan \
  --resource-group rg-clientname-ai \
  --deployment-name gpt-41-finplan \
  --model-name gpt-4.1 \
  --model-version '2025-04-14' \
  --model-format OpenAI \
  --sku-capacity 80 \
  --sku-name Standard

# Enable diagnostic logging to Log Analytics
az monitor diagnostic-settings create \
  --name oai-diagnostics \
  --resource /subscriptions/{sub-id}/resourceGroups/rg-clientname-ai/providers/Microsoft.CognitiveServices/accounts/oai-clientname-finplan \
  --logs '[{"category":"RequestResponse","enabled":true},{"category":"Audit","enabled":true}]' \
  --workspace /subscriptions/{sub-id}/resourceGroups/rg-clientname-ai/providers/Microsoft.OperationalInsights/workspaces/law-clientname

# Create Azure Key Vault
az keyvault create \
  --name kv-clientname-ai \
  --resource-group rg-clientname-ai \
  --location eastus2 \
  --sku standard

# Store the API key in Key Vault
API_KEY=$(az cognitiveservices account keys list --name oai-clientname-finplan --resource-group rg-clientname-ai --query key1 -o tsv)
az keyvault secret set --vault-name kv-clientname-ai --name oai-api-key --value $API_KEY

# Store the endpoint
az keyvault secret set --vault-name kv-clientname-ai --name oai-endpoint --value 'https://oai-clientname-finplan.openai.azure.com/'

# Create storage account with immutable storage
az storage account create \
  --name stclientnamearchive \
  --resource-group rg-clientname-ai \
  --location eastus2 \
  --sku Standard_GRS \
  --kind StorageV2

# Create container for AI documents
az storage container create \
  --name ai-document-archive \
  --account-name stclientnamearchive

# Set immutable policy (365-day retention — adjust per firm's retention policy)
az storage container immutability-policy create \
  --resource-group rg-clientname-ai \
  --account-name stclientnamearchive \
  --container-name ai-document-archive \
  --period 365

az storage container generate-sas \
  --account-name stclientnamearchive \
  --name ai-document-archive \
  --permissions rwl \
  --expiry 2026-12-31 \
  --auth-mode key \
  -o tsv

mkdir -p finplan-ai/{app,templates,prompts,static,tests}
cd finplan-ai

cat > requirements.txt << 'EOF'
flask==3.1.0
gunicorn==22.0.0
openai==1.52.0
python-docx==1.1.0
Jinja2==3.1.4
requests==2.32.3
azure-identity==1.17.1
azure-keyvault-secrets==4.8.0
azure-storage-blob==12.22.0
python-dotenv==1.0.1
redis==5.0.8
celery==5.4.0
pydantic==2.9.0
EOF

cat > app/main.py << 'PYEOF'
import os
from flask import Flask, request, jsonify, send_file
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from app.pipeline import FinancialPlanPipeline
from app.compliance_logger import ComplianceLogger

app = Flask(__name__)

# Load secrets from Azure Key Vault
credential = DefaultAzureCredential()
kv_client = SecretClient(vault_url=os.environ['KEY_VAULT_URL'], credential=credential)

OAI_KEY = kv_client.get_secret('oai-api-key').value
OAI_ENDPOINT = kv_client.get_secret('oai-endpoint').value

pipeline = FinancialPlanPipeline(api_key=OAI_KEY, endpoint=OAI_ENDPOINT)
logger = ComplianceLogger()

@app.route('/api/generate-plan', methods=['POST'])
def generate_plan():
	try:
  		payload = request.get_json()
  		client_id = payload['client_id']
  		document_type = payload['document_type']  # 'financial_plan' or 'investment_proposal'
  		advisor_id = payload['advisor_id']
  		customization_notes = payload.get('customization_notes', '')

  		# Pull client data from CRM
  		client_data = pipeline.fetch_client_data(client_id)

  		# Pull planning data
  		planning_data = pipeline.fetch_planning_data(client_id)

  		# Generate document
  		result = pipeline.generate_document(
    			client_data=client_data,
    			planning_data=planning_data,
    			document_type=document_type,
    			customization_notes=customization_notes
  		)

  		# Log for compliance (input + output)
  		log_id = logger.log_generation(
    			advisor_id=advisor_id,
    			client_id=client_id,
    			document_type=document_type,
    			prompt_used=result['prompt'],
    			raw_output=result['raw_text'],
    			model_used=result['model'],
    			tokens_used=result['usage']
  		)

  		return jsonify({
    			'status': 'draft_ready',
    			'log_id': log_id,
    			'document_url': result['document_url'],
    			'preview_text': result['raw_text'][:2000],
    			'requires_review': True
  		})

	except Exception as e:
  		logger.log_error(str(e))
  		return jsonify({'status': 'error', 'message': str(e)}), 500

@app.route('/api/approve-document', methods=['POST'])
def approve_document():
	payload = request.get_json()
  	log_id = payload['log_id']
  	advisor_id = payload['advisor_id']
  	approval_notes = payload.get('notes', '')

  	logger.log_approval(log_id, advisor_id, approval_notes)
  	return jsonify({'status': 'approved', 'log_id': log_id})

if __name__ == '__main__':
  	app.run(debug=False)
PYEOF

az webapp up \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --runtime 'PYTHON:3.11' \
  --sku B2

az webapp config appsettings set \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --settings \
    KEY_VAULT_URL='https://kv-clientname-ai.vault.azure.net/' \
    CRM_TYPE='redtail' \
    CRM_API_URL='https://smf.crm3.redtailtechnology.com/api/public/v1' \
    PLANNING_SOFTWARE='emoney' \
    AZURE_STORAGE_ACCOUNT='stclientnamearchive' \
    ARCHIVE_CONTAINER='ai-document-archive'

az webapp identity assign --name app-clientname-finplan --resource-group rg-clientname-ai

