The honest answer to "should we add an AI trading agent to our platform" is: yes for the intent layer, never for uncontrolled execution. An agent that turns a spoken sentence into a prepared order is a retention feature. An agent that can open positions without structural limits is a liability with a chat interface.
We run a voice trading agent in production on our own brokerage, so this is not a thought experiment. Here is the architecture that lets us sleep.
The three-party contract
Every safe deployment we have seen — including ours — converges on the same division of labor:
| Party | Role | What it can never do |
|---|---|---|
| The model | Understands intent, reads news, technicals and the account; prepares orders with stop, take-profit and leverage | Touch the exchange directly |
| The human | Confirms or rejects each trade; delegates narrow strategies deliberately | Get skipped "for convenience" |
| The server | Enforces mandatory stops, position caps, leverage limits, kill switch | Be overridden by the model |
The model proposes, the human confirms, the server constrains. Break any leg of that triangle and you are running an experiment on client money.
The subtle part is the third leg. Prompt-level rules ("never risk more than 2%") are suggestions to a language model. Server-side limits are physics: the order gateway rejects what exceeds them, no matter how eloquently the model asks.
Keys are the first casualty
The fastest way to ship an AI trading feature is to ask users for exchange API keys and store them. It is also how you accumulate a database that every attacker on earth wants.
Our rule: session-only keys. Credentials live in the encrypted session, scoped to it, and evaporate with it. Nothing touches disk. If a feature design requires storing keys, the design is wrong — regulators increasingly agree, and traders already do: key custody is the first question sophisticated users ask.
Voice is an interface, not a gimmick
Why voice at all? Because the bottleneck in retail trading is the distance between intent and action. "Short bitcoin, half a percent risk, stop above the local high" is one sentence. Executing it manually is a dozen taps across three panels — and most intents die on the way.
Voice compresses that distance, and the same agent drives the chart: add an indicator, mark a level, switch symbols by phrase. The chart stays on screen as the verification surface. The trader never has to trust the agent blindly — they watch it work.
Going 24/7 without going rogue
The next step users ask for is delegation: "run this strategy while I sleep." Server-side agents make that safe to offer because the guardrails are already server-side. An autonomous agent runs under the same mandatory stops, the same position caps, the same kill switch as a human session — with the browser closed. Delegation changes who initiates orders; it must never change what the server permits.
For the platform operator this splits cleanly into two products: assisted trading (agent prepares, human confirms) as the default, and bounded autonomy as an opt-in for strategies the user explicitly configured.
What to ask any vendor (including us)
- Where do the limits live — in the prompt or in the order gateway?
- Are credentials ever written to storage? Under what encryption, and why?
- Can the user halt all agent activity with one action? How fast?
- Is the agent's every action visible on the chart and in the account history?
- Has this run against a live venue with real money — or only in demos?
An AI agent done right makes a platform feel a generation ahead. Done wrong, it is the incident report your compliance team already dreads. The difference is not the model. It is the guardrails.