Which Risk Parameters Must Stay Under Human Control in an AI Trading Agent?
Leverage, position size, capital at risk and final execution: which risk parameters an AI trading agent may automate and which must stay under human control, and how to enforce it.
The short answer
In an AI trading agent, the parameters that define how much can be lost must stay under human control: leverage and margin settings, position size and total capital at risk, and the authority over final execution of orders (who can execute, through which wallet, with what limits).
What can be automated is the search for opportunities: token discovery, signal generation, and, within limits set by a human, the trade idea itself, including direction.
The principle: the agent may decide what to do; a human decides how much is allowed and under what conditions the agent may act at all. The rest of this article explains why, and how to make that split real instead of a line in the prompt.
Parameter by parameter
Leverage and margin settings: human. Leverage multiplies the cost of every mistake, including the model's. A human sets the maximum, and the agent can only use less.
Position size and total capital at risk: human. This is the single most important control. A human defines the per-trade cap, the portfolio-wide exposure cap and the daily loss limit. The agent sizes within them.
Final execution of orders: human-governed. That does not always mean a person clicks 'confirm'. It means a human decides which wallet the agent signs with, what it can withdraw (ideally nothing), which venues it can touch, and which conditions block execution entirely.
Trade direction: can be automated, inside limits. Choosing long or short is the agent's job if you are using an agent at all. What a human controls is whether the agent may go short, may use leverage in a given direction, or must stand aside when conditions are extreme.
Token discovery and research: fully automatable. Scanning markets, reading data and ranking candidates carries no direct financial risk until an order is placed.
Why these parameters, specifically
The test is simple: does a wrong value cause losses on its own, regardless of whether the trade idea is good?
A bad trade idea at small size is a cheap lesson. A good trade idea at 10x leverage with half the account can still end in liquidation from ordinary noise. Size, leverage and capital at risk are where errors compound, and they are exactly the parameters a model is worst at: it has no stake in the outcome, it can be talked into overconfidence by its own reasoning, and it can be manipulated by injected text in the data it reads.
Direction and discovery, on the other hand, are where an agent adds value. Keeping humans in charge of those would defeat the point of the agent.
Human control does not mean human in every loop
A common mistake is to read 'human control' as 'a person approves every trade'. That does not scale, and people stop reading confirmations after the tenth one.
The better pattern is human-set policy, machine-enforced. A human writes the limits once: maximum leverage, maximum position as a fraction of capital, maximum total exposure, conditions that block new entries. A deterministic system outside the model enforces them on every order, without exceptions. The human reviews the policy and the audit log, not each trade.
One refinement: static limits are not enough in crypto. A 20% position that is reasonable in a calm range is reckless in a liquidation cascade. So the human sets the ceiling, and a risk engine can tighten the effective limit when market conditions deteriorate, but never loosen it above what the human allowed.
How to enforce it in practice
Put the limits outside the model. Anything in the system prompt is a suggestion the model can ignore or be argued out of. Limits must live in code that runs between the model's decision and the order.
Check before every order. The agent proposes; a pre-trade check returns the allowed size and the blocked actions; the order is resized or rejected before it is sent.
Restrict the wallet. Give the agent a key that can trade but not withdraw. On Hyperliquid this is an API wallet; on Safe it is a module with limited permissions.
Log every decision. Record the inputs, the limits that applied and a hash of the decision, so you can reconstruct afterwards why the agent was allowed to do what it did.
Make the risk layer read-only to the agent. The agent must be able to ask 'what am I allowed to do?' and never 'change what I am allowed to do'. If the governed system can move its own limits, the limits mean nothing.
A checklist you can use
Before an AI agent trades real money, confirm each of these is set by a human and enforced outside the model:
1. Maximum leverage per asset.
2. Maximum position size as a fraction of capital.
3. Maximum total exposure across positions.
4. Daily or weekly loss limit that halts the agent.
5. Conditions that block new entries, such as extreme volatility or crowded positioning.
6. A wallet that cannot withdraw funds.
7. An audit log with the limits applied to every decision.
If any of these lives only in the prompt, it is not a control.
Human-set limits, machine-enforced.
RiskState returns the maximum size, leverage cap and blocked actions for BTC and ETH before every order, read-only to the agent, with a policy hash for audit.