How AI agents change stock trading without taking custody of your funds

AI agents can now trade stocks through your existing brokerage account while your funds remain in your name and under your sole control. Instead of depositing capital into a managed account or giving the agent a wallet it owns, you authorize scoped access that lets the agent place orders within strict limits you define. The architecture means the agent can buy or sell shares, but it cannot withdraw cash, change ownership, or exceed the budget caps you set. This changes stock trading because it removes the traditional custody trade-off between automation and control.

What does non-custodial stock trading actually mean?

Traditional automated stock strategies often force a custody choice. You either manage positions yourself, or you hand capital to a fund, a managed account, or a platform that pools investor money. In those models, you no longer hold the shares directly. You hold a claim on someone else’s balance sheet, and your return depends on their solvency, their fee structure, and their willingness to return your capital when you ask for it.

Non-custodial stock trading reverses that flow. Your cash and shares stay in your account at a stock broker. The AI agent receives a scoped credential that can only place orders and read balances. It never takes delivery of your assets, and it never becomes the legal owner of the account. If the agent stops working, your capital is still sitting where you left it, accessible to you through the normal brokerage interface.

This model is conceptually similar to self-custody in crypto, but adapted to the brokerage world. You retain the direct relationship with the broker. Dividends, interest on cash balances, corporate actions, and tax documents flow to you, not to an intermediary. There is no commingling of assets. The agent is a software layer that sits above your account, not a counterparty that sits between you and your money. You can revoke it at any time without filing a withdrawal request or waiting for a redemption window. How AI agents trade across markets without taking custody of your funds

How does an AI agent place orders without holding your funds?

The agent connects to the Felix API through an MCP client or a direct REST integration. When you create an API key, you scope it to specific actions, such as spot stock orders and balance queries. You do not grant withdrawal permissions, and you do not grant permissions to change account settings or linked bank accounts. The key is tied to your account, but it is not your master login. If you ever need to cut access, you revoke the API key without changing your brokerage password or locking yourself out of the web interface.

When the agent decides to trade, it sends an order instruction denominated in plain US dollars. The API translates that instruction into the share math required by the underlying stock broker. The agent never needs to know how many shares equal your intended dollar amount, nor does it handle settlement logic, lot sizes, or fractional share rounding. It simply requests a purchase or sale of a specific dollar value, and the API normalizes the rest against the broker's current rules.

Because the agent never holds the funds, it cannot sweep cash to an external address. Withdrawal destinations, if any, are owner-approved and frozen at the key level. The agent cannot add a new bank account, request a wire, or transfer shares to another entity. Even a fully compromised agent is trapped inside the trading sandbox. It can only move value between cash and shares within your account, and only within the limits you set. How an AI agent executes orders while you keep full custody

What safety controls keep the owner in charge?

Scoped keys are the first layer. You can restrict an API key to a single market type, such as stocks only, or to a specific set of symbols. You can also cap the total dollars the agent is allowed to deploy per day, per week, or per trade. These constraints are enforced at the API level, not by the agent's own logic, so a buggy or adversarial prompt cannot override them.

Budget caps prevent the agent from exceeding a maximum notional exposure. Position limits keep any single name from becoming too large a share of the account. Exit plans let you pre-schedule take-profit or stop-loss rules that the agent must follow, rather than letting it improvise exits in real time. An exit plan is a pre-commitment you write in advance, and the agent is bound to it.

The panic switch is the final layer. If the agent behaves unexpectedly, or if market conditions shift faster than the model can adapt, you can trigger a kill switch. This flattens open positions and revokes the API key in one action. The agent loses access instantly, and you are left with cash or neutral exposure in your own account. The switch is designed to be a single decisive action, not a negotiation with the agent. How to set guardrails for a trading agent without giving up custody

Why does dollar-based sizing matter for agentic stock trading?

Stock brokers handle shares, fractional shares, lot sizes, and price fluctuations. An AI reasoning in natural language does not think in terms of lot sizes. It thinks in terms of intent: allocate five hundred dollars to a position, or reduce exposure by one thousand dollars. Forcing an LLM to compute share counts introduces unnecessary complexity and raises the chance of a rounding error or a unit mismatch.

If the agent were forced to compute share counts manually, it would need to fetch prices, divide intended dollars by the current quote, round to the nearest tradable unit, and account for commissions and fees. That is fragile. A rounding error, a stale price, or a confusion between share count and dollar value can turn a conservative intent into an oversized order. In fast moving markets, that delay can also mean the computed share count is wrong by the time the order arrives.

The API abstracts this away. The agent states the order in dollars, and the system handles the conversion to shares at the current market price. This reduces logic errors, simplifies prompts, and keeps the agent focused on strategy rather than venue-specific contract math. It also makes backtesting and paper trading more consistent, because the same dollar intent maps to the same logical exposure regardless of which stock broker executes the trade. The owner thinks in dollars, the agent thinks in dollars, and the API translates to the mechanical reality of the market.

How do you test a stock trading agent before going live?

Paper trading exists for exactly this purpose. You can run the agent against a simulated environment that mirrors the live API, including the same dollar-based sizing, position limits, and exit plans. The agent believes it is trading real money, but the orders do not hit the market. This lets you observe behavior without paying tuition to the market.

During paper trading, verify the following:

1. 01Confirm that the agent respects the scoped key limits and does not attempt to access forbidden markets or symbols.
2. 02Check that position sizing and budget caps behave as expected under volatile conditions.
3. 03Practice triggering the kill switch and observe that the agent flattens and stops immediately. You should also review the audit logs to confirm that the agent is not leaking information or making unexpected API calls.

Live trading requires an explicit owner authorization step. The paper key does not automatically graduate to real money. You must separately approve a live key, which is a deliberate checkpoint that forces you to review the guardrails one more time. This two-stage process prevents accidental deployment. Many owners also choose to start with a small live budget, such as a fraction of the eventual allocation, to observe how the agent handles real slippage and liquidity before scaling up.

What risks remain even when you keep custody?

Keeping custody eliminates counterparty risk and theft, but it does not eliminate market risk. The agent can still lose money, including a substantial portion of the account, if its strategy is wrong or if the market moves against it. Budget caps and position limits reduce the speed of loss, yet they cannot guarantee positive returns. You can still end up with less capital than you started.

Model risk is another concern. An LLM-based agent may misinterpret a news headline, a technical signal, or a prompt instruction. Scoped keys and dollar sizing limit the blast radius, but they do not fix the underlying reasoning error. You should monitor logs, set conservative initial budgets, and avoid deploying untested strategies on large capital. The agent is only as good as the strategy you give it.

Operational risk also matters. API sessions can expire, stock brokers can experience downtime, and network delays can cause slippage between the agent's decision and the filled price. The kill switch is a safety net, not a time machine. It closes positions at the market price available when it triggers, which may differ from the price you expected. You should maintain a direct login to your brokerage account so you can intervene manually if the automation layer fails.

Non-custodial architecture gives you control, not immunity. The goal is to let automation work while keeping the downside bounded and reversible. You can stop the agent, change the strategy, or withdraw your funds at any time without waiting for permission from a third party. How to control the risks of non-custodial trading with real money