How an AI agent trades stocks while you keep full custody

You can let an AI agent trade stocks on your behalf while your cash and shares stay in an account that only you control. The agent receives a scoped key that lets it send buy and sell instructions within strict limits, but it cannot withdraw funds or send money to itself. This arrangement is non-custodial by construction, meaning the agent operates inside boundaries you set while you retain the final authority over every dollar.

What does non-custodial stock trading with an agent actually mean?

You might think that letting software trade for you requires sending your capital to a third party or giving up legal ownership of your shares. That is the traditional custodial model, and it is not what happens here. In a non-custodial setup, the AI agent is better understood as a remote operator that works on your accounts, not as a fund manager that holds your assets. Your cash and shares remain at a stock broker or in a wallet that you opened and control. The agent connects through an API and can see market data, submit orders, and read fills, but it cannot change the ownership of the underlying securities. You are the legal and technical owner at every step. If you decide the agent is behaving poorly, you revoke its key and the connection disappears instantly. The funds do not move because they were never in the agent's possession. This architecture changes the trust problem into an operational problem. Instead of worrying whether the service will abscond with your money, you focus on whether the agent's strategy will lose money within the guardrails you set. That is a meaningful difference, but it does not eliminate risk. Trading can lose money, including your entire allocated budget, and you should size your capital accordingly. How to let an AI trading agent spend real money without giving up custody

How does the agent place orders without holding your funds?

The agent does not hold a brokerage account, a bank account, or any legal entity that can own property. It stores a scoped API key that is bound to your identity at the venue where your funds already sit. The key is a credential, not a wallet. It cannot store value, receive deposits, or sign transactions that move assets to a new owner. When the agent's strategy decides to act, it constructs an order message and sends it through the Felix API. The infrastructure validates the message against your safety controls, then forwards it to the stock broker. The broker checks that the key is active, that your account has sufficient buying power, and that the order is within any venue-specific rules such as short locate requirements or trading halts. If the check passes, the broker enters the order into its matching engine. When the order fills, the shares and cash settle inside your account, exactly as if you had clicked the buy button yourself. The agent merely generated the instruction. Because orders are sized in plain US dollars, the agent does not need to know about lot sizes, tick values, or fractional share logic. You tell the agent to buy five hundred dollars of a stock, and the API normalizes that into the correct share quantity for the specific broker. This removes an entire class of sizing errors and makes the agent's logic portable across different venues. The exact request schema is in the docs; the shape looks like this:

{
  "tool": "place_stock_order",
  "parameters": {
    "symbol": "AAPL",
    "side": "buy",
    "dollar_amount": 500,
    "api_key": "YOUR_KEY"
  }
}

If the agent were somehow compromised, an attacker holding the key could only place orders within your preconfigured caps. They could not withdraw cash, change your bank link, or transfer shares to another account. The key is scoped to trading, and withdrawal addresses are owner approved only. This is the core of the non-custodial guarantee. The agent can spend within limits, but it can never take the money home. How an AI agent executes orders while you keep full custody

What safety controls prevent unauthorized withdrawals?

Non-custodial access is only trustworthy if the controls are enforced by the infrastructure, not by the agent's own code or by a prompt that might be manipulated. Felix implements several layers that are active before the agent sends its first order, and they remain active for every subsequent message. First, the API key is scoped. You can restrict it to specific market types, specific symbols, or even specific sides. A key scoped to buy only cannot sell, and a key scoped to stocks cannot touch options or crypto. This scoping happens at the infrastructure level, so the API endpoint itself refuses invalid requests. Second, budget caps and position limits act as hard ceilings. You might configure a cap of five thousand dollars in total exposure and a limit of ten concurrent stock positions. The API tracks these totals in real time and rejects any order that would breach them, even if the agent believes it is making a sound decision. Third, exit plans define automatic flattening rules. You can set a drawdown percentage or a time-based exit. If the threshold is hit, the system closes positions and pauses trading without waiting for the agent to agree. Fourth, withdrawal addresses are owner approved only. The agent cannot add a new bank account, a crypto wallet, or any other destination for outbound transfers. Even if the agent requests a withdrawal, the infrastructure blocks it because the destination is not on your whitelist. Finally, the panic or kill switch flattens all positions and revokes the key immediately. You can trigger it manually, or in some configurations it can trigger automatically when a critical limit is breached. These controls are not suggestions that the agent should follow. They are rules that the API enforces. A bug, a hallucinated symbol, or a malicious prompt in the agent cannot override them, because the agent never had the authority to bypass the infrastructure in the first place. A practical checklist for running autonomous trading systems with real money

How do you size and monitor stock positions?

