Dynamic Risk Permissions for Crypto: Why Static Rules Fail in Volatile Markets

The 2% rule says: never risk more than 2% of your account on a single trade. It is the most repeated piece of risk advice in trading, and in a calm, liquid, normally distributed market it works well. Crypto is none of those things for long.

The rule fixes one number, the loss you accept per trade, and assumes everything around it stays stable: that your stop fills near where you placed it, that one position is independent of the next, and that the market tomorrow behaves roughly like the market today. In BTC and ETH all three assumptions fail regularly. Realized volatility can double inside a week. Liquidation cascades turn a planned 5% stop into a 9% realized loss. And BTC and ETH move together so tightly that two "separate" 2% trades are often one 4% trade.

The deeper problem is that a static rule holds constant the one number that should move. Two percent in a quiet range and two percent during a squeeze are not the same decision. They carry the same label.

A dynamic risk permission replaces a fixed rule with a standing answer to a question you re-ask continuously: given current market conditions, how much exposure is allowed right now?

The output is not a trade signal. It does not say buy or sell. It says how large any position may be, whether leverage is permitted, and which actions are off the table. Concretely, a permission has three parts:

• A size ceiling — the maximum fraction of capital that may be exposed, for example 0.35 (35%). • An allowed and blocked action list — for example, light accumulation allowed, leverage above 2x blocked, new entries blocked entirely in the worst conditions. • A reason — which condition is currently binding, so the decision can be explained and audited later.

The direction of the trade stays with you, your strategy, or your agent. The permission only governs how much of it you are allowed to carry.

Not every market signal deserves a vote on position size. The ones that do are the ones that change how much damage a position can do, not the ones that claim to predict where price goes next:

• Realized volatility. The single most reliable input. When the market moves twice as much, the same position carries roughly twice the risk. Shrink size as volatility rises. • Positioning and leverage in the market. High open interest, extreme funding, and stacked liquidation levels mean the path to your stop can be violent. That is a reason to carry less, regardless of direction. • Macro regime. When crypto is tightly coupled to risk assets during a risk-off period, an equity sell-off becomes your sell-off. The permission should tighten. • Cycle context. Late-cycle and euphoric conditions have historically produced the deepest drawdowns, so they justify a lower ceiling than early recovery phases. • Your own exposure. A DeFi loan close to its liquidation threshold, or a book already concentrated in one direction, lowers what any new position is allowed to add. • Data quality. If core inputs are missing or stale, the honest answer is a smaller permission or no permission at all, not a confident number computed over defaults.

Each input above produces its own ceiling. The question is how to combine them. Averaging is the tempting answer and the wrong one: a severe macro risk-off reading averaged against a calm volatility reading produces a moderate number that describes neither.

The robust design takes the minimum. Every condition gets to set a cap, and the tightest cap binds. If volatility alone would allow 80% exposure but your DeFi health factor only allows 30%, the answer is 30%, and the permission says the DeFi position is the binding constraint. Volatility then scales the result down further in turbulent conditions, and data quality is applied last so that missing data can drive the permission toward zero instead of being averaged away.

This structure has two useful properties. It is conservative by construction: no single benign reading can talk you out of a real danger. And it is explainable: there is always one named reason for the current ceiling, which is exactly what you need when reviewing a decision after the fact.

We have run this kind of engine live on BTC and ETH since early 2026 and audited it against simple benchmarks. Three findings are worth sharing because they cut against how most risk tools are marketed.

First, the exposure level does most of the protective work. Operating at a conservative average size cut the frequency of deep weekly losses far more than any clever timing of when to be bigger or smaller.

Second, the composite "market quality" scores that look most sophisticated did not show a reliable forward-return signal in our sample. They tend to echo recent price: they read strong after a rally and weak after a drop. Sizing up on them is pro-cyclical — you end up largest just after the move has happened.

Third, volatility was the input that consistently pushed size in the right direction. That matches decades of evidence from volatility targeting in traditional markets.

The practical lesson: treat dynamic permissions as loss containment, not as a hidden prediction engine. A permission that shrinks size when the market gets dangerous is valuable even if it never calls a single top or bottom.

The same permission reads differently depending on where you trade.

In spot, the size ceiling is simply the maximum share of your capital in BTC or ETH. Leverage fields do not apply.

In perpetual futures, read the ceiling as maximum notional exposure, not margin. A 30% ceiling on a $50,000 account means $15,000 of notional, whether you post it at 3x or 10x. Leverage changes where your liquidation price sits, not how much risk you carry, so pick leverage that keeps liquidation far beyond your stop.

In DeFi borrowing, the permission interacts with your loan. A health factor close to liquidation becomes the binding cap, and the right action is often to reduce debt before adding any exposure at all.

You do not need any particular tool to adopt the principle. A minimal version takes an afternoon:

1. Pick a conservative base size you would be comfortable holding through a 30% drawdown. 2. Measure 30-day realized volatility and scale the base size down when it rises above its normal range. 3. Add hard blocks for the situations you already know are dangerous for you: no leverage during extreme funding, no new entries when your loan is near liquidation. 4. Take the minimum of all your caps, never the average. 5. Log every decision with the reason that bound it, so you can check later whether the rules helped.

If you would rather not build and maintain this yourself, RiskState does exactly this as a deterministic policy engine: it converts live BTC and ETH market state into a maximum position size, allowed and blocked actions, and the binding reason, with a hash on every decision so it can be verified later. You can see the current permission for BTC and ETH in the app, or call the same engine from your own bot or AI agent through the API or MCP server.