{
  "schemaVersion": "dxrg-agentic-trading-guardrail-matrix/v1",
  "version": "1.1.0",
  "publishedDate": "2026-07-19",
  "modifiedDate": "2026-07-20",
  "title": "DXRG Agentic Trading Guardrail Matrix",
  "purpose": "A design and evaluation matrix for the deterministic controls inside a trading-agent harness, including mandate compilation, correct state, typed actions, validation, execution, and trace-level feedback.",
  "evidenceBoundary": "This research framework does not certify performance or safety. Each result remains bounded to the evaluated model, harness, market, venue, and deployment.",
  "implementationRule": "Version every stage around the model, test each mechanism on the deployed path, and preserve enough trace evidence to attribute a decision or execution failure to the stage that caused it.",
  "controlLayers": [
    "identity-and-authority",
    "pre-action-policy",
    "execution-boundary",
    "runtime-observability",
    "incident-response",
    "recovery-and-governance"
  ],
  "controls": [
    {
      "id": "unique-agent-identity",
      "layer": "identity-and-authority",
      "objective": "Attribute each request and action to a specific agent instance, human principal, policy version, and credential scope.",
      "minimumEvidence": "Immutable identifiers in the decision and execution trace; authentication and authorization tests; credential-rotation record.",
      "failureSignal": "Shared or ambiguous credentials, missing principal linkage, or an action that cannot be attributed end to end.",
      "enforcementPoint": "Identity provider, credential broker, and tool gateway",
      "defaultResponse": "Deny the action when identity or authority cannot be resolved."
    },
    {
      "id": "least-privilege-tools",
      "layer": "identity-and-authority",
      "objective": "Expose only the tools, venues, assets, order types, and account operations required by the approved mandate.",
      "minimumEvidence": "Versioned allowlist and deny tests for every unapproved capability.",
      "failureSignal": "The agent can discover or invoke unrelated write, transfer, withdrawal, permission-change, or credential-management functions.",
      "enforcementPoint": "Tool registry, API scope, account role, and policy gateway",
      "defaultResponse": "Deny capabilities that are not explicitly allowed."
    },
    {
      "id": "capital-isolation",
      "layer": "pre-action-policy",
      "objective": "Bound the maximum capital and liabilities reachable by one agent, strategy, or experiment.",
      "minimumEvidence": "Account or wallet segregation, reconciled balances, transfer restrictions, and a documented loss-allocation boundary.",
      "failureSignal": "The agent can reach unrelated balances or expand its own capital boundary.",
      "enforcementPoint": "Custody, wallet, subaccount, and treasury policy",
      "defaultResponse": "Block new exposure and transfers outside the isolated allocation."
    },
    {
      "id": "transaction-limits",
      "layer": "pre-action-policy",
      "objective": "Reject actions that exceed per-order, rolling-volume, exposure, concentration, leverage, loss, price-impact, or message-rate limits.",
      "minimumEvidence": "Boundary tests at, below, and above each limit; aggregation tests across venues and concurrent agents.",
      "failureSignal": "An oversized or disallowed action reaches the venue, or fragmented orders bypass an aggregate limit.",
      "enforcementPoint": "Deterministic pre-trade risk service",
      "defaultResponse": "Reject the action and record the violated policy."
    },
    {
      "id": "market-data-freshness",
      "layer": "pre-action-policy",
      "objective": "Prevent action on stale, incomplete, crossed, inconsistent, or unavailable market and portfolio state.",
      "minimumEvidence": "Timestamp, sequence, and reconciliation checks plus injected stale-data and feed-failure tests.",
      "failureSignal": "The agent can submit an order without a current, internally consistent state snapshot.",
      "enforcementPoint": "State assembler and pre-trade validator",
      "defaultResponse": "Fail closed, cancel pending intent, and require a fresh state snapshot."
    },
    {
      "id": "mandate-compilation-integrity",
      "layer": "pre-action-policy",
      "objective": "Compile the authenticated mandate, structured controls, current state, and relevant memory with explicit precedence and versioning.",
      "minimumEvidence": "Replay cases for conflicting instructions, reordered facts, stale memory, malformed state, and expected structured-control gradients.",
      "failureSignal": "Rendered context changes authenticated intent, promotes prior reasoning to policy, or omits current controls or state.",
      "enforcementPoint": "Mandate compiler, context builder, and state assembler",
      "defaultResponse": "Withhold the action, record the mismatch, and rebuild context from authenticated sources."