PRINCIPAL_ID=$(az webapp identity show --name app-clientname-finplan --resource-group rg-clientname-ai --query principalId -o tsv)
az keyvault set-policy --name kv-clientname-ai --object-id $PRINCIPAL_ID --secret-permissions get list

cat > app/integrations/crm_redtail.py << 'PYEOF'
import requests
from typing import Dict, Any

class RedtailCRMClient:
    BASE_URL = 'https://smf.crm3.redtailtechnology.com/api/public/v1'

    def __init__(self, api_key: str):
        self.headers = {
            'Authorization': f'Userkeyauth {api_key}',
            'Content-Type': 'application/json'
        }

    def get_client(self, contact_id: int) -> Dict[str, Any]:
        resp = requests.get(
            f'{self.BASE_URL}/contacts/{contact_id}',
            headers=self.headers
        )
        resp.raise_for_status()
        contact = resp.json()
        return {
            'id': contact['id'],
            'first_name': contact.get('first_name', ''),
            'last_name': contact.get('last_name', ''),
            'date_of_birth': contact.get('date_of_birth', ''),
            'email': contact.get('email', ''),
            'phone': contact.get('phone', ''),
            'marital_status': contact.get('marital_status', ''),
            'employment_status': contact.get('employment_status', ''),
            'risk_tolerance': contact.get('category_tags', {}).get('risk_tolerance', 'Moderate'),
            'annual_income': contact.get('custom_fields', {}).get('annual_income', ''),
            'net_worth': contact.get('custom_fields', {}).get('net_worth', ''),
            'retirement_age': contact.get('custom_fields', {}).get('target_retirement_age', '65'),
            'goals': self._get_goals(contact_id),
            'household_members': self._get_household(contact_id)
        }

    def _get_goals(self, contact_id: int) -> list:
        resp = requests.get(
            f'{self.BASE_URL}/contacts/{contact_id}/notes',
            headers=self.headers,
            params={'category': 'Financial Goals'}
        )
        if resp.status_code == 200:
            return [note['body'] for note in resp.json().get('notes', [])]
        return []

    def _get_household(self, contact_id: int) -> list:
        resp = requests.get(
            f'{self.BASE_URL}/contacts/{contact_id}/relationships',
            headers=self.headers
        )
        if resp.status_code == 200:
            return resp.json().get('relationships', [])
        return []
PYEOF

az keyvault secret set --vault-name kv-clientname-ai --name crm-api-key --value 'REDTAIL_API_KEY_HERE'

# eMoney Advisor API integration client

import requests
from typing import Dict, Any, Optional

class EMoneyClient:
    """Integration with eMoney Advisor API for plan data extraction."""

    def __init__(self, api_key: str, base_url: str):
        self.base_url = base_url
        self.headers = {
            'Authorization': f'Bearer {api_key}',
            'Accept': 'application/json'
        }

    def get_plan_summary(self, client_id: str) -> Dict[str, Any]:
        """Fetch the most recent financial plan summary for a client."""
        resp = requests.get(
            f'{self.base_url}/clients/{client_id}/plans/current',
            headers=self.headers
        )
        if resp.status_code == 200:
            plan = resp.json()
            return {
                'plan_id': plan.get('id'),
                'plan_date': plan.get('created_date'),
                'retirement_probability': plan.get('monte_carlo_probability'),
                'projected_retirement_income': plan.get('annual_retirement_income'),
                'total_investable_assets': plan.get('total_assets'),
                'total_liabilities': plan.get('total_liabilities'),
                'net_worth': plan.get('net_worth'),
                'annual_savings_rate': plan.get('savings_rate'),
                'asset_allocation': plan.get('current_allocation', {}),
                'recommended_allocation': plan.get('target_allocation', {}),
                'social_security_estimate': plan.get('ss_benefit'),
                'insurance_coverage': plan.get('insurance_summary', {}),
                'estate_documents': plan.get('estate_docs_status', {}),
                'tax_bracket': plan.get('effective_tax_rate'),
                'scenarios': self._get_scenarios(client_id, plan.get('id'))
            }
        # Fallback: return empty structure for manual data entry
        return self._empty_plan_structure()

    def _get_scenarios(self, client_id: str, plan_id: str) -> list:
        resp = requests.get(
            f'{self.base_url}/clients/{client_id}/plans/{plan_id}/scenarios',
            headers=self.headers
        )
        if resp.status_code == 200:
            return resp.json().get('scenarios', [])
        return []

    def _empty_plan_structure(self) -> Dict[str, Any]:
        return {
            'plan_id': None,
            'retirement_probability': None,
            'total_investable_assets': None,
            'asset_allocation': {},
            'recommended_allocation': {},
            'scenarios': [],
            '_note': 'Plan data not available via API — advisor must input manually'
        }

# CSV fallback importer for planning tools without API access

import csv
import io
from typing import Dict, Any

class CSVPlanningImporter:
    """Fallback for planning software without API access.
    Advisor uploads a CSV export from their planning tool."""

