The agent itself is deliberately boring. Orders rest as limit orders rather than market orders, both because they cost less and because a resting order cannot chase a price. A risk gate sits in front of every action that can spend money, and it is a pure function: given the proposed action and the current state, allow or deny with a reason. The strategy layer cannot place an order without passing it.
The gate refuses, among other things, to ever place a sell at or below the current market or a buy at or above it. That sounds too obvious to need stating. It exists because an earlier version of this system did exactly that once, which dumps inventory at market instantly.
The stop loss is measured against the portfolio high-water mark using a 24 hour average price rather than the last trade. It cancels everything, sells in chunks sized to fit both the per-transaction limit and whatever spending allowance remains, revokes the standing approvals so nothing can fill afterwards, then refuses to trade for a day. If it cannot sell, because the spending allowance has run out, it stops and says so loudly rather than reporting success.
That last detail came out of a review, and the review is worth describing.
We had the finished code examined by a large set of independent automated reviewers, each assigned a single dimension to attack, with every finding then handed to two further reviewers whose only job was to refute it. They confirmed 34 real defects. Five could have lost money silently.
Four separate reviewers independently found the same worst one. When a limit order filled, the system compared the order's new state against its last known state to work out what had just traded. If the exchange reported the input consumed before it reported the output received, the code advanced its bookkeeping without recording the trade, and the next comparison then booked the fill at roughly half its true price. Cost basis, profit and loss, and the reported return all went quietly wrong.
A second favourite: the ladder re-armed a replacement order one level toward the centre after each fill, except that the level at the centre does not exist, so the calculation landed on a non-existent level and gave up. Those innermost rungs are the ones that fill most often. The strategy was silently dropping most of its own mechanism, and every test passed, because the tests asserted the behaviour the author intended rather than the behaviour the market would produce.
If there is one engineering lesson here: have something adversarial read your money code, and make it verify its own findings. Reviewers with a specific dimension to attack and an incentive to disprove themselves found things no amount of staring at a diff would have.