Guardrails for AI Trading Agents: Limits That Save You
Seven guardrail layers for AI trading agents, with the failure each one prevents, how to size it, and a sensible default. The reference for making autonomy survivable.
Every AI trading agent will eventually do something you did not anticipate. That sentence is not pessimism; it is the design assumption behind every system that survives. Guardrails are the difference between an agent that can only lose what you budgeted and one that can genuinely hurt you. This is the reference piece for AI trading guardrails: seven layers, and for each one the failure it prevents, how to size it, and a default that works until you have evidence for something better. Bookmark it, then configure your agents against it.
What AI trading guardrails actually do
A guardrail is a hard limit enforced at execution time, outside the agent's reasoning. The distinction matters. An instruction inside a prompt ("never risk more than 1%") is a request; a sizing cap checked by the execution engine before any order leaves is a law. Agents misread, drift, and occasionally act on garbage data. Guardrails assume all of that and bound the damage anyway.
Two things guardrails are not. They are not a strategy: limits cannot make a losing idea profitable, only survivable. And they are not a substitute for deciding how much autonomy to grant in the first place, which is its own question covered in our levels of autonomy framework. What follows assumes you have chosen to let an agent execute, and asks: inside what walls?
The seven layers stack. Each catches a failure the previous one lets through, which is why you want all of them rather than your favorite three.
Layer 1 and 2: per-trade sizing and exposure caps
Position sizing per trade. The failure this prevents is the oldest one in trading: a single oversized position doing structural damage. It also blocks the automation-specific version, where an agent misparses a condition and buys ten times your intent.
Size it from risk, not conviction: position size = (equity × risk fraction) / distance to your stop. Risking 0.5% of a $10,000 account with a stop 5% away means a $1,000 position, computed, not felt.
Default: risk 0.5% of equity per trade for a new agent, 1% maximum once it has a live track record. Add an absolute notional cap (say, $2,000 per order on a $10,000 account) as a second, dumber check that survives any formula bug.
Exposure caps, per agent and per portfolio. Per-trade sizing does not stop an agent from opening fifteen correct-sized positions that add up to trouble, and it says nothing about three different agents all quietly accumulating the same bet. If your breakout agent, your DCA agent and your news agent are each long crypto within their own limits, your portfolio is one correlated dump away from a triple hit no single limit saw coming.
Size the per-agent cap from the strategy's worst historical stretch plus margin; size the portfolio cap from the drawdown you could endure without abandoning the plan.
Default: one agent may hold at most 10–20% of portfolio value; total gross exposure across all agents stays at or under 100% of capital, meaning no net borrowing; add a cluster cap of roughly 40% for any group of positions that move together.
Layer 3 and 4: stops and drawdown circuit breakers
Stop-losses, fixed or trailing. The failure prevented: holding a position after the reason for holding it has died. A fixed stop sits at your invalidation level, the price at which the trade thesis is simply wrong. A trailing stop follows price at a set distance and converts an open gain into a protected one, at the cost of more whipsaw exits in choppy conditions.
Size stops from structure, not round numbers: below the level that invalidates the setup, or a multiple of recent volatility such as 2× ATR(14), so the stop breathes with the market instead of sitting inside its noise.
Default: every position an agent opens carries a stop at the invalidation level, defined before entry. Trend-following agents use a trailing stop of 2–3× ATR(14); mean-reversion agents use fixed stops plus a time exit if the reversion has not happened within a set number of bars.
Drawdown circuit breakers. Stops manage one position; circuit breakers manage a losing streak. The failure prevented is the slow bleed, an agent that never takes a catastrophic single loss but grinds down 30% one plausible trade at a time, and its fast cousin, a berserk loop selling into a flash crash. A breaker halts the agent entirely when cumulative losses cross a line, and, crucially, requires a human to restart it. The pause is the point: something about the market or the agent has diverged from expectations, and diagnosis should precede resumption.
Size it from the backtest: you know the strategy's historical maximum drawdown, so a live drawdown meaningfully beyond it is evidence the edge is gone or the implementation is broken.
Default: halt the agent at 1.5× its backtested max drawdown, with a hard ceiling of 15% of the capital allocated to it. For intraday agents, add a daily loss limit of 2% of allocated capital; hit it and the agent is done until tomorrow.