    REQUIRED_FIELDS = [
        'client_name', 'total_assets', 'total_liabilities',
        'retirement_probability', 'annual_income', 'savings_rate'
    ]

    def parse_plan_export(self, csv_content: str) -> Dict[str, Any]:
        reader = csv.DictReader(io.StringIO(csv_content))
        rows = list(reader)
        if not rows:
            raise ValueError('Empty CSV file')
        row = rows[0]  # First row = client data
        return {
            'plan_id': 'csv-import',
            'total_investable_assets': row.get('total_assets', ''),
            'total_liabilities': row.get('total_liabilities', ''),
            'retirement_probability': row.get('retirement_probability', ''),
            'annual_savings_rate': row.get('savings_rate', ''),
            'asset_allocation': {
                'equities': row.get('equity_pct', ''),
                'fixed_income': row.get('fi_pct', ''),
                'alternatives': row.get('alt_pct', ''),
                'cash': row.get('cash_pct', '')
            },
            'scenarios': []
        }

mkdir -p prompts/{financial_plan,investment_proposal,retirement_analysis,common}

cat > prompts/financial_plan/narrative.j2 << 'TEMPLATEEOF'
You are a senior financial planning writer employed by {{ firm_name }}. You produce personalized, compliant financial plan narrative documents for clients of registered investment advisory firms.

## CRITICAL RULES:
1. NEVER fabricate financial data. Use ONLY the data provided below. If data is missing, write: "[DATA NEEDED: description of missing information]"
2. NEVER provide specific investment product recommendations (no ticker symbols, fund names, or specific securities)
3. ALWAYS use language consistent with fiduciary duty — the plan is in the client's best interest
4. Include the required disclosure paragraph at the end of every section that discusses investments or projections
5. Use second person ("you"/"your") when addressing the client
6. Write at a 10th-grade reading level — accessible but professional
7. All projected returns must be clearly labeled as hypothetical

## CLIENT PROFILE:
- Name: {{ client.first_name }} {{ client.last_name }}
- Age: {{ client.age }} | Target Retirement Age: {{ client.retirement_age }}
- Marital Status: {{ client.marital_status }}
- Employment: {{ client.employment_status }}
- Annual Household Income: {{ client.annual_income | format_currency }}
- Household Members: {% for member in client.household_members %}{{ member.name }} ({{ member.relationship }}, age {{ member.age }}){% if not loop.last %}, {% endif %}{% endfor %}

## FINANCIAL SNAPSHOT:
- Total Investable Assets: {{ plan.total_investable_assets | format_currency }}
- Total Liabilities: {{ plan.total_liabilities | format_currency }}
- Estimated Net Worth: {{ plan.net_worth | format_currency }}
- Current Savings Rate: {{ plan.annual_savings_rate }}%
- Effective Tax Bracket: {{ plan.tax_bracket }}%

## CURRENT ASSET ALLOCATION:
{% for asset_class, pct in plan.asset_allocation.items() %}- {{ asset_class }}: {{ pct }}%
{% endfor %}

## RECOMMENDED ALLOCATION:
{% for asset_class, pct in plan.recommended_allocation.items() %}- {{ asset_class }}: {{ pct }}%
{% endfor %}

## RETIREMENT PROJECTION:
- Monte Carlo Success Probability: {{ plan.retirement_probability }}%
- Projected Annual Retirement Income: {{ plan.projected_retirement_income | format_currency }}
- Social Security Estimate (at FRA): {{ plan.social_security_estimate | format_currency }}/month

## CLIENT GOALS:
{% for goal in client.goals %}- {{ goal }}
{% endfor %}

## SCENARIOS MODELED:
{% for scenario in plan.scenarios %}- {{ scenario.name }}: {{ scenario.description }} → Probability: {{ scenario.probability }}%
{% endfor %}

{% if customization_notes %}- ADVISOR NOTES: {{ customization_notes }}{% endif %}

## DOCUMENT STRUCTURE (generate each section):
1. **Executive Summary** (1 page) — warm, personal overview of the plan's key findings and recommendations
2. **Your Financial Picture Today** (1-2 pages) — net worth summary, income analysis, current allocation review
3. **Your Goals & What They Mean** (1-2 pages) — each goal restated with quantified targets and timelines
4. **Retirement Readiness Analysis** (2-3 pages) — projection results, Monte Carlo explanation in plain English, Social Security strategy
5. **Investment Strategy** (2-3 pages) — allocation rationale, risk management approach, rebalancing philosophy (NO specific product names)
6. **Tax Planning Opportunities** (1-2 pages) — tax bracket management, Roth conversion analysis if applicable, tax-loss harvesting overview
7. **Risk Management & Insurance Review** (1 page) — coverage assessment, gaps identified
8. **Estate Planning Considerations** (1 page) — beneficiary review, document status, basic planning needs
9. **Action Items & Next Steps** (1 page) — numbered, prioritized action list with responsible party and timeline
10. **Important Disclosures** — insert the following verbatim:

{{ firm_disclosures }}

Generate the complete document now. Use markdown formatting with headers. Each section should flow naturally into the next with transitional language.
TEMPLATEEOF

cat > prompts/investment_proposal/proposal.j2 << 'TEMPLATEEOF'
You are a senior investment writer employed by {{ firm_name }}. You produce personalized investment proposal documents for prospective and existing clients.

