How to run an AI trading agent with real-money controls

Real money is the point of an AI trading agent, but real money does not mean unrestricted authority. The trades are live after owner authorization. You keep custody, narrow the key, bind the caps, reconcile ambiguous outcomes, and maintain a tested stop path. These controls reduce specific failure modes; they do not make trading risk-free. Here is the checklist.

1. Keep custody of the funds

The owner wallet stays under your control. A trade-scoped agent key can spend an authorized balance on trades but carries no withdrawal authority. That separates one custody boundary from trading risk; it does not replace owner-key protection or recovery planning. The model is covered in depth in Non-custodial trading for AI agents.

2. Scope the key to trade, not to withdraw

Keys are not all-or-nothing. Give the agent a key with the trade scope and nothing more. Withdrawals live behind a separate transfer scope that you never hand to an autonomous agent, and require the owner to authorize the destination and exact transaction locally.

3. Enforce limits outside the model

Prompts are not guardrails. An instruction in a system prompt can be argued around by the model or overridden by a clever input. Real limits live on the key, enforced by the API:

• ·An owner-signed order and daily-notional budget enforced outside the model.
• ·Position limits so no single trade can dominate the book.
• ·A daily-loss or drawdown limit enforced outside the model, with the exact blocking or position-handling behavior reported by the deployed control.

Start the budget small. You can always raise it. You cannot un-lose money.

4. Preview before large orders

Before a big trade, the agent can preview it. The API returns the estimated fill price and fee so the trade can be sanity-checked before it becomes real.

POST /v1/orders/preview {"instrument":"BTC","side":"buy","size_usd":500}
# -> { "est_fill_price":61825.5, "fee":{"fee_usd":0.40,"bps":8} }

5. Make retries safe with idempotency

Networks blip and agents retry. An idempotency key lets an exact retry replay the original workflow. After an ambiguous result, reconcile intent state, positions, and fills before retrying; a new identity can create a second real order.

POST /v1/orders
Idempotency-Key: 6f1c... (a unique id per intended trade)
{"instrument":"NVDA","side":"buy","size_usd":250}

6. Keep an emergency stop within reach

However much you trust the agent, keep a tested emergency stop. One call cancels managed activity where possible and revokes the calling key. It does not automatically close positions or revoke existing token allowances.

POST /v1/panic   # cancels managed activity where possible and revokes the calling key

Review the workflow before authorizing execution

Use authenticated market data, research, backtests, previews, and control checks before authorizing execution. Every executed order remains real money and requires a separate owner-authorized key.