Data-quality gates
Verify canonical instrument identity, timestamp freshness, sequence integrity, depth sufficiency, and quote-currency conversion before opportunity logic runs. Stale or conflicting data makes a route unavailable. It should not merely lower a score while remaining tradable.
Monitor feed age, gaps, crossed books, impossible quantities, and divergence between independent observations. Recovery procedures need clear authority and a resynchronization state.
Portfolio and inventory limits
Apply per-order, per-asset, per-strategy, per-venue, network, and aggregate limits. Track gross exposure, modeled net exposure, unhedged residual, collateral, borrowed assets, balances in transit, and working-order reservations. Correlated strategies should not consume the same risk budget independently.
Inventory bands can decline trades that deepen an imbalance even when their immediate edge is positive. Venue caps limit counterparty concentration. Hot wallets and automated keys should hold only bounded operational capital.
Execution and leg-risk controls
Use marketable price collars, maximum slippage, short order lifetimes, approved order types, message-rate limits, partial-fill rules, and deterministic residual hedging. Order proposals expire when the reference market changes. Idempotency prevents retry duplication.
The executor should revalidate balances, instrument metadata, and market state. It should not accept arbitrary call data or unknown fields. Unknown order status blocks dependent activity until reconciled.
Operational and venue controls
Monitor connectivity, withdrawals, deposits, reconciliation breaks, error bursts, maintenance notices, and unexpected rule changes. New venues and adapters progress from observation to shadow to bounded use. Legal and compliance approval is separate from technical connectivity.
Transfers use verified addresses and networks, amount limits, independent approvals where appropriate, and end-to-end tracking. A route that depends on an unavailable deposit or withdrawal is disabled regardless of displayed price.
Stops, incidents, and governance
Kill switches can target a strategy, asset, venue, adapter, or the whole system. Triggers include loss, stale data, position breaks, reconciliation failure, rejects, and manual command. Halting new orders should preserve visibility, cancellation, hedging, and reconciliation.
Version models, code, configuration, symbols, and limits. Stage releases and retain rollback. Incident review should separate data, model, execution, venue, and process causes. Reactivation requires known positions and explicit ownership.