## CRITICAL RULES:
1. NEVER fabricate performance data. Use ONLY the data provided.
2. NEVER guarantee future returns or use language implying certainty of outcomes
3. All hypothetical projections must be clearly labeled as such
4. Do NOT name specific securities, mutual funds, or ETFs unless provided in the data below
5. Comply with SEC Marketing Rule 206(4)-1: no misleading statements, no cherry-picked performance
6. Focus on the STRATEGY and PROCESS, not on specific products

## PROSPECT/CLIENT PROFILE:
- Name: {{ client.first_name }} {{ client.last_name }}
- Current Portfolio Value: {{ plan.total_investable_assets | format_currency }}
- Risk Tolerance Score: {{ client.risk_tolerance }} / 100
- Investment Time Horizon: {{ client.investment_horizon }} years
- Primary Investment Objective: {{ client.primary_objective }}

## CURRENT ALLOCATION (if available):
{% for asset_class, pct in plan.asset_allocation.items() %}- {{ asset_class }}: {{ pct }}%
{% endfor %}

## PROPOSED ALLOCATION:
{% for asset_class, pct in plan.recommended_allocation.items() %}- {{ asset_class }}: {{ pct }}%
{% endfor %}

## FEE SCHEDULE:
{{ firm_fee_schedule }}

## DOCUMENT STRUCTURE:
1. **Cover Letter** — personalized to client's situation and stated goals
2. **Our Firm & Philosophy** — {{ firm_name }} overview, investment philosophy, fiduciary commitment
3. **Understanding Your Needs** — restate client goals, risk tolerance, time horizon
4. **Current Portfolio Assessment** — analysis of existing allocation, identified concerns
5. **Proposed Investment Strategy** — recommended allocation with rationale for each asset class
6. **Fee Transparency** — clear fee schedule, total cost comparison
7. **What to Expect** — onboarding process, communication cadence, reporting overview
8. **Appendix: Important Disclosures** — insert verbatim: {{ firm_disclosures }}

Generate the complete investment proposal now. Tone: confident but not aggressive, educational, and transparent about costs and risks.
TEMPLATEEOF

cat > prompts/common/disclosures.j2 << 'TEMPLATEEOF'
{{ firm_name }} is a registered investment adviser with the Securities and Exchange Commission. Registration does not imply a certain level of skill or training. The information contained in this document is for general informational purposes and should not be construed as personalized investment advice. Past performance is not indicative of future results. All investing involves risk, including the potential loss of principal. Hypothetical projections shown are not guarantees of future performance and are based on assumptions that may not be realized. Monte Carlo simulations provide probabilities based on historical data patterns and do not guarantee specific outcomes. {{ firm_name }} does not provide tax, legal, or accounting advice. Clients should consult their tax advisor regarding their specific tax situation. For additional information, including our Form ADV Part 2A, please visit {{ firm_website }} or contact us at {{ firm_phone }}.
TEMPLATEEOF

cat > app/pipeline.py << 'PYEOF'
import os
import json
import datetime
from typing import Dict, Any, Optional
from jinja2 import Environment, FileSystemLoader
from openai import AzureOpenAI
from docx import Document
from docx.shared import Inches, Pt, RGBColor
from docx.enum.text import WD_ALIGN_PARAGRAPH
from azure.storage.blob import BlobServiceClient
from azure.identity import DefaultAzureCredential

class FinancialPlanPipeline:
    def __init__(self, api_key: str, endpoint: str):
        self.client = AzureOpenAI(
            api_key=api_key,
            api_version='2025-01-01-preview',
            azure_endpoint=endpoint
        )
        self.jinja_env = Environment(
            loader=FileSystemLoader('prompts'),
            autoescape=False
        )
        self.jinja_env.filters['format_currency'] = self._format_currency
        self._load_firm_config()

    def _load_firm_config(self):
        with open('config/firm_config.json', 'r') as f:
            self.firm_config = json.load(f)

    @staticmethod
    def _format_currency(value):
        try:
            return f'${float(value):,.0f}'
        except (ValueError, TypeError):
            return str(value) if value else '[AMOUNT NOT PROVIDED]'

    def fetch_client_data(self, client_id: str) -> Dict[str, Any]:
        crm_type = os.environ.get('CRM_TYPE', 'redtail')
        if crm_type == 'redtail':
            from app.integrations.crm_redtail import RedtailCRMClient
            crm = RedtailCRMClient(api_key=self._get_secret('crm-api-key'))
            return crm.get_client(int(client_id))
        # Add other CRM integrations as elif blocks
        raise ValueError(f'Unsupported CRM type: {crm_type}')

    def fetch_planning_data(self, client_id: str) -> Dict[str, Any]:
        planning_type = os.environ.get('PLANNING_SOFTWARE', 'emoney')
        if planning_type == 'emoney':
            from app.integrations.planning_emoney import EMoneyClient
            planner = EMoneyClient(
                api_key=self._get_secret('planning-api-key'),
                base_url=os.environ.get('PLANNING_API_URL', '')
            )
            return planner.get_plan_summary(client_id)
        elif planning_type == 'csv':
            return {}  # Will be populated via CSV upload endpoint
        raise ValueError(f'Unsupported planning software: {planning_type}')