Layer 5, 6 and 7: leverage, order rate, and approval gates
Leverage caps. Borrowed exposure turns every other guardrail brittle: a 10× position does not stop out gracefully, it gaps into liquidation, and the exchange's forced-exit machinery takes over from your risk plan. The failure prevented is total: liquidation is the one loss you cannot manage after the fact.
Default: 1×, meaning none. If you run perpetuals with a strategy that specifically requires it, cap at 2–3× and treat every increment as a decision needing evidence, not a dial to nudge. No agent should be able to raise its own leverage.
Order-rate limits. A cap on orders per hour and per day. The failure prevented is the runaway loop: a bug, a bad data feed, or a self-triggering condition (buy fills move price, price move re-triggers buy) that machine-guns orders and converts your capital into exchange fees. Rate limits are the guardrail nobody misses until the one afternoon they would have saved four figures.
Size it from the backtest's trade frequency, with headroom for clustered signals.
Default: 2× the strategy's expected trades per day, and an absolute ceiling around 10 orders/day for swing strategies. Anything beyond the cap queues for review instead of executing.
Approval gates for out-of-pattern actions. The final layer routes unusual decisions to you instead of the market: first live trade of a new agent, an order above a size threshold, a symbol the agent has never traded, resuming after a circuit breaker. The failure prevented is the unknown unknown, the action that is technically within every numeric limit but outside anything you imagined approving. Gate the exceptions, not the routine; requiring a tap for every ordinary execution just trains you to tap blindly, a trap the human-in-the-loop design piece covers in depth.
Default: gate first-time actions, orders above 2× the agent's average size, and any restart after a halt. Everything inside the pattern runs unattended.
The seven layers on one page
| Guardrail | Failure it prevents | Sensible default |
|---|---|---|
| Per-trade sizing | One position doing structural damage | Risk 0.5–1% of equity per trade + notional cap |
| Exposure caps | Correlated pile-up across positions and agents | 10–20% per agent; ≤100% gross portfolio |
| Stop-losses | Holding through thesis invalidation | Stop at invalidation; trailing 2–3× ATR(14) for trends |
| Drawdown breaker | Slow bleed or berserk streak | Halt at 1.5× backtest max DD, ceiling 15%; 2% daily intraday |
| Leverage cap | Liquidation, the unmanageable loss | 1×; hard max 2–3× on perps |
| Order-rate limit | Runaway loops, fee bleed | 2× expected frequency; excess queues |
| Approval gates | The action you never imagined | Gate first-times, oversized orders, restarts |
Configured together, these numbers describe an agent that can be wrong for weeks without being fatal once, which is the actual bar for letting software trade. They do not eliminate risk; the strategy can still fail, and the broader risk register for AI trading still applies. What they eliminate is the unbounded downside.
On Obside, this stack is not a policy document you hope the agent respects. Position sizing, stops, drawdown caps and leverage limits are fields on the automation itself, checked by the execution engine at order time. Create an agent, "buy $300 of ETH when it closes above its 60-day high on above-average volume", and you attach its risk profile in the same breath: 1% max risk per trade, 15% allocation cap, drawdown halt at 12%, leverage locked to 1×. If the agent ever proposes an order that violates any of these, the order does not shrink to fit; it is rejected and surfaced to you. The reasoning layer can be creative. The execution layer is not allowed to be.
Where to go from here
Set your guardrails before the first live order, write down why you chose each number, and change them only deliberately, never mid-drawdown and never because a good month made the limits feel timid. Loosening limits after wins is how disciplined setups decay into exposed ones. If you are still upstream of this step, the full build path lives in our guide to creating an AI trading agent. And when you want limits that are enforced rather than suggested, Obside applies every layer above at execution time, per agent, from the day you switch it on.
Educational content only. This is not investment advice. Trading involves risk, including possible loss of capital.
FAQ
Seven layers: per-trade position sizing, exposure caps per agent and per portfolio, stop-losses on every position, a drawdown circuit breaker that halts the agent, a leverage cap, an order-rate limit, and approval gates for out-of-pattern actions. They stack; each catches a failure the others miss. The critical property is enforcement at execution time by the platform, not instructions inside a prompt the agent might ignore.