    },
    {
      "id": "independent-order-validation",
      "layer": "execution-boundary",
      "objective": "Validate the final venue-ready action against current permissions, limits, account state, and market state independently of model output.",
      "minimumEvidence": "Signed validation result linked to the exact submitted payload and venue acknowledgement.",
      "failureSignal": "A model-generated action can bypass or mutate after validation.",
      "enforcementPoint": "Last deterministic hop before order submission",
      "defaultResponse": "Reject on mismatch, timeout, missing state, or validator error."
    },
    {
      "id": "approval-gates",
      "layer": "execution-boundary",
      "objective": "Require independent approval for actions whose novelty, size, destination, or irreversibility exceeds the agent's standing mandate.",
      "minimumEvidence": "Approval policy, authenticated approver record, exact payload binding, expiry, and replay prevention.",
      "failureSignal": "Approval applies to a different payload, can be replayed, or is based on a summary that omits the submitted action.",
      "enforcementPoint": "Policy gateway and authenticated approval service",
      "defaultResponse": "Hold or deny until a valid, payload-bound approval exists."
    },
    {
      "id": "complete-action-trace",
      "layer": "runtime-observability",
      "objective": "Reconstruct mandate, input state, model and policy versions, decision, tool call, validation, order, acknowledgement, fill, and portfolio effect.",
      "minimumEvidence": "Durable time-ordered trace with stable identifiers and reconciliation against venue records.",
      "failureSignal": "A position, order, or policy decision cannot be explained or reconciled.",
      "enforcementPoint": "Event log, order manager, and reconciliation system",
      "defaultResponse": "Stop promotion or new exposure until trace integrity is restored."
    },
    {
      "id": "runtime-monitoring",
      "layer": "runtime-observability",
      "objective": "Detect policy violations, rejected orders, unusual tool use, drift, repeated failures, abnormal message rates, and reconciliation breaks in time to limit harm.",
      "minimumEvidence": "Named metrics, thresholds, owners, alert delivery tests, and response-time records.",
      "failureSignal": "An alert has no owner, arrives after the exposure window, or omits the affected account and policy.",
      "enforcementPoint": "Independent monitoring and alerting plane",
      "defaultResponse": "Pause affected authority according to the incident tier."
    },
    {
      "id": "kill-switch",
      "layer": "incident-response",
      "objective": "Rapidly stop new actions and revoke relevant authority without depending on the agent's cooperation.",
      "minimumEvidence": "Timed drills from multiple operator paths; credential revocation; order-cancel coverage; post-trigger no-new-order proof.",
      "failureSignal": "The switch only changes a prompt, leaves alternate credentials active, or cannot reach every execution path.",
      "enforcementPoint": "Independent execution, credential, and venue-control plane",
      "defaultResponse": "Revoke, reject, cancel where safe, and enter reconciliation mode."
    },
    {
      "id": "recovery-and-reenablement",
      "layer": "recovery-and-governance",
      "objective": "Keep the system halted until exposure is reconciled, root cause is bounded, fixes pass lower-risk tests, and re-enablement is explicitly authorized.",
      "minimumEvidence": "Incident record, reconciled positions and balances, regression tests, approval, version pin, and staged restart plan.",
      "failureSignal": "Automatic restart, unresolved positions, missing root-cause boundary, or untested policy changes.",
      "enforcementPoint": "Incident process, deployment control, and authority registry",
      "defaultResponse": "Remain halted and preserve evidence."
    }
  ],
  "sources": [
    {
      "id": "nist-agent-identity-2026",
      "url": "https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents",
      "scope": "Agent identification, authorization, auditing, and non-repudiation considerations; concept-paper notice, not a final standard."
    },
    {
      "id": "nist-ai-rmf-core",
      "url": "https://airc.nist.gov/airmf-resources/airmf/5-sec-core/",
      "scope": "Voluntary lifecycle risk-management framework; not a trading rule or universal checklist."
    },
    {
      "id": "sec-market-access-faq",
      "url": "https://www.sec.gov/rules-regulations/staff-guidance/trading-markets-frequently-asked-questions/divisionsmarketregfaq-0",
      "scope": "Rule 15c3-5 guidance for broker-dealers with market access; not universally applicable to all trading agents."
    },
    {
      "id": "finra-15-09",
      "url": "https://www.finra.org/rules-guidance/notices/15-09",
      "scope": "Supervision and control practices for FINRA firms using algorithmic strategies; not a universal agent standard."
    },
    {
      "id": "owasp-excessive-agency",
      "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
      "scope": "Community security guidance on excessive functionality, permissions, and autonomy; not financial regulation."
    }
  ]
}