    def generate_document(self, client_data: Dict, planning_data: Dict,
                          document_type: str, customization_notes: str = '') -> Dict[str, Any]:
        # Select and render prompt template
        if document_type == 'financial_plan':
            template = self.jinja_env.get_template('financial_plan/narrative.j2')
        elif document_type == 'investment_proposal':
            template = self.jinja_env.get_template('investment_proposal/proposal.j2')
        else:
            raise ValueError(f'Unknown document type: {document_type}')

        prompt = template.render(
            client=client_data,
            plan=planning_data,
            firm_name=self.firm_config['firm_name'],
            firm_disclosures=self.firm_config['disclosures'],
            firm_fee_schedule=self.firm_config.get('fee_schedule', ''),
            firm_website=self.firm_config['website'],
            firm_phone=self.firm_config['phone'],
            customization_notes=customization_notes
        )

        # Call Azure OpenAI
        response = self.client.chat.completions.create(
            model='gpt-41-finplan',
            messages=[
                {'role': 'system', 'content': 'You are an expert financial planning document writer. Follow all rules exactly. Never fabricate data.'},
                {'role': 'user', 'content': prompt}
            ],
            temperature=0.3,
            max_tokens=16000,
            top_p=0.9
        )

        raw_text = response.choices[0].message.content
        usage = {
            'prompt_tokens': response.usage.prompt_tokens,
            'completion_tokens': response.usage.completion_tokens,
            'total_tokens': response.usage.total_tokens
        }

        # Generate Word document
        doc_path = self._create_word_document(
            raw_text, client_data, document_type
        )

        # Upload to archive
        blob_url = self._archive_document(doc_path, client_data, document_type)

        return {
            'raw_text': raw_text,
            'prompt': prompt,
            'model': 'gpt-4.1',
            'usage': usage,
            'document_url': blob_url,
            'document_path': doc_path
        }

    def _create_word_document(self, markdown_text: str, client_data: Dict,
                              document_type: str) -> str:
        doc = Document()
        style = doc.styles['Normal']
        font = style.font
        font.name = self.firm_config.get('font_name', 'Calibri')
        font.size = Pt(11)

        # Add firm logo if available
        logo_path = self.firm_config.get('logo_path')
        if logo_path and os.path.exists(logo_path):
            doc.add_picture(logo_path, width=Inches(2.5))
            last_paragraph = doc.paragraphs[-1]
            last_paragraph.alignment = WD_ALIGN_PARAGRAPH.CENTER

        # Title
        title_text = 'Comprehensive Financial Plan' if document_type == 'financial_plan' else 'Investment Proposal'
        title = doc.add_heading(title_text, level=0)
        title.alignment = WD_ALIGN_PARAGRAPH.CENTER

        # Subtitle with client name and date
        subtitle = doc.add_paragraph()
        subtitle.alignment = WD_ALIGN_PARAGRAPH.CENTER
        run = subtitle.add_run(
            f"Prepared for {client_data['first_name']} {client_data['last_name']}\n"
            f"Date: {datetime.datetime.now().strftime('%B %d, %Y')}\n"
            f"Prepared by: {self.firm_config['firm_name']}"
        )
        run.font.size = Pt(14)
        run.font.color.rgb = RGBColor(70, 70, 70)

        doc.add_page_break()

        # Parse markdown sections into Word
        for line in markdown_text.split('\n'):
            line = line.strip()
            if line.startswith('# '):
                doc.add_heading(line[2:], level=1)
            elif line.startswith('## '):
                doc.add_heading(line[3:], level=2)
            elif line.startswith('### '):
                doc.add_heading(line[4:], level=3)
            elif line.startswith('- '):
                doc.add_paragraph(line[2:], style='List Bullet')
            elif line.startswith('[DATA NEEDED:'):
                p = doc.add_paragraph()
                run = p.add_run(line)
                run.font.color.rgb = RGBColor(255, 0, 0)
                run.bold = True
            elif line:
                doc.add_paragraph(line)

        # Save
        timestamp = datetime.datetime.now().strftime('%Y%m%d_%H%M%S')
        filename = f"{client_data['last_name']}_{document_type}_{timestamp}.docx"
        filepath = os.path.join('output', filename)
        os.makedirs('output', exist_ok=True)
        doc.save(filepath)
        return filepath

    def _archive_document(self, doc_path: str, client_data: Dict,
                          document_type: str) -> str:
        credential = DefaultAzureCredential()
        blob_service = BlobServiceClient(
            account_url=f"https://{os.environ['AZURE_STORAGE_ACCOUNT']}.blob.core.windows.net",
            credential=credential
        )
        container = blob_service.get_container_client(os.environ['ARCHIVE_CONTAINER'])
        blob_name = f"{datetime.datetime.now().strftime('%Y/%m')}/{os.path.basename(doc_path)}"
        with open(doc_path, 'rb') as f:
            container.upload_blob(name=blob_name, data=f, overwrite=False)
        return f"https://{os.environ['AZURE_STORAGE_ACCOUNT']}.blob.core.windows.net/{os.environ['ARCHIVE_CONTAINER']}/{blob_name}"

    def _get_secret(self, name: str) -> str:
        from azure.keyvault.secrets import SecretClient
        credential = DefaultAzureCredential()
        kv = SecretClient(
            vault_url=os.environ['KEY_VAULT_URL'],
            credential=credential
        )
        return kv.get_secret(name).value
PYEOF

