How far AI is allowed to act – and who gets to decide
This week’s launches in AI in trading shared one design: AI at the edges, determinism at the core. Agents got scoped keys to broker accounts, models priced credit baskets and answered TCA questions, and desktop tools let AI propose allocations. But the final execution stayed deterministic and human.
That is the case for judging AI by its autonomy rather than its intelligence. The FCA made the point this week: RTS 6 controls (testing, pre-trade limits and the ability to cancel orders) may offer useful considerations for managing AI and other automation. The lens is not how clever a model is. It is what the model may do on its own, and how quickly it can be stopped.
The week’s news shows the debate shifting from what AI can do to what it is allowed to do:
• B2BROKER opened its B2TRADER platform to AI agents over MCP, with separate read-only and trading permissions. PrimeXBT MCP announced a similar integration the same day.
• Wealthsimple launched an agent that trades for Canadian retail clients, with every action approved.
• MarketAxess launched basket-level PT cost estimation.
• J.P. Morgan, in a Trader TV interview released on 4 November, outlined AI risk agents for its Vida platform.
• Tradefeedr set out how desks can query TCA through their own AI models over MCP.
• FDC3: the community explored desktop interoperability as the control layer for agents.
• Goldman Sachs pulled AI coding tools from its traders and bankers.
• The FCA’s latest Wholesale banks supervision insights showed what happens when controls lag: an over-filled algo, untested kill switches and incomplete AI inventories.
There is a catch. Most of AI tooling is moving into pre-trade pricing, analytics and desktop plumbing, not order execution. That may appear safer, but it means the most influential AI on your desk may be one you never procured, tested or logged. It can arrive inside a vendor’s pricing model, a platform’s cost estimate or a desktop plug-in without ever passing through algo governance.
Here are the five themes I learnt this week on AI in Trading:
1. Agents get a key to the account, with permission tiers built in
Three more platforms opened accounts to AI agents, each at a different level of autonomy:
• B2BROKER: B2TRADER now lets traders connect Claude, ChatGPT or a custom agent over MCP. Brokers choose read-only or trading access, and each agent is limited to the accounts of the trader who authorised it.
• PrimeXBT: opened client accounts to ChatGPT and Claude. The assistants prepare orders and preview fees, margin and liquidation levels, but the client confirms before anything reaches the market.
• Wealthsimple: launched Penny, an assistant that can trade and rebalance with approval on every action. ChatGPT and Claude connections are due in early 2027, and bracket orders are due in the coming weeks.
Why this matters for trading:
• Read versus trade is becoming the first control. Separating the two at the protocol layer could become the template EMS and broker vendors are measured against.
• The vendor sets the default. Instead of a broker switching access on for an end user, the vendor may decide which access levels exist.
• Approval does not slow the herd. If thousands of clients receive the same agent suggestion at once, their approvals still arrive together, especially if one agent is accepting another agent’s suggestion.
• Retail agent flow is going cross-border. Canada joins the US, so global equity desks will likely meet this flow wherever those clients trade.
2. Credit pricing and protocol choice become model-led
Portfolio trading is where credit execution is being re-engineered fastest, with AI at both ends of the basket:
• J.P. Morgan: Adam Threadgold and Luigi Marino claimed in a Trader TV interview released on 4 November that PT is now more than 11% of the US credit market and set out plans for AI risk agents across Vida.
• MarketAxess: extended CP+ to estimate basket-level PT costs by side, size and client type for USD IG, HY and EM bonds.
• Tradeweb and Trumid: SNAP+ adds AI-enabled dealer and pricing predictions to EM PT. Trumid’s List Optimiser suggests, bond by bond, how to split a list between PT and RFQ.
• LTX: CEO Jim Kwiatkowski described using an LLM only to interpret what the trader wants. The agent itself is built from tested components that run deterministically.
Why this matters for trading:
• Model meets model. When a dealer’s risk agent and a venue’s cost estimate agree, that is not necessarily independent evidence of best execution, especially if both draw on similar data.
• Basket totals can hide line-level costs. It will matter whether estimates break down to line items, and how illiquid names are treated.
• Dealer agents change the RFQ dynamic. Faster repricing or declines could mean tighter response windows and more variable hit rates when markets move.
• Protocol choice becomes a recommendation. If a tool can now suggest RFQ, PT or algo, that raises the question of how that sits within best-execution evidence.
3. Analytics and the desktop become the agent’s way in
AI is reaching the institutional desk through the layers around the order rather than the order itself. It informs and proposes, but does not act:
• Tradefeedr: CEO Balraj Bassi explained how traders can query TCA through their own approved AI models over MCP. Answers come from deterministic calculations and can be traced back to the underlying query.
• FDC3: A-Team examined desktop interoperability as a control layer for agents. In its example, an AI proposes a trade allocation across funds for the trader to review and submit.
• Bloomberg and StarCompliance: BQuant Assistant now writes Python and BQL from plain language. StarCompliance added a natural-language agent for compliance data.
