Non-custodial trading for AI agents: trade authority without withdrawal authority

When people worry about letting an AI agent trade real money, they often picture a bad trade. Owner-signed caps bound authorized trading activity, but gaps, liquidation, venue behavior, implementation defects, and other residual risks can still affect realized losses. Non-custodial architecture reduces one withdrawal-authority failure mode while keeping execution real-money and preserving other stated risks.

What does non-custodial mean?

Non-custodial means owner custody remains separate from narrower agent permissions. The money lives in a wallet whose control key you hold, not in a company's omnibus account. A trade-scoped agent is not the withdrawal path; transfer actions require separate authority and exact owner-signed constraints. Owner-key, module, contract, venue, software, operational, and market risks remain.

Non-custodial design separates owner and withdrawal authority from a narrower trading grant; the exact module, key, contract, and recovery state still require verification.

Why custody separation matters in agentic trading

Agents can run unattended and take instructions from text that can be manipulated. That is a bad combination to point at a withdrawal path. The practical response is to narrow the authority surface and enforce boundaries outside the model. Separate the two powers:

• ·The power to trade: place and cancel orders, move between positions. Give an agent only the minimum trade-scoped authority required, with owner-signed caps and a tested revocation path.
• ·The power to withdraw: move funds to an external address. Keep this away from the agent entirely.

Once those are separate, the agent credential remains limited to its owner-signed trading caps and carries no withdrawal authority. That reduces one custody failure mode; it does not eliminate market, software, owner-key, venue, or operational risk.

How Felix enforces the split

Felix is built on this separation from the ground up:

• ·Your real funds sit in a wallet you control. Deposits become spendable trading cash without transferring custody.
• ·A trade-scoped key can open, size, and close real positions, but has no ability to withdraw.
• ·Withdrawals need transfer scope, only go to an address the owner explicitly signed, and require the owner to sign the exact withdrawal transaction locally.
• ·Money workflows use durable idempotency identities. After an ambiguous response, reconcile intent state, positions, fills, and balances before any retry; changing the identity can create a second action.

A trade-scoped key cannot choose an arbitrary withdrawal destination, but authorized trades and other system risks can still lose allocated funds. Keep owner-signed caps low, monitor state, and retain a tested revocation and recovery path.

Non-custodial does not mean no limits

Separating withdrawal authority reduces custody exposure. Owner-signed order, daily-notional, and daily-loss caps bound trading authority. You want both. See How to give an AI agent a trading account for the scoping and caps in practice, and How to run an AI trading agent with real-money controls for the full checklist.