cat > app/compliance_logger.py << 'PYEOF'
import json
import uuid
import datetime
import os
from azure.storage.blob import BlobServiceClient
from azure.identity import DefaultAzureCredential

class ComplianceLogger:
    def __init__(self):
        self.credential = DefaultAzureCredential()
        self.blob_service = BlobServiceClient(
            account_url=f"https://{os.environ['AZURE_STORAGE_ACCOUNT']}.blob.core.windows.net",
            credential=self.credential
        )
        self.container = self.blob_service.get_container_client('ai-compliance-logs')
        # Ensure container exists
        try:
            self.container.create_container()
        except Exception:
            pass  # Already exists

    def log_generation(self, advisor_id: str, client_id: str,
                       document_type: str, prompt_used: str,
                       raw_output: str, model_used: str,
                       tokens_used: dict) -> str:
        log_id = str(uuid.uuid4())
        timestamp = datetime.datetime.utcnow().isoformat() + 'Z'

        log_entry = {
            'log_id': log_id,
            'timestamp': timestamp,
            'event_type': 'document_generation',
            'advisor_id': advisor_id,
            'client_id': client_id,
            'document_type': document_type,
            'model_used': model_used,
            'tokens': tokens_used,
            'prompt_hash': self._hash(prompt_used),
            'prompt_full': prompt_used,
            'output_full': raw_output,
            'output_hash': self._hash(raw_output),
            'approval_status': 'pending_review',
            'approved_by': None,
            'approval_timestamp': None,
            'approval_notes': None
        }

        # Write to Azure Blob (immutable archive)
        blob_name = f"logs/{datetime.datetime.utcnow().strftime('%Y/%m/%d')}/{log_id}.json"
        self.container.upload_blob(
            name=blob_name,
            data=json.dumps(log_entry, indent=2),
            overwrite=False
        )

        # Also write to local NAS via file system
        local_path = os.path.join(
            os.environ.get('NAS_MOUNT_PATH', '/mnt/nas/AI-Compliance-Archive'),
            'logs',
            datetime.datetime.utcnow().strftime('%Y/%m/%d')
        )
        os.makedirs(local_path, exist_ok=True)
        with open(os.path.join(local_path, f'{log_id}.json'), 'w') as f:
            json.dump(log_entry, f, indent=2)

        return log_id

    def log_approval(self, log_id: str, advisor_id: str, notes: str = ''):
        timestamp = datetime.datetime.utcnow().isoformat() + 'Z'
        approval_record = {
            'log_id': log_id,
            'event_type': 'document_approval',
            'approved_by': advisor_id,
            'approval_timestamp': timestamp,
            'approval_notes': notes,
            'approval_status': 'approved'
        }

        blob_name = f"approvals/{datetime.datetime.utcnow().strftime('%Y/%m/%d')}/{log_id}_approval.json"
        self.container.upload_blob(
            name=blob_name,
            data=json.dumps(approval_record, indent=2),
            overwrite=False
        )

    def log_error(self, error_message: str):
        log_id = str(uuid.uuid4())
        timestamp = datetime.datetime.utcnow().isoformat() + 'Z'
        error_record = {
            'log_id': log_id,
            'timestamp': timestamp,
            'event_type': 'error',
            'error_message': error_message
        }
        blob_name = f"errors/{datetime.datetime.utcnow().strftime('%Y/%m/%d')}/{log_id}.json"
        self.container.upload_blob(
            name=blob_name,
            data=json.dumps(error_record, indent=2),
            overwrite=False
        )

    @staticmethod
    def _hash(content: str) -> str:
        import hashlib
        return hashlib.sha256(content.encode()).hexdigest()
PYEOF

az storage container create \
  --name ai-compliance-logs \
  --account-name stclientnamearchive

az storage container immutability-policy create \
  --resource-group rg-clientname-ai \
  --account-name stclientnamearchive \
  --container-name ai-compliance-logs \
  --period 2555

