AI assist
Users need help deciding what to trade, placing it well, and understanding what they are holding. Three AI surfaces cover those needs. All three are advisory: they produce typed suggestions that enter the same RiskGate as any other intent. None of them can sign anything.
The rule that makes the rest safe. AI never holds
Trade authority. There is no code path from a model response to
a signed order that skips the guardrail chain. A model that is wrong, manipulated, or
hallucinating is then a bad suggestion — annoying, not catastrophic.
What exists today
Worth being honest about the starting point: the only AI in the system now is the parameter optimiser (random, Bayesian TPE, and an LLM-driven mode) plus one entity-resolution bot that matches equivalent questions across venues. Neither is a user-facing assistant. All three surfaces below are new work.
Surface A — trade determination
Answers: "I don't know what to trade."
Takes the user's stated interest and the current market state, and returns a ranked candidate list with reasoning. It does not decide; it shortlists, and every item is traceable to the data that produced it.
interface TradeSuggestion {
marketId: string; // must resolve; hallucinated ids hard-reject
side: "buy" | "sell";
conviction: number; // 0..1, calibrated, not vibes
rationale: string; // plain English, shown verbatim to the user
evidence: Array<{ // REQUIRED. No evidence ⇒ no suggestion
kind: "signal" | "book" | "news" | "resolution_rule";
ref: string; // signal name, snapshot id, article id
observedAt: number;
}>;
suggestedSizePctOfBankroll?: number; // a hint; the chain decides
modelVersion: string; // pinned, logged, comparable over time
}
Rules
- Every market id is validated against the registry before the suggestion is shown. A model inventing a plausible-looking id is the expected failure, not an edge case.
- Evidence is mandatory. A suggestion with an empty
evidencearray is dropped, not shown with a caveat. - Conviction is calibrated and measured. Log suggested conviction against realised outcome. A model whose 0.8 is not roughly 80 % is worse than no number, because users will size on it.
- The user or their bot acts, never the surface. Accepting a suggestion creates a proposal, which enters the chain like any other.
- Prices and sizes are never asserted as facts from model output. They are read from the book at proposal time.
Surface B — placement assistance
Answers: "How do I actually get this on without paying up?"
Given an approved intent, suggests how to work it: passive or aggressive, one clip or several, limit placement relative to the touch, timing around known events. Bounded by construction — it operates strictly inside the envelope the chain already approved.
| May | May not |
|---|---|
| Suggest a limit price inside the approved band. | Suggest a price outside the band. |
| Suggest splitting into clips. | Increase total size beyond the approved figure. |
| Suggest waiting for depth or after an event. | Delay past the intent's validity window without re-proposing. |
| Suggest passive vs. aggressive posture. | Change side or market. |
| Explain the expected cost of each option. | Assert a fill probability as a fact. |
Overlaps deliberately with exec.smartrouter and
exec.antitoxicfill. Those are deterministic and stay
authoritative. Surface B explains and proposes alternatives; it does not replace them. When
they disagree, the deterministic utility wins and the disagreement is logged — that log
is how we find out whether the model is adding anything.
Surface C — position, correlation, and risk monitoring
Answers: "What am I actually holding, and what could hurt me?"
Read-only, Governance authority, and the surface users will value most. Turns a position set into something a human can act on.
- Concentration. "Four of your six positions resolve from the same oracle."
- Hidden correlation. Reads
intel.crossmarketgraphand says the thing the user cannot see: that six positions are one bet. This is the highest-value output on the whole surface. - Drawdown trajectory. Distance to the user's own limit, and what happens at it.
- Resolution risk. Ambiguous rules, disputed oracles, markets resolving imminently.
- Behaviour drift. "This bot's win rate has been falling for two weeks while its size has been rising."
- Plain-English decision explanations. Why a bot did or did not act, from the reason codes rather than a free-text reconstruction.
Read-only means read-only. Surface C may recommend flattening and may offer the user a button that creates a proposal. It may not act, and it may not be wired to a scheduler that acts on its behalf. An automated de-risking loop driven by model output is a Trade-authority AI wearing a monitoring costume.
Failure modes, and what we do about them
| Failure | Looks like | Control |
|---|---|---|
| Prompt injection via market text | Market titles, resolution rules, and news are attacker-controlled text arriving in a prompt. | Treat all market-derived text as untrusted data, never instructions. Structured extraction only. Never let retrieved text alter tool-calling behaviour. |
| Hallucinated market ids | A plausible id that does not exist, or exists and is the wrong market. | Registry validation before display. Never construct an id from model output. |
| Silent model drift | A provider updates a model; behaviour changes with no code change. | Pin versions. Log modelVersion on every suggestion. A held-out suite runs on every version change. |
| Overconfidence | Conviction that does not track outcomes; users size on it. | Calibration tracking as a first-class metric. Suppress the surface if calibration degrades. |
| Correlated advice | Every user gets the same suggestion; they crowd the same side and become each other's adverse selection. | Monitor suggestion concentration across users. This is a platform-level risk with no per-user symptom. |
| Cost and latency blowout | A monitoring loop that calls a model per position per tick. | Hard per-user budgets. Cache aggressively. Deterministic checks first; the model only explains what they found. |
| Advice that looks like a recommendation | Regulatory and expectation risk from confident phrasing. | Fixed framing rules. Always show evidence. Never state a price or an outcome as certain. |
Where AI must not be used
- Inside a guardrail decision. Guardrails are deterministic and replayable; a model in the chain destroys both.
- As the signer, or anywhere in the signing path.
- To compute exposure, drawdown, correlation clusters, or reconciliation. Those are arithmetic. Use arithmetic, then let the model explain the result.
- To generate reason codes. Codes come from the registry.
- To decide whether a user bot may go live.
the four invariants · these are not negotiable
- 1
The platform never holds user funds.
Keys stay in the user's wallet. There is no platform-controlled omnibus account, no internal ledger of custodied balances, and no code path that can move a user's assets without a signature the user authorised. If a feature needs custody to work, it does not ship.
- 2
A user bot never reaches the venue directly.
User-authored logic produces a proposal. It never holds a venue client, an API key, or a signer. Exactly one component signs and submits, and it is ours.
- 3
Guardrails cannot be configured away.
The user tunes thresholds inside bounds we set. The user cannot remove a guardrail from the chain, reorder the chain, or lower a hard cap below the platform floor.
- 4
AI never holds Trade authority.
Model output is advisory. An AI suggestion enters the same RiskGate as any bot intent and is subject to the same rejects. There is no path from a model response to a signed order that skips the chain.
If a design requires breaking one of these, the design is wrong. Escalate before writing code — do not work around it. See RiskGate and the signing model.