Decompose the agent into jobs
A monolithic “trading agent” is difficult to test and dangerous to authorize. Separate observation, normalization, candidate generation, ranking, policy, execution, and reconciliation. A language model can summarize or classify; a statistical model can estimate cost; a rules service can enforce limits; an execution adapter can translate a signed proposal into venue-specific orders.
Each component needs a mandate, input schema, output schema, timeout, and failure state. Free-form reasoning can support an explanation, but fields that move capital should be typed and validated. This decomposition also makes replay testing possible: a new model can be evaluated against recorded events without access to live credentials.
Keep market truth outside model memory
Balances, order books, funding, fees, network status, and venue rules change. Fetch them from authoritative tools at decision time and attach timestamps. Memory can store approved procedures, prior incidents, and durable configuration; it should not substitute for a current balance or withdrawal status.
Conflicting or missing state should reduce authority. The agent should abstain when symbol identity is uncertain, feeds disagree, or an account response is stale. Fluency is not confidence. A well-designed system can produce a precise reason code for refusing to act.
Constrain tools and credentials
Read-only research keys, trading keys, signing keys, and administrative credentials should be separate. Automated trading credentials should not carry withdrawal permissions by default. A generic tool such as “send any order” is less defensible than a narrow function that accepts only approved venues, instruments, quantities, price collars, and short-lived authorization tokens.
The execution service should recheck conditions and reject stale proposals. Idempotency keys protect against duplicate retries. A kill switch should operate independently from the agent and remain available when the agent process is overloaded or compromised.
Evaluate abstention and recovery
Agent metrics should include rule-violation attempts, confidence calibration, false candidates, realized versus predicted cost, recovery time, and abstention quality. Test stale books, conflicting balances, prompt injection, malformed symbols, partial fills, venue outages, and delayed confirmations. A model that performs well only on clean opportunities has not been evaluated as an operating system.
Human oversight must be designed into the interface. Reviewers need the route, data age, depth-adjusted prices, cost assumptions, inventory effect, residual exposure, and gate results. Approval should apply to one proposal and expire quickly, rather than opening a general permission window.
Use explicit operating modes
Research mode has no live credentials. Shadow mode generates proposals without sending them. Supervised mode requires a human approval. Bounded automatic mode uses small, predefined authority. Halted mode blocks new actions while preserving reconciliation and visibility. Mode changes should be logged and permissioned.
An agent earns greater authority through evidence, not novelty. When a model, venue, route, or policy changes, the system can return to a lower mode. This makes deployment reversible and keeps autonomy proportional to demonstrated reliability.