My futures agent runs without approvals. It reads the market, decides, and sends orders. The obvious place for its risk rules would be the prompt: never risk more than a fixed share of the account, never exceed a certain leverage, always set a stop.
A prompt is text the model weighs against everything else it reads. Rules written there hold most of the time, and for money that is not enough. So the limits sit in a gateway between the agent and the exchange, in code the agent cannot change.
Where the limits sit
The agent has no exchange key. It talks to the gateway with a key of its own, and that key belongs to a role with a narrow set of tools: read market and account data, open a position, reduce or close one, cancel its own orders. Every other tool is refused.
The limits themselves are configuration on the gateway. The agent can ask how much risk budget is left, but it has no way to raise it.
What happens to an entry
Every order that opens exposure goes through the same checks:
- Is trading switched on? The switch is mine. If it is off, nothing opens.
- Is the account above its floor, and are the loss limits for the day and for the last seven days intact?
- Has the agent already used its entries for today?
- Is the symbol in the allowed set, which contains only the most liquid contracts?
- Does the order carry a stop-loss on the correct side of the entry, and is the stop distance inside the permitted band?
- Is the leverage within the cap and the margin isolated?
- Would this trade push the sum of all possible stop-losses above the budget for the whole account?
The agent does not choose a position size. It states which share of the account it is willing to lose if the stop is hit, and the gateway calculates the size from the entry price and the stop distance. If that budget is smaller than one lot of the contract, the order is refused.
Refuse, don’t repair
When a check fails, the gateway refuses the order and gives the reason in one sentence, for example that the stop distance is outside the band. It does not move the stop or lower the leverage on the agent’s behalf. The agent reads the reason and decides again.
I chose this because a gateway that quietly repairs orders produces positions nobody asked for in that form. With refusals, every position on the exchange goes back to one explicit request.
Fail closed
If the gateway cannot read positions, open orders or the current price, it refuses new entries. An account it cannot see is treated like an account with no risk budget left.
Stops are protected too
The agent may cancel its own orders, with one exception: it cannot remove the protective stop of an open position. It first has to place a stop that is at least as tight, and only then can the old one go. Cancelling all orders at once is not available to it, because that would drop the stops as well.
What this does not solve
The gateway limits how much the agent can lose. It says nothing about whether the trades are any good. That is a separate problem with tools of its own, a paper book and a research bench, and a topic for other notes.