Guardrails and Action Limits for Agents

An LLM agent given access to a "place order" tool is, at some level, a system that can move real money based on a probabilistic model's output. That model can misread a document, hallucinate a number that doesn't exist, or simply make a bad call under uncertainty — and unlike a human trader, it will do so instantly, at whatever scale its tools allow, without an ounce of hesitation or self-doubt. Guardrails are the explicit, code-level limits placed around what an agent's actions can do, independent of how confident or well-reasoned the agent's own output sounds — because confidence in an LLM's text is not evidence that the underlying decision was actually correct.

Categories of guardrail

Hard limits on action size — a maximum position size per trade, a maximum daily notional the agent can move in aggregate, a maximum number of distinct orders per hour — enforced entirely outside the LLM, typically in the code layer between the agent's tool call and the actual execution system, so no prompt or reasoning chain can talk its way past them.

Human-in-the-loop checkpoints — actions above a certain size, or of a certain type (anything irreversible, anything outside a pre-approved universe of instruments), require explicit human sign-off before executing, turning the agent from an autonomous actor into a proposal-generator for exactly the highest-stakes decisions.

Scope restrictions — the agent's tools are limited to a specific, pre-approved action space (e.g., it can query data and draft a research note, but the "place order" tool simply doesn't exist in its toolkit) so that even a fully compromised or badly confused agent physically cannot take actions outside that scope.

Sanity checks on outputs — before an action executes, an independent check (not the agent itself) verifies the action is plausible: a proposed trade shouldn't be more than $N$ times the recent average daily volume, a proposed order price shouldn't be more than a few percent from the last traded price. These catch the specific failure mode where an agent's reasoning was sound but an intermediate number was wrong — a unit error, a decimal-place slip, a hallucinated price.

Worked example: a bounded agent trading pipeline

An agent is tasked with rebalancing a portfolio toward target weights it computes from updated fundamental data. Guardrails: (1) no single order may exceed 2% of the prior day's average volume; (2) the agent's tools include "propose rebalance" but not "execute trade" — execution requires a separate, human-approved step; (3) any proposed weight change greater than 5 percentage points triggers mandatory review; (4) a sanity check rejects any order price more than 3% from the last traded price, since a gap that large usually means a stale or corrupted feed, not a real opportunity. If a data error makes the agent compute a wildly wrong target weight, guardrail (3) catches the large weight change before it becomes an order, guardrail (1) caps any impact that slips through, and guardrail (2) means no capital moves without a human seeing it first.

What this means in practice

Guardrails should be designed assuming the agent will eventually be wrong — not as a rare edge case, but as a routine event to be bounded rather than prevented outright, since no amount of prompt engineering makes an LLM's output categorically reliable. The right question when designing a guardrail isn't "will the agent make this mistake" but "if it does, how much damage can happen before a human or a hard limit stops it."