# What guardrails should an AI trading agent have?

Updated 2026-10-20.

## What guardrails should an AI trading agent have?

Keep the controls outside the agent. Hard limits live in a file the agent cannot write. A separate check reads each order before it is sent. You hold a kill switch, a paper-before-live gate, and a log of every check. Read the trading environment back before the first order.

1. Hard limits in a file the agent cannot write. [validate_limits.py](/packs/desk-kit/validate_limits.py) reads max loss, live trading, and human approval from limits.md. The same names on the proposal do not count.
2. A per-order check outside the agent. Paste the order into the free [Agent Order Check](/check). It runs in the browser. The [risk gate](/skills/risk-gate) returns CLEAR or SEND-BACK on the written rules.
3. A kill switch the agent can read and cannot write. The pattern and the paper test are on the [kill switch guide](/guides/ai-trading-bot-kill-switch).
4. A paper-before-live gate. The [paper-to-live gate](/skills/paper-live-gate) stays DISARMED until you write ARMED.
5. Read the trading environment back before the first order. The TradeStation pack sets the environment to sim and asks you to read it back. The Alpaca pack stays on the paper host until live trading is on.
6. Log every check and every reject. If ok is false, do not send.

## Where do published controls sit?

Each sentence is only what the linked paper says.

Price collars, maximum order size limits, and position or risk limits linked to P&L exposure sit outside the AI layer and operate as independent gateway controls before any model output interacts with the market ([FMSB, AI in Trading, February 2026](https://fmsb.com/wp-content/uploads/2026/02/FMSB-AI-in-Trading_Final_12.02.26_FINAL.pdf)).

The practices apply to existing technologies and to evolving ones, such as artificial intelligence ([FIA, July 2024](https://www.fia.org/sites/default/files/2024-07/FIA_WP_AUTOMATED%20TRADING%20RISK%20CONTROLS_FINAL_0.pdf)). Localized pre-trade risk controls can be implemented at the trader, at the broker, or at the exchange ([FIA, July 2024](https://www.fia.org/sites/default/files/2024-07/FIA_WP_AUTOMATED%20TRADING%20RISK%20CONTROLS_FINAL_0.pdf)). Kill-switch functionality may be separate from the trading application itself and can be operated by the trader and by the person responsible for risk ([FIA, July 2024](https://www.fia.org/sites/default/files/2024-07/FIA_WP_AUTOMATED%20TRADING%20RISK%20CONTROLS_FINAL_0.pdf)).

Version 1.1 is dated 9 October 2026. The paper says it does not constitute regulatory guidance or supervisory expectations ([MAS, SAFR v1.1](https://www.mas.gov.sg/-/media/mas-media-library/development/fintech/ai-safr/safr-v1-1.pdf)). SAFR sits between the agent and the systems it acts on, evaluating proposed actions before execution ([MAS, SAFR v1.1](https://www.mas.gov.sg/-/media/mas-media-library/development/fintech/ai-safr/safr-v1-1.pdf)). Guardrails built into the application and the agent do not by themselves determine whether a proposed financial action should proceed ([MAS, SAFR v1.1](https://www.mas.gov.sg/-/media/mas-media-library/development/fintech/ai-safr/safr-v1-1.pdf)). An audit log entry, once written, cannot be modified by the agent or by any downstream system ([MAS, SAFR v1.1](https://www.mas.gov.sg/-/media/mas-media-library/development/fintech/ai-safr/safr-v1-1.pdf)).

Checked on 2026-10-20.

The staged path from research through paper to live is the [paper trading guide](/guides/ai-agent-paper-trading).

## Kill switch

A kill switch stops new orders when you are not at the screen. It lives outside the agent, in a flag file or an environment variable the agent can read and cannot write. Daily max loss and a max order count are trips that set that switch. Flattening open positions is a separate step. The pattern, the broker controls, and the paper test are on the [kill switch guide](/guides/ai-trading-bot-kill-switch).

## How do I stop an AI agent from placing a bad trade?

Approving every order is a floor, not a risk system. Start in the simulator or on a paper host, and keep max loss, live trading, and human approval in a file the agent does not write. Run a checker that rejects a bad order before a person sees it.

## What are banks doing about AI agents?

JPMorgan Chase blocks a third party that gets in by taking a customer's banking credentials and logging in, and says it supports secure, customer-authorized data sharing through open banking providers ([CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html), [Fortune](https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/)). Jamie Dimon said the bank will not allow outside agents in because of the risk from rogue agents. Charles Schwab is blocking unauthorized agents, including Meta's Muse, from moving client money, and says MCP servers it is preparing can show balances and research but cannot move money ([Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers), [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html)). A broker MCP is the other path: the customer authorizes the connector, and an order still needs approval where that connector requires it ([broker connectors](/guides/broker-ai-connectors)).

