AI Trading Agents Without the Hype: Rules, Paper Trading and Risk Controls

1. Read this first: the honest frame

This is Guide 4 — the last — of our AI agent business series, and it is deliberately the least exciting. Begin with the fact regulators keep repeating: the large majority of retail traders lose money. Broker disclosures required in the UK and EU routinely show most retail accounts ending in the red, and bolting an AI agent onto an account does not change that arithmetic by itself. An agent executes rules consistently — including bad rules, at machine speed, without hesitation or doubt. Consistency is an amplifier, not an edge.

So this guide does not build a money machine. It builds a supervised checker: software that watches a market, applies a written strategy's rules, prepares order tickets, and stops for human approval before anything is placed. When a strategy has no edge — most do not — the agent's real job is to help you discover that cheaply, in backtests and paper trading, instead of expensively, live. Read the whole guide before touching a broker API; the order of what follows is the risk control.

2. What the agent does — and what it refuses to do

The job description is narrow on purpose. The agent does: fetch and sanity-check market data; compute signals from closed bars only; run every proposed action through the risk gate in section 6; prepare order tickets with full context — which rule fired, the data snapshot, the size math; log every signal it acted on and every signal it skipped, with the reason; and alert a human when anything looks abnormal.

The agent refuses: discretionary trades ("this setup looks good"); averaging down or adding beyond the written plan; trading on stale, partial or unvalidated data; changing its own parameters; and — in this design, permanently — placing a live order that no human has approved. Every refusal is a feature. The moment the agent can improvise, you no longer have a rules engine; you have an unsupervised trader with your account keys.

3. Strategy rules as code

A strategy that cannot be written as code cannot be tested, and a strategy that cannot be tested is a story. Here is the running example — deliberately boring: a trend filter (fast EMA above slow EMA) with entries and exits on crosses, computed on daily bars. The most important line is the shift: decisions use the previous bar's completed values, never the bar still forming. That one habit eliminates the most common form of lookahead bias.

import pandas as pd

def compute_signals(df: pd.DataFrame) -> pd.DataFrame:
    out = df.copy()
    out["ema_fast"] = out["close"].ewm(span=20, adjust=False).mean()
    out["ema_slow"] = out["close"].ewm(span=50, adjust=False).mean()
    out["trend_up"] = out["ema_fast"] > out["ema_slow"]
    # Crosses are read from yesterday's completed bar (shift = no lookahead)
    prev = out["trend_up"].shift(1, fill_value=False)
    crossed_up = out["trend_up"] & ~prev
    crossed_dn = ~out["trend_up"] & prev
    out["signal"] = 0
    out.loc[crossed_up, "signal"] = 1    # prepare a long ticket
    out.loc[crossed_dn, "signal"] = -1   # prepare an exit ticket
    return out

Boring is auditable: anyone can read these rules and predict what the agent will do tomorrow. Evaluating the same rules vectorized across years of data — the backtest in the next section — is what a tool like vectorbt exists for.

4. Backtest discipline: the backtest's job is to kill strategies

Treat every backtest as an attempt at falsification, not a sales pitch to yourself. Four rules do most of the work. Split the data. Design and tune on one period; judge on a later period the strategy never saw during design — and prefer walk-forward evaluation, where that discipline repeats across rolling windows. Hunt lookahead. It hides in deciding at a bar's close as if that close were known at the open, in restated or revised data, and in testing only the companies that happen to be in an index today (survivorship). Charge real costs. Every run includes fees and a slippage assumption; a strategy that only survives with zero slippage has already failed, quietly. Stress the parameters. Move each setting ±20% and re-run: a genuine edge degrades gracefully, while a curve-fit result exists only at one magic point.

A strategy that survives all four has earned exactly one thing: paper trading. Not money. The graveyard of retail accounts is paved with backtests that were never attacked by their own authors.

5. Paper trading: probation under a written contract

Paper trading runs the same code against live or replayed markets with simulated fills. Its value is not the fake profit — it is everything the backtest could not model: real data gaps, real latency, real behaviour of your own code at 2 a.m. Before the first paper session, write the promotion criteria down and date them. As an example policy (yours to set, not advice): a minimum sample of signals and a minimum duration across at least one hostile stretch for the strategy type; a maximum allowed drift between paper results and backtest expectations; zero unexplained skipped signals.

Log the skips obsessively. If the agent misses trades in paper mode that the backtest took, your data feed or timing model is wrong — and finding that out with simulated money is the entire point. Ending probation early because the first weeks "look great" is how this story usually ends badly.

6. Position sizing and the kill switch

Size by fixed fractions of risk, never by confidence. An example policy, labelled as such: risk a fixed 0.5–1% of current equity per position, cap total open risk, and add two hard stops — a daily loss limit and a maximum drawdown limit. Hitting either halts the agent and requires a human reset plus a written note about what happened. Every proposed ticket passes a risk gate before a human ever sees it:

def risk_gate(equity, open_risk, daily_pnl, cfg):
    if daily_pnl <= -cfg["max_daily_loss"]:
        return False, "daily loss stop hit"
    if open_risk + cfg["risk_per_trade"] > cfg["max_total_risk"]:
        return False, "total risk cap reached"
    return True, "ok"

Finally, the kill switch: one action that cancels every pending ticket and blocks new ones. Test it during paper trading, on a calm day, before the day you actually need it.

7. Failure modes that actually happen

• Overfitting. Parameters are tuned until history confesses to a pattern that was never there. The ±20% stress test in section 4 is the cheapest detector you own.
• Lookahead bias. Subtler than it sounds: timestamps off by one bar, earnings data timestamped when reported rather than when known, index members as of today. Each one manufactures fake performance.
• Cost erosion. Signal frequency multiplied by fees and slippage quietly exceeds the edge — especially in "improved" high-turnover variants of a working rule.
• Regime change. A trend system in a sideways market bleeds slowly and politely. If your test decade contained basically one regime, you tested one market, not the strategy.
• Silent failure. A NaN in the data feed makes the agent never trade — indistinguishable from discipline. A daily heartbeat log ("alive, saw N bars, computed M signals") is not optional.

8. Common mistakes

• Designing rules on the test data. If the same years inspired the strategy and graded it, the grade is meaningless.
• Skipping the paper stage. "The backtest looked great" is the most expensive sentence in retail trading.
• Removing the human gate to move faster. In version one, approval is the circuit breaker while the system earns trust. Many careful builders never remove it at all.
• Sizing by conviction. Confidence is not a risk model. Fixed fractions are boring in exactly the way that survives.

Previous in the series: Guide 3 — the content agent. This completes the four models; return to the series hub for the full roadmap and the honest-expectations briefing.