Before Letting AI Trade My Brokerage Account, I Built the Vault First
I'm not a developer. And I'll confess: I'm terrible at cutting losses. When I reviewed my losing positions, the conclusion hurt — if I had sold whenever the AI told me to, my losses would have been far smaller. So I decided: within a small budget, let the AI buy and sell for real. But before building any trading feature, I made it write down the list of things it can never do. This is the story of those guardrails.
1. The Trigger — It Wasn't the AI That Was Wrong. It Was Me.
I sat down with months of my trading history. The pattern was blunt. My AI assistant would say "discipline says cut it here," and I would say "let's hold just a bit longer." Most of the time, the AI was right. Every position sitting at half its purchase price in my account today marks a spot where my stubbornness beat the AI's judgment.
Here's the funny part: when we backtested the AI's stock picks against historical data, they had no special edge. The real edge was somewhere else entirely — selling by the rules. Honoring take-profit and stop-loss lines. In other words, exactly the thing I, the human, am worst at. Then the answer is obvious: don't automate the judgment. Automate the discipline.
2. The Fear — A Program That Can Spend My Money
Saying it is easy: "AI, trade for me." But this is a different universe from asking a chatbot for restaurant recommendations. A program connected to a brokerage's open API places real orders with real money. What if the AI hallucinates and buys some random ticker? What if a bug fires the same order ten times? What if it one day sells the long-term holdings I actually care about?
So I gave my AI assistant this instruction: "The trading feature comes later. First, hard-code what you cannot do. If that list doesn't pass its tests, the trading feature never turns on."
3. The Four-Layer Vault — Stacking the 'Cannot' List
The finished structure is a vault with four layers. The deeper you go, the simpler it gets — and the simpler, the harder to break.
① The Floor of Money — the Budget Vault
At the innermost gate, where an order actually leaves for the broker, sits a budget check. Three tests must pass simultaneously: a per-order amount cap, a cumulative spend cap (the test budget — a small one), and the real-time remaining cash. If even one can't be verified? Unverifiable means denied. Ledger file corrupted — denied. Cash lookup failed — denied. The vault's only rule is "when in doubt, block," never "when in doubt, proceed."
The beauty of this layer: nothing above it matters. If the AI goes insane or the code tangles itself, my maximum loss is capped at the test budget itself.
② Ledger Isolation — "You May Only Sell What You Bought"
The scenario that scared me most wasn't a loss — it was overreach: the AI selling stocks I already held. So we built a separate ledger just for auto-trading. Only what the AI buys gets written into it, and automated sells are allowed only for entries in that ledger, only up to their quantity. My pre-existing holdings aren't in the ledger, so they physically cannot be touched. The automated test suite literally includes attack tests: "if the AI tries to sell a pre-existing holding, is it rejected?"
③ The Single-Use Pass
Auto-trading runs twice per market per day, at fixed times only. At those times, the system issues a 30-minute single-use pass, and every AI buy order must carry that pass number. If the AI, mid-conversation with me, decides "this looks like a great entry!" and tries to place an order on its own — no pass, no order. Auto-trading exists only during auto-trading hours.
④ The Discipline Contract
The final layer is the instruction sheet itself. At most one new position per session. No averaging down on positions it already holds. No chasing near recent highs. And the sentence that matters most: "If there's nothing worth buying, buying nothing is the correct answer. Sitting out is not failure — it's discipline." That explicitly breaks the AI's peculiar over-eagerness to buy something.
4. Automating Discipline — the Exit Plan Locks the Moment You Buy
The heart of this system isn't the buying — it's the selling. The instant the AI buys anything, a stop-loss order (−8%) and a take-profit order (+15%) are registered automatically. There is no gap for me to squeeze into. The system simply has no mouth with which to say "let's hold a bit longer." When one side fills, the other is cancelled automatically.
Building this surfaced one chilling trap. The reservation system, by design, silently expires orders after seven days. Left alone, any position held longer than a week would one day sit there with its stop-loss quietly evaporated. Now, at the start of every session, the system checks that every open position still has its live stop and target — and if they've vanished, re-registers them based on the original purchase price. That detail matters: anchoring to purchase price, not current price, makes it structurally impossible for the stop-loss to drift downward.
5. The Default Is Always 'Off'
The system has several switches, and every one of them defaults to off. With no configuration at all, it runs in rehearsal mode: the AI analyzes the market, picks a candidate, walks all the way to the final step — then merely records "no real order was placed." For a real order to go out, multiple switches must be flipped explicitly, all of them.
Turning it off, by contrast, takes one move. Create a single empty file with a specific name on the server, and the entire system halts on the spot. A physical emergency stop I can hit from my phone at 3 a.m.
As I write this, the system is in exactly that rehearsal mode. Every day at fixed times, the AI genuinely deliberates, and only a report lands in my messenger: "I would have bought this, for these reasons" or "everything is in chase territory today — sitting out." I'll watch these rehearsal reports for a few days, and if the quality of judgment earns my trust, then I flip the switches.
6. In Numbers
- Guardrail layers: 4 (budget vault → ledger isolation → single-use pass → discipline contract)
- Automated tests: ~250 — all against fake responses; zero real orders placed during development
- Deliberate attack tests included: selling pre-existing holdings → rejected; over-budget orders → rejected; routing to other accounts → rejected
- Discipline constants: stop-loss −8%, take-profit +15%, max one new buy per session
- Trap found: the silent 7-day reservation expiry (vanishing stop-losses) — fixed with per-session auto-recovery
- Emergency stop: creating one file = full halt
7. What a Non-Developer Learned
First: when granting an AI real power, design the forbidden list before the feature list. "What can it do" is a later question; "no matter what, it cannot cross this line" comes first. Following that order gave me peace of mind — and that peace is precisely what made me able to grant the power at all.
Second: "when in doubt, block" must be the default. When the ledger is corrupted, when a lookup fails, when certainty is missing — the system must choose "stop for now" over "proceed for now." The quality of a guardrail is decided not on the happy path but in exactly these ambiguous moments.
Third: the thing most worth automating turned out to be discipline, not judgment. I still don't know whether the AI picks stocks better than I do. But I'm certain it cuts losses better than I do — because it has no stubbornness with which to say "just a little longer." As the half-priced tickers in my account can testify, that stubbornness is far more expensive than it looks.
When the rehearsal ends and the live switch goes on, I'll write honestly about what happens — profit or loss. After all, the ceiling is already set.
