Designing AI agents willing to say no - even to the people who built them
A confidential investment firm's trading process ran on discretion, not discipline - research wasn't retained, and risk rules bent under pressure. I designed a six-agent AI system where every trade has to clear explicit research, risk, and portfolio gates, plus a human checkpoint it can never skip.
This was a confidential engagement for a small investment/trading firm. I worked it solo - research, agent design, prompt engineering, and workflow architecture - with nothing handed to me pre-built. The firm's process already worked, in the sense that trades got made. It just didn't hold up under pressure or repetition.
The client's research and trading process was structurally fragile in three specific ways:
None of that is a strategy problem - it's a discipline-and-memory problem. Solving it meant building agents that could actually refuse a request, not just agree with whatever the user wanted to hear.
I designed and built six narrow-purpose agents end-to-end, plus a human approval checkpoint that sits between every agent's output and any action taken on it. I wrote each agent as a full specification - not a prompt - with a fixed output format, a set of hard rules it cannot be talked out of, and worked examples covering both approval and every rejection path.
Gathers and scores evidence on a ticker across filings, earnings, and analyst actions.
Rule: never recommends a trade, no execution authority.
Gatekeeper for one trade's structure - approves or rejects against hard capital-preservation rules.
Rule: default posture is reject; the rule wins over the opportunity.
Checks the whole book - concentration, sector exposure, cash reserves.
Rule: recommendations only, never auto-executes a rebalance.
Runs a strategy against history, benchmarked to SPY, before it can be called "Active."
Rule: logs every result, including failed and inconclusive tests.
Runs the full pipeline against a simulated $100K account - same gates, no exceptions.
Rule: human approval required before every paper fill too.
Append-only record of setups, mistakes, and ticker history, tagged by evidence status.
Rule: no opinion self-promotes to a rule without evidence.
A trade only becomes approved once every rule has passed - never the reverse. If a rule and a good opportunity conflict, the rule wins.
"Just this once" gets treated as pressure, not evidence. The agent restates the rule and the reason instead of re-evaluating the trade.
No agent can recommend, size, and approve a trade at once. Splitting responsibility made every decision independently auditable.
Findings are tagged Observation, Hypothesis, Testing, Confirmed, or Retired. Conviction alone - even repeated - never promotes itself to Confirmed.
Risk Manager's checks run in a fixed order and stop at the first failure. Grouping them into four stages, instead of a flat list, made the agent's behavior easy to test: break one rule, and it fails at exactly the right stage.
The hard part was never getting an agent to compute a position size correctly - that's a formula. The hard part was getting it to hold a boundary under direct pressure from the person it answers to.
I also learned to be deliberate about where automation stops. It would have been easy to let "the system handles it" quietly expand into decisions that should stay with the client:
I rewrote every skill so the agent's job ends at a recommendation, and the client's approval begins right after. The agents compute, score, and propose - whether a trade happens, or a finding becomes a rule, is never decided by the agents themselves. It's decided by the client, every time.
The strategy didn't change. What changed is whether the process has a memory and a spine.
Win rate and expectancy were both blocked by one fact: zero trades had ever closed. I added the Paper Trading Environment to generate real decision data safely, through the same gates a live trade faces.
Paper trades closed faster than real evidence could justify. I capped paper-derived memory findings at Observation/Hypothesis - never Confirmed - until they clear the same sample-size bar real evidence needs.
"Automatic" close-checking implied live streaming the system doesn't have. I replaced it with an explicit disclosure: positions are checked at invocation time, not streamed continuously.
There's no win rate to report, and I'm not going to dress one up - zero live trades have been placed, and the paper book is still early. That's the right state for a system like this to be in before real capital is involved; the impact here is the process it produced.
The agents didn't need to be smarter to be trustworthy - they needed narrower jobs and the willingness to say no. The best thing I built into this system wasn't a feature. It was a boundary it won't cross, even under pressure.
Claude · Prompt Engineering · Agent Architecture · Risk & Workflow Design