What the guardrails do¶
The assistant proposes; these guardrails decide what it can actually do. They're enforced by the server, off the language model, so a misunderstanding stays contained.
Spend caps¶
Two caps bound how much value the assistant can move:
| Cap | Bounds |
|---|---|
| Per-trade (dUSD) | The dUSD value of any single trade |
| Daily (dUSD) | Cumulative dUSD value per UTC day |
The key detail: caps are checked before a trade is quoted, not just at execution. An over-cap request is rejected up front — the model can't reword it through. The daily total is persisted, so it survives a restart, and it's charged conservatively (an attempt counts even if the trade later reverts).
There's also a coarser max-notional limit on the raw input amount for swaps, deposits, and native-token sends. See the plugin config to set caps, or leave them empty for no cap.
Opt-in gates¶
Reads move no funds and are always available. Everything that moves funds beyond a DEX swap is off by default and must be enabled explicitly:
| Gate | Unlocks | Default |
|---|---|---|
| Deposits | deposit_stablecoin, deposit_stock_token (wallet → custodial ledger) |
Off |
| Withdrawals | request + claim dUSD / stock withdrawals (ledger → wallet) | Off |
| Brokerage orders | place_limit_order, place_market_sell_order, cancel_order |
Off |
| Subaccounts | confirm_ai_agent, reject_ai_agent |
Off |
A gated tool the operator hasn't enabled simply isn't exposed — the assistant can't call it. Turning a gate on is a deliberate choice in the config.
Withdrawals have a second lock
For an AI subaccount, enabling the withdrawals gate isn't enough — an admin must also enable off-venue withdrawals on the account, backend-side. The plugin flag can't override that.
Allowlists¶
For tighter setups, the operator can restrict:
- which symbols are tradable,
- which addresses a native-token send may pay,
- which spenders a token approval may grant.
If an allowlist is set, anything outside it is refused as policy — not a bug.
The kill switch¶
The session has a halt() / resume() control. While halted, all trading is blocked — with one deliberate exception: cancel_order still works, so you can always pull a resting order even with the kill switch engaged.
Reads are always safe¶
Prices, balances, quotes, portfolio, order status — none of these move funds, so they're never gated. If you're ever unsure what's enabled, ask for your session status: it reports your mode, signer, caps (with the day's usage), gates, and active allowlists.
See the full tool list and which gate each write needs → MCP tools reference