These reports were checked on 2026-10-17.

| Path | What is blocked | What is allowed | Source |
| --- | --- | --- | --- |
| Bank credentials | A third party logs in with the customer's banking password and acts on the account. | JPMorgan blocks that login. Schwab blocks unauthorized agents, including Muse, from moving client money this way. | [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html), [Fortune](https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/), [Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers) |
| Open banking | The agent taking the customer's banking credentials to log in. | Customer-authorized data sharing through an open banking provider. CNBC reports a read-only path, such as balances, when a provider has the credentials, and that the agent cannot send money or pay a bill. | [CNBC](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html), [Fortune](https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/) |
| Broker MCP | A bank password used to move money. | The customer authorizes the broker's connector. Read the row for OAuth and for whether an order waits for approval. Schwab says the MCP servers it is preparing will not move money. | [Broker connectors](/guides/broker-ai-connectors), [Bloomberg Law](https://news.bloomberglaw.com/banking-law/us-banks-block-ai-agents-attempting-to-move-money-for-customers), [Moneycontrol](https://www.moneycontrol.com/news/business/after-jpmorgan-charles-schwab-blocks-unauthorised-ai-agents-from-accessing-customer-accounts-14054121.html) |

Whether to give an agent a brokerage password, and the authorized connection to use instead, is on [Should I give an AI agent my brokerage password?](/guides/ai-agent-brokerage-password).

## Is approving every order a risk system?

No. It is a floor. The click stops an order the agent would have sent alone. It does not check the asset, the side, the bracket, or the loss. The [TradeStation expert pack](/guides/ai-agents-for-tradestation) records that confirm accepted a sell larger than the long, a close with no position, and a price off the tick. The [Alpaca expert pack](/guides/ai-agents-for-alpaca) has no separate confirm call. Refuse the order in the checker before a person is asked.

## Where does the first order go?

The simulator, or the paper host. The TradeStation pack sets the environment to sim and asks you to read it back before an account call. The Alpaca pack stays on the paper host until live trading is on. The [Desk Kit](/desk-kit) install writes LIVE_TRADING: off and PAPER_FLAG: DISARMED. DISARMED is the paper state. Risk accepts DISARMED on a paper draft.

## Where do the limits live?

Outside the agent, in limits.md, which you write. [validate_limits.py](/packs/desk-kit/validate_limits.py) reads max loss, live trading, and human approval from that file only. The same names on the proposal do not count. The parser reads the lines above SPECS and stops there.

## Which orders should a checker reject?

A checker should reject an unknown asset type, a missing side, bracket legs on the wrong sides, a stop at the entry, a proposal that raises max loss, and a proposal that turns live trading on or human approval off. The strings below are what these checkers return. If ok is false, do not send.

| Order | Checker | What it returns |
| --- | --- | --- |
| Asset type missing, blank, or not on the list. A typo such as `futures` is not treated as an equity. | Desk Kit `validate_limits` | `asset type not listed` |
| Side missing, or no buy or sell intent. | Alpaca `validate_order`, and Desk Kit `validate_limits` | Alpaca: `side is buy or sell.` Desk Kit: `intent missing` |
| Bracket legs on the wrong sides. A buy with the take-profit under the entry and the stop over it. A sell is the reverse. | Alpaca `validate_order` | `A buy bracket needs take_profit above the entry and the entry above the stop.` A sell returns `A sell bracket needs take_profit below the entry and the entry below the stop.` |
| Stop at the entry, or closer than one cent. | Alpaca `validate_order` | `The stop must be at least $0.01 from the entry.` |
| Proposal sets max loss to 100 while limits.md says 50. Example: two MES, 8 points, multiplier 5, dollar risk 80. | Desk Kit `validate_limits` | `dollar risk exceeds max loss` |
| Proposal sets live trading on, or human approval off, while limits.md says the opposite, and the line is marked sending. | Desk Kit `validate_limits` | `LIVE_TRADING is off`, or `human approval missing` |

The TradeStation check is [validate_order.py](/packs/tradestation/validate_order.py), before every confirm. The Alpaca check is [validate_order.py](/packs/alpaca/validate_order.py), before every order.

## What do I paste?

Save the block below as limits.md when you want to try the check. If you already finished the install, keep your own file. The numbers are an example for the checker. They are not a position size.

```
LIVE_TRADING: off
PAPER_FLAG: DISARMED
MAX LOSS PER TRADE: 50
MAX LOSS PER DAY: 150
MAX OPEN POSITIONS: 2
NEVER TRADE:
HUMAN_APPROVAL: on
KILL_SWITCH: operator
```

Then save the line as `proposal.json` in the same folder and run:

```
python3 validate_limits.py limits.md proposal.json --realized-today 0 --open-positions 0
```

The worked line in the Desk Kit readme is one future. Example symbol MES. Example price 5000. Invalidation 4992. Quantity 1. Multiplier 5. Tick size 0.25. Tick value 1.25. Sending false. Dollar risk is 40, which is under the 50 on limits.md, so the checker prints `"ok": true`. Change the quantity to 2. Dollar risk is 80. The checker prints `"ok": false` even when the proposal also says `"max_loss": "100"`, `"live_trading": "on"`, and `"human_approval": "off"`.

Free check: https://theagentictrader.com/check?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-trading-guardrails
Weekly note on broker and agent changes: https://theagentictrader.com/subscribe?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-trading-guardrails
Desk Kit, $79 one-time. Full refund within 7 days: https://theagentictrader.com/desk-kit?utm_source=md&utm_medium=agent&utm_campaign=guides-ai-agent-trading-guardrails