cat > templates/index.html << 'HTMLEOF'
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>{{ firm_name }} - AI Document Generator</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        .status-badge { font-size: 0.9rem; }
        .review-banner { background-color: #fff3cd; border: 2px solid #ffc107; padding: 15px; border-radius: 8px; margin-bottom: 20px; }
        .review-banner h5 { color: #856404; margin: 0; }
        #output-preview { white-space: pre-wrap; font-family: 'Georgia', serif; line-height: 1.8; }
        .data-gap { color: #dc3545; font-weight: bold; background: #fff5f5; padding: 2px 6px; border-radius: 3px; }
    </style>
</head>
<body>
    <nav class="navbar navbar-dark bg-dark">
        <div class="container">
            <span class="navbar-brand">{{ firm_name }} | AI Document Generator</span>
            <span class="navbar-text text-warning">⚠️ All documents require advisor review before client delivery</span>
        </div>
    </nav>
    <div class="container mt-4">
        <div class="row">
            <div class="col-md-4">
                <div class="card">
                    <div class="card-header bg-primary text-white">Generate New Document</div>
                    <div class="card-body">
                        <form id="generateForm">
                            <div class="mb-3">
                                <label class="form-label">Client ID (from CRM)</label>
                                <input type="text" class="form-control" id="clientId" required>
                            </div>
                            <div class="mb-3">
                                <label class="form-label">Document Type</label>
                                <select class="form-select" id="documentType">
                                    <option value="financial_plan">Comprehensive Financial Plan</option>
                                    <option value="investment_proposal">Investment Proposal</option>
                                </select>
                            </div>
                            <div class="mb-3">
                                <label class="form-label">Customization Notes (optional)</label>
                                <textarea class="form-control" id="customNotes" rows="4" placeholder="E.g., Client is especially concerned about college funding for twins starting in 2028. Emphasize tax-efficient strategies."></textarea>
                            </div>
                            <button type="submit" class="btn btn-primary w-100" id="generateBtn">
                                Generate Draft
                            </button>
                        </form>
                    </div>
                </div>
            </div>
            <div class="col-md-8">
                <div id="reviewSection" style="display:none;">
                    <div class="review-banner">
                        <h5>⚠️ DRAFT — REQUIRES YOUR REVIEW AND APPROVAL</h5>
                        <small>This document was generated by AI and has NOT been reviewed for accuracy. Per firm compliance policy and FINRA Rule 2210, you must review all content before sharing with a client. Look for <span class="data-gap">[DATA NEEDED]</span> placeholders that require your input.</small>
                    </div>
                    <div class="card">
                        <div class="card-header d-flex justify-content-between">
                            <span>Document Preview</span>
                            <span class="badge bg-warning status-badge" id="statusBadge">Pending Review</span>
                        </div>
                        <div class="card-body" id="output-preview"></div>
                        <div class="card-footer">
                            <div class="mb-3">
                                <label class="form-label">Approval Notes</label>
                                <textarea class="form-control" id="approvalNotes" rows="2" placeholder="Note any changes made before delivery"></textarea>
                            </div>
                            <div class="d-flex gap-2">
                                <a id="downloadLink" class="btn btn-outline-primary" href="#" target="_blank">Download Word Document</a>
                                <button class="btn btn-success" id="approveBtn" onclick="approveDocument()">✓ Approve for Client Delivery</button>
                                <button class="btn btn-outline-danger" onclick="requestRevision()">↻ Regenerate with Changes</button>
                            </div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
    <script>
        let currentLogId = null;
        document.getElementById('generateForm').addEventListener('submit', async (e) => {
            e.preventDefault();
            const btn = document.getElementById('generateBtn');
            btn.disabled = true;
            btn.textContent = 'Generating... (30-90 seconds)';
            try {
                const response = await fetch('/api/generate-plan', {
                    method: 'POST',
                    headers: {'Content-Type': 'application/json'},
                    body: JSON.stringify({
                        client_id: document.getElementById('clientId').value,
                        document_type: document.getElementById('documentType').value,
                        advisor_id: '{{ current_user_id }}',
                        customization_notes: document.getElementById('customNotes').value
                    })
                });
                const data = await response.json();
                if (data.status === 'draft_ready') {
                    currentLogId = data.log_id;
                    let preview = data.preview_text;
                    preview = preview.replace(/\[DATA NEEDED:[^\]]+\]/g, '<span class="data-gap">$&</span>');
                    document.getElementById('output-preview').innerHTML = preview;
                    document.getElementById('downloadLink').href = data.document_url;
                    document.getElementById('reviewSection').style.display = 'block';
                } else {
                    alert('Error: ' + data.message);
                }
            } catch (err) { alert('Error: ' + err.message); }
            btn.disabled = false;
            btn.textContent = 'Generate Draft';
        });
        async function approveDocument() {
            const response = await fetch('/api/approve-document', {
                method: 'POST',
                headers: {'Content-Type': 'application/json'},
                body: JSON.stringify({
                    log_id: currentLogId,
                    advisor_id: '{{ current_user_id }}',
                    notes: document.getElementById('approvalNotes').value
                })
            });
            const data = await response.json();
            if (data.status === 'approved') {
                document.getElementById('statusBadge').className = 'badge bg-success status-badge';
                document.getElementById('statusBadge').textContent = 'Approved ✓';
                document.getElementById('approveBtn').disabled = true;
            }
        }
        function requestRevision() {
            document.getElementById('customNotes').value += '\n[REVISION REQUEST]: ';
            document.getElementById('customNotes').focus();
        }
    </script>
</body>
</html>
HTMLEOF

mkdir -p config

cat > config/firm_config.json << 'JSONEOF'
{
  "firm_name": "[CLIENT FIRM NAME]",
  "firm_dba": "[DBA IF DIFFERENT]",
  "firm_website": "https://www.clientfirm.com",
  "firm_phone": "(555) 123-4567",
  "firm_email": "info@clientfirm.com",
  "crd_number": "[FIRM CRD NUMBER]",
  "sec_registration": "[SEC FILE NUMBER]",
  "logo_path": "static/firm_logo.png",
  "font_name": "Calibri",
  "brand_color_primary": "#1B3A5C",
  "brand_color_secondary": "#4A90D9",
  "disclosures": "[CLIENT FIRM NAME] is a registered investment adviser with the Securities and Exchange Commission (SEC File Number: [SEC FILE NUMBER]). Registration does not imply a certain level of skill or training. The information in this document is for informational purposes only and does not constitute investment advice. Past performance is not indicative of future results. All investments involve risk, including loss of principal. Hypothetical projections are based on assumptions that may not materialize and are not guarantees. Monte Carlo analysis results represent statistical probabilities, not certain outcomes. [CLIENT FIRM NAME] does not provide tax, legal, or accounting advice. Please consult your tax advisor. For our Form ADV Part 2A brochure, visit [WEBSITE] or call [PHONE].",
  "fee_schedule": "Advisory Fee Schedule:\n- First $500,000: 1.00% annually\n- $500,001 - $1,000,000: 0.85% annually\n- $1,000,001 - $3,000,000: 0.70% annually\n- Over $3,000,000: 0.50% annually\n\nMinimum account size: $250,000. Fees are billed quarterly in advance based on the market value of assets under management.",
  "advisor_roster": [
    {"name": "[ADVISOR 1 NAME]", "title": "CFP®, CFA", "email": "advisor1@clientfirm.com"},
    {"name": "[ADVISOR 2 NAME]", "title": "CFP®", "email": "advisor2@clientfirm.com"}
  ]
}
JSONEOF