Stock brokers vary in how they handle share quantities, fractional shares, and minimum order sizes. Some venues allow fractional purchases down to a single dollar, while others require whole-share lots. Rather than forcing the agent to learn each venue's specific rules, the Felix API accepts orders expressed in plain US dollars. If you instruct the agent to allocate one thousand dollars to a particular stock, the API translates that into the correct number of shares, including fractional amounts if the venue supports them. If the venue does not support fractions, the API rounds down to the nearest whole share and adjusts the dollar total accordingly. This abstraction removes an entire class of sizing errors and makes the agent's logic portable across different brokers. Monitoring is handled through continuous audit logs and observability hooks. Every order submission, fill, cancellation, and rejection is recorded with a timestamp, the exact scoped key that triggered it, the symbol, and the dollar amount involved. These logs are append-only from the agent's perspective, meaning the agent cannot delete or alter them. You can stream the logs to your own dashboard, store them in external storage, or review them in the Felix interface. The logs let you verify that the agent is trading the symbols you expect, staying within its dollar budget, and not triggering safety limits. You can also set alerts that notify you when the agent approaches its budget cap or triggers a safety limit, which gives you time to review before the API begins rejecting orders. Good monitoring is not a luxury. It is how you confirm that your safety controls are working and that the agent has not drifted from its intended behavior. It is also your primary tool for post trade analysis if you need to adjust the strategy or the guardrails.

What should stock traders know about settlement and dividends?

Stock trading introduces mechanics that differ from crypto or perpetual futures. When an agent buys a stock, the trade typically settles on a T+1 or T+2 cycle, meaning the cash and shares do not exchange hands instantly. The agent can place orders, but it cannot speed up settlement. This matters for safety because the agent's buying power is a function of settled cash and margin rules, not just the balance shown on a screen. If the agent places multiple orders before previous trades settle, it may encounter insufficient funds rejections. You should configure your position limits and budget caps with settlement timing in mind. You should also review your broker's margin and settlement rules, because the agent's ability to trade is ultimately constrained by the account's real buying power, not just the API limits. Dividends and corporate actions also flow to your account, not to the agent. If the agent holds a dividend-paying stock, the cash dividend lands in your brokerage account just as it would if you held the shares manually. The agent does not receive special treatment or separate payouts. Splits, mergers, and other corporate actions are handled by the broker and reflected in your positions directly. The agent will see the adjusted symbol or share count on its next data read, but it does not process the corporate action itself. Understanding these mechanics helps you set realistic expectations for the agent. It is an order generator, not a back office administrator. Settlement, dividends, and corporate actions remain the broker's domain, and your custody of the assets means you receive all the downstream benefits and risks.

How do you start with paper trading and move to live?

You should never let an agent trade real money on its first run. Felix provides paper trading for exactly this reason. In paper mode, the agent connects to live market data and receives simulated fills based on real order books, but no cash moves and no shares change ownership. You can use this phase to test strategy logic, confirm that your budget caps and position limits trigger correctly, and observe how the agent behaves under volatile conditions. You can pause the agent at any time during paper trading to inspect its logs and adjust its strategy before reactivating it. Paper trading uses the same API shape and the same safety controls as live trading, so moving from one to the other is a matter of changing the key, not rewriting code. The behavior you observe in paper mode should be nearly identical to live mode, with the important caveat that simulated fills do not experience slippage or liquidity gaps the way real orders sometimes do. When you are ready to go live, you generate a new key and explicitly authorize it for real spending. The infrastructure requires this authorization step so that a paper key cannot accidentally touch production funds. Start with a small budget cap that you can afford to lose entirely. Observe the agent across multiple sessions and market conditions. Only after you see consistent, expected behavior should you consider raising the cap. Agents can connect through MCP tools in AI editors like Claude or Cursor, or through direct REST API calls from your own servers. Both paths use the same scoped key model and the same safety controls. The custody model does not change whether the agent is an LLM invoking tools or a Python script running on a server. In all cases, your funds stay in your account, the agent gets limited access, and you retain the kill switch. Trading with real money carries genuine risk. You can lose your entire allocated budget, and past behavior in paper trading does not guarantee future results in live markets. How to take an AI trading agent live in 2026