# Build an investor report from your own documents An investor asks for everything you have on one client. Your agent can pull that together: what exists, when each file was proven, and what it holds. This works over the MCP connector alone. You do not need the agent skill. > **Agent summary** > - Find what is not yet described: `list_documents` with `hasClassification: false`. > - Read a file back: `read_document`. Needs the `documents:content` scope, which is not on by default. > - Record what you found: `annotate_document` with `parties`, `documentDate`, `abstract`. > - Pull the set: `list_documents` with `party`, `sort: "documentDate"`, `order: "asc"`. > - Two dates. `createdAt` is proven. `documentDate` is read off the page and is not. > - Raw twin: [/docs/diligence-report.md](/docs/diligence-report.md) ## What can immut tell an investor? That a file existed at a precise time and has not changed since. Anyone can check it, with no account. That is the part immut proves. Everything else in your report is your agent's reading of your own documents. Keep the two apart and the report is strong. Blur them and it is worth less than saying nothing. ## How does my agent find documents about one client? Ask for them by party. ```bash curl "https://backend.immut.io/api/v1/documents?party=Acme%20Corp&sort=documentDate&order=asc" \ -H "Authorization: Bearer $IMMUT_API_KEY" ``` `party` is an exact match, not a search. "Acme" will not return "Acme Holdings". In diligence the difference between two legal entities matters, so the match is strict. Over MCP that is `list_documents` with `party`, `sort` and `order`. ## What if the documents were never described? Then your agent describes them first. This is the common case for files someone uploaded by hand. The loop is three steps, and it needs no local files. 1. Find them: `list_documents` with `hasClassification: false` 2. Read each one: `read_document` 3. Record what you found: `annotate_document` ```bash curl -X PATCH "https://backend.immut.io/api/v1/documents//classification" \ -H "Authorization: Bearer $IMMUT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"parties":["Acme Corp"],"documentDate":"2024-03-11","docType":"contract","docState":"executed"}' ``` It merges. Sending one field never blanks the others. ## Which date do I show? Both, labelled. They answer different questions. | Field | What it is | Proven? | |---|---|---| | `createdAt` | When immut received the file and anchored it | **Yes.** This is the evidence | | `documentDate` | The date printed on the document | No. Your agent read it | A contract dated March 2024 and uploaded in August 2026 has both. Order the story by `documentDate`. Make the claim with `createdAt`. Never put an unproven date in a column headed "proven". immut exists to prove *when*. A judged date dressed as a proven one undoes the only thing the report is for. ## Why is reading a document a separate permission? Because it is a different level of trust. `documents:read` returns names, dates and proof references. `documents:content` returns the document itself. An admin grants the second one deliberately, in Organization Settings. It is not on agent keys by default. Every content read is written to your audit log. The connector is hosted, so the file passes through immut on its way to your AI tool. ## Can immut summarise my documents for me? No. immut holds your files encrypted and never reads them. Your agent reads them, on your machine or through your AI tool, and writes the summary. `abstract` stores what your agent wrote. Because that means immut then holds a description of what is inside your files, it is off until an admin turns it on. Ask for one without it enabled and the request is refused, not quietly ignored. ## What must the report say that agents tend to leave out? Two things, and both protect you. **What is missing.** Files your agent could not open, and documents with no record, belong in the report. A tidy report that quietly drops them reads as complete and is not. **Who decided what.** immut proved the dates. Your agent judged the types, the parties and the summaries. The export pack already words this well: an AI agent's judgement, not a warranty by immut. ## How do I send it? Share the files with a link that expires. Create it for a document, a folder or a whole workspace, name the people who may open it, and set a date it dies. Recipients confirm by email code. You can see who opened what, and revoke it at any time. Send the report your agent wrote alongside it. You review it first. Your agent does not send anything on your behalf. ## What if they want to check it themselves? They can, on any file, without asking you. ```bash curl "https://backend.immut.io/api/public/verify/" ``` No key, no account. That is the point. Full detail on [how to verify](/docs/verify).