echo 'Replace all [BRACKETED] values with actual firm information before deployment.'

cd finplan-ai

az webapp up \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --runtime 'PYTHON:3.11' \
  --sku B2 \
  --location eastus2

az webapp config set \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --startup-file 'gunicorn --bind=0.0.0.0:8000 --timeout 120 --workers 2 app.main:app'

az webapp config appsettings set \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --settings \
    KEY_VAULT_URL='https://kv-clientname-ai.vault.azure.net/' \
    CRM_TYPE='redtail' \
    CRM_API_URL='https://smf.crm3.redtailtechnology.com/api/public/v1' \
    PLANNING_SOFTWARE='emoney' \
    PLANNING_API_URL='https://api.emoneyadvisor.com/v1' \
    AZURE_STORAGE_ACCOUNT='stclientnamearchive' \
    ARCHIVE_CONTAINER='ai-document-archive' \
    NAS_MOUNT_PATH='/mnt/nas/AI-Compliance-Archive' \
    FLASK_ENV='production'

az webapp update \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --https-only true

az webapp auth update \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences 'api://app-clientname-finplan'

az monitor app-insights component create \
  --app appinsights-clientname-finplan \
  --location eastus2 \
  --resource-group rg-clientname-ai \
  --application-type web

INSTRUMENTATION_KEY=$(az monitor app-insights component show --app appinsights-clientname-finplan --resource-group rg-clientname-ai --query instrumentationKey -o tsv)

az webapp config appsettings set \
  --name app-clientname-finplan \
  --resource-group rg-clientname-ai \
  --settings APPINSIGHTS_INSTRUMENTATIONKEY=$INSTRUMENTATION_KEY

echo 'Deployment complete. Access at: https://app-clientname-finplan.azurewebsites.net'

mkdir -p compliance_docs

cat > compliance_docs/AI_Usage_Policy_TEMPLATE.md << 'DOCEOF'
# [FIRM NAME] Artificial Intelligence Usage Policy
## Effective Date: [DATE]
## Approved by: [CCO NAME], Chief Compliance Officer

### 1. Purpose
This policy governs the use of artificial intelligence tools for generating client-facing financial plan narratives and investment proposal documents at [FIRM NAME].

### 2. Scope
This policy applies to all associated persons who use the firm's AI Document Generator system.

### 3. Approved AI Tools
- Azure OpenAI GPT-4.1 (accessed exclusively via the firm's managed application at [APP URL])
- No other AI tools are approved for generating client-facing content
- Use of consumer AI tools (ChatGPT, Claude, Gemini, etc.) for any client-related work is PROHIBITED

### 4. Human Review Requirement
ALL AI-generated documents MUST be reviewed by a qualified advisor before delivery to any client or prospect. Specifically:
a) The generating advisor must read the entire document for accuracy
b) All financial figures must be verified against source data
c) All [DATA NEEDED] placeholders must be resolved
d) Any AI-generated recommendations must be validated for client suitability
e) The advisor must click 'Approve for Client Delivery' in the system, creating an electronic record of review

### 5. Prohibited Uses
- Generating specific security recommendations
- Creating performance marketing materials without compliance pre-review
- Sharing AI-generated content with clients without completing the approval workflow
- Inputting client data into any non-approved AI system

### 6. Recordkeeping
All AI interactions (prompts, outputs, approvals) are automatically logged and archived in compliance with SEC Rule 204-2 and FINRA Rule 4511. Records are retained for [7] years in immutable storage.

### 7. Supervisory Review
The CCO or designated principal will conduct quarterly reviews of a random sample of AI-generated documents (minimum 10% or 25 documents, whichever is greater) to ensure quality and compliance.

### 8. Vendor Due Diligence
The firm has conducted due diligence on Microsoft Azure OpenAI confirming: SOC 2 Type II certification, data encryption at rest and in transit, no training on customer data, data residency in the United States.

### 9. Annual Review
This policy will be reviewed and updated at least annually, or more frequently as regulatory guidance evolves.

---
Acknowledged by: ___________________________ Date: ___________
DOCEOF

echo 'Template created. CCO must customize, review, and formally adopt.'

curl -X POST https://oai-clientname-finplan.openai.azure.com/openai/deployments/gpt-41-finplan/chat/completions?api-version=2025-01-01-preview \
  -H 'api-key: {KEY}' \
  -H 'Content-Type: application/json' \
  -d '{"messages":[{"role":"user","content":"Hello"}]}'