Trust, before you pay.

No. We never hold a key, never move a dollar, and never place the order. Your agent asks whether an action is inside the limits you set, we answer allow, ask a human or no, and the account stays exactly where it was. That is not a promise we are asking you to trust, it is the shape of the product: there is no endpoint that accepts your brokerage credentials, because we never want to be the reason someone loses them.

The limits are not a prompt, so there is nothing to argue with. They are checked outside the model, and on every path that moves money rather than only on orders: a recurring buy, an account setting, money wired out, a cancelled protective position. That last part is where naive guardrails leak, because an agent blocked from buying can simply schedule the buy instead. A refusal cannot be overwritten, and attempts to overwrite one are counted rather than quietly rejected. Trading on borrowed money is not a setting we offer at all.

Nothing of ours can break a trade, because we are not in the execution path. When our own package cannot get a verdict it refuses to act rather than guessing, which is the safe direction to fail in. And you do not have to take our word for whether the engine is up: this endpoint runs the real engine on request and answers 503 if it is not enforcing. A monitor checks it every hour.

Only for the length of one question. The account state arrives with each check and is never stored. The decision log keeps a hash of it instead, which proves which state a verdict was computed against without keeping the contents, so a refusal stays auditable and your positions stay yours. The public numbers are aggregate only: nothing in them identifies an agent, an owner, a holding or a single amount.

Live, and here is the part most products would hide: the public counters currently read zero. The engine is real and enforcing, but no live agent has produced a decision yet, so there is nothing honest to count. We would rather show a zero you can verify than a number you cannot reproduce. When that changes it changes on the same public endpoint, measured rather than projected.

Brokerage trading and card spending, both live. The engine does not know which venue is asking, so a new one is an adapter rather than a rewrite. Two honest limits: on a card we can refuse a charge before it happens but we cannot physically stop an agent that already holds the card number, and prediction markets are designed and deliberately not built, a separately regulated venue with no agent surface yet, and we will not write rules against a payload nobody has published.