Risk Rails First: Designing LLM-in-the-Loop Trading Systems

There is a tempting demo where you hand a language model a market feed and a brokerage key and let it trade. It is also a fast way to lose money. The useful question is not whether an LLM can pick trades, but how to build a system where the model's judgement is one bounded input among several hard, deterministic controls.

The model proposes; the system disposes

The single most important architectural decision is to separate proposal from execution. The model — or a panel of strategies, some of which may be model-driven — produces a candidate order with a rationale. A separate execution engine then checks that order against rules the model has no ability to change: maximum position size, maximum leverage, allowed instruments, and whether the proposed action is even reachable from the current state.

This is the same privilege-separation principle that governs any system where an AI can trigger consequential actions. The model's output is a request, not a command.

Put the limits in code

• Leverage ceiling: a hard cap enforced at the execution layer, independent of what any strategy requests.
• Position sizing: bounded by account equity and a per-trade risk budget, computed deterministically.
• Loss limits: a daily and per-position stop that halts new entries when breached.
• Confirmation for outliers: any order outside normal envelopes requires an extra, explicit check before it can fire.

These are not features you bolt on after a good backtest. They are the contract that makes the rest of the system safe to run unattended.

Determinism, logging, and reproducibility

A trading system you cannot audit is a liability. Every decision should be reconstructable: what the market state was, what each strategy proposed, which rules fired, and what finally executed. When a model is in the loop, log its reasoning alongside the deterministic checks so a human can review why a trade happened — and so the same state reliably produces the same decision.

Scale risk last

The disciplined path is to validate the machinery — the rails, the logging, the kill switches — at small size where mistakes are cheap, and to treat capital at risk as the final dial. The TRAGenX approach to AI-assisted trading is built around exactly this ordering: enforce the constraints first, make every decision observable, and only then consider scale.

The model is the easy part. The rails that bound what it can do are the product.

— TRAGenX Desk