Why this matters for trading:
• A possible template for safe agentic analytics. The vendor owns the data, permissions and calculations, and the client runs the model. The open question is whether that split neatly maps onto who answers to the regulator for what (accountability again)
• MCP becomes a governance boundary. The tools exposed over MCP define what an agent can see and do, which puts MCP connections alongside API keys and data entitlements.
• In-flight TCA drifts towards execution. Once analytics inform live slicing or venue choice, they become part of the trading decision. ESMA’s AI and algo briefing expects firms to understand AI’s effect on algorithm decisions.
• “Propose, populate, approve” only works if the approval is real. An AI-suggested allocation that is rubber-stamped is still the firm’s allocation.
4. The FCA focuses on RTS 6
On 2 November the FCA published Wholesale banks supervision – Insights 3. It was written for banks, but its findings map closely onto the buy-side desk. It judges AI by what it can access, what it is allowed to do and where the control sits:
• An algo enhancement over-filled a stop-loss. A defect between the algo and its order management component gave it the wrong view of its executed quantity. Testing missed near-simultaneous fills in different locations.
• Human review missed AI errors. AI-generated code passed review and caused a loss of service, and unapproved AI tools led to data leaks.
• Internal audit’s AI findings. Conditional approvals were recorded as full approvals, and agents were risk-tiered inconsistently. Kill switches were insufficiently tested, with no list of who may operate them, and AI inventories were incomplete.
• A billion-sized fat finger. A trader entered a fixed income RFQ notional in billions rather than millions, and it reached clearing before being cancelled.
Why this matters for trading:
• RTS 6 is becoming the floor for agents. Agent controls may increasingly be read through the algo lens of testing, pre-trade limits and the ability to cancel.
• The interaction matters, not just the change. Agents that read fills, positions or allocations share the over-fill’s dependency, now at machine speed.
• A kill switch is a named-person control. The same question extends to vendors whose AI sits in the order flow.
• Inventory is the common failure. Missing AI inventories and missing fat-finger inventories are arguably the same issue: desks need to know what is running, and with what limits.
5. Banks draw lines around agents, a sign of open questions
Goldman’s Claude restriction was widely read as banks being afraid of AI. Set alongside the wider pull-back, it looks more like risk reviews finding questions that as yet do not yet have sufficient answers:
• Goldman Sachs: Bloomberg reported on 2 November that Claude Code and GitHub’s coding tools are now limited to the bank’s roughly 12,000 engineers.Traders and bankers lose third-party agents that write and run code, but the in-house AI assistant remains firm-wide.
• Customer accounts: On 22nd October Axios reported that large US banks were finding third-party agents in customer accounts, often logged in with customers’ own credentials.
o Morgan Stanley began blocking them, though it said it had seen no rogue agents.
o Jamie Dimon has said outside agents will not be permitted inside JPMorgan.
o Bank of America is limiting agents’ access to consumer deposits.
o Citi does not let third-party agents log in or transact.
• Shadow agents: RSA CEO Greg Nelson told PYMNTS that a midsize bank which said it had no AI agents turned out to have 4,000, and could have 20,000 within a year. The count matters less than which agents hold consequential permissions, and who is responsible for them.
Two different lines are being drawn: Goldman’s around its own people, and the others around outside agents acting for customers. Both are drawn around what software may do on its own, rather than around AI itself. Banks were built to know who is accessing an account, not which software is acting or how far its authority goes.
Why this matters for trading:
• Restriction is often a stage, not an end point. Once the answers are documented clearly enough for an examiner, restrictions tend to become scoped pilots, and pilots become rollouts.
• Know Your Agent follows Know Your Customer. Verifiable agent identity, scoped and revocable permissions, and human approval for high-risk actions are emerging as the rules of delegated authority. They echo the permission tiers in theme 1.
• Controls need to travel. Agents cross into broker engines, TCA and desktop apps. A control that stops at the firm’s edge may be invisible to the party on the other side – something we are looking at in the FIX AI Working Group discussions.
• Agents can outlive their owners. The earlier RSA story gave two examples: an employee leaves but the agent they introduced keeps its permissions, and overloaded approvers sign off requests in batches. A human in the loop only helps if they have time to examine what they approve.
• Open experimentation or routed through engineering. Goldman is a live example of the trade-off for anyone deciding who may build with AI: keep it open to traders or route it through engineering and accept the frustration.
Where the gap opens
AI in capital markets is moving from proofs of concept to autonomous systems that execute trades and manage risk. Humans are shifting from manual execution to supervision, behind boundaries of deterministic execution and layered tiers of AI authority.
Most of this week’s launches still leave the decision with a human. They are agents that answer, prepare or propose, and existing algo controls largely stretch to cover them. The gap opens where an agent chooses its own actions at runtime and its behaviour cannot be fully specified in advance.
As that autonomy grows, the open question is how well desks know what they have deployed. That means every model, every MCP connection and every “approve” button – who built it, what it can touch and what it logs.
Thanks for reading as always.
Rebecca
