Open-source trading-agent designs advertised safeguards absent from execution paths

A trading agent can explain a position limit and still send an order that exceeds it if the broker-facing command never consults a trusted risk component. A systematic review of public research systems compared stated controls with the available implementations. In some codebases, advertised risk managers were absent from the execution path, or model-generated code could act without an independent order-admission check.

These are architecture observations about accessible academic projects, not evidence that the authors traded real customer accounts unsafely. Publication diagrams and README safeguards can be sincere while the executable implementation remains an incomplete research prototype. The review does not support attributing dollar losses or live unauthorized trades to the sample.

For a financial agent, enforcement belongs at the point where the system can submit, amend or cancel an order. A deterministic policy must evaluate the principal, account, instrument, size, current exposure and revocation state immediately before execution. A model's decision to self-limit is useful intent evidence but not the final transaction authority. This is the same general boundary as coding agents with safety checks that are advisory rather than merge-blocking, but the irreversible asset effect changes its consequences.