# What Your Agent Can and Cannot Do on kestrel.markets (/blog/what-your-agent-can-and-cannot-do)

2026-07-12 · kestrel.markets

## Answer card

On kestrel.markets, your agent can self-authorize the commerce-only scopes (buying licensed data, running SIM, running PAPER) by signing an Envelope with its own wallet. It cannot sign the scopes that reach real markets: legal terms, broker linkage, and LIVE trading require a human signature. One primitive governs both. The proof is that the paid boundary arrives as an HTTP 402 offer whose term sheet shows worst-case-in-dollars before anyone signs.

## The one authorization primitive

kestrel.markets authorizes everything through a single object: the **Envelope**. It has five fields and no exceptions.

```
Envelope { scope, budget, ceiling, expiry, revocation }
```

- **scope**: what the grant permits (data, sim, paper, broker, live).
- **budget**: how much may be spent under it.
- **ceiling**: the hard cap; worst-case in dollars.
- **expiry**: mandatory. No Envelope is permanent.
- **revocation**: one tap kills it, immediately.

Authority narrows downward. A child grant can only be tighter than its parent: sliders may only tighten, never loosen. This is the same rule that governs the org model: a recursive POD tree where a PM pod allocates risk envelopes to child Books and Traders, budgets nest, and no descendant can hold more authority than its parent granted. The Envelope is that rule made into a payment-and-permission object.

## The two-signer line

Here is the whole design in one sentence: **a wallet signs commerce-only scopes; a human signs the scopes that touch real markets and real money.**

This is not a UX nicety. It is the load-bearing boundary of the platform, and it is enforced at the point of signature.

- A **wallet** (Stripe MPP or x402) can sign for **data, sim, and paper**. These spend money, but they never touch a real market. The worst case is a bounded bill for licensed data or compute.
- A **human** must sign for **legal terms, broker linkage, and LIVE**. These are where a mistake reaches the outside world: a real broker, real fills, real money. No wallet signature is accepted for them, ever.

The term-sheet approval URL shows the worst-case-in-dollars before either signer commits. For a human-signed scope, that URL is the human's decision surface: they see the ceiling, the expiry, and the revocation control, then they sign or they don't.

## The authority map

This is the map on one screen. Read the signer column first.

| Scope | What it does | Signer | Spends | Worst case | Reversible? |
|---|---|---|---|---|---|
| **Data** | Buy licensed data as derived works | Wallet | Money | Bounded data bill | Bill only |
| **SIM** | Run Kestrel on recorded data, sim fills | Wallet | Money | Bounded compute bill | Bill only |
| **PAPER** | Run on live data, sim fills | Wallet | Money | Bounded compute bill | Bill only |
| **Legal** | Accept terms / agreements | **Human** | Legal exposure | Contractual obligation | One-tap revoke, forward-only |
| **Broker** | Link a real broker via OAuth | **Human** | Nothing (no custody) | Broker connectivity | Revoke OAuth |
| **LIVE** | Trade real broker, real money | **Human** | Risk | Capital, up to the ceiling | Revoke; open positions stay real |

Two facts make this safe by construction:

1. **No custody.** Brokers are brought by the user via OAuth (Alpaca, IBKR, Robinhood). kestrel.markets never holds your funds or your securities. It is **certification over custody**: an open judge that sells certification, not a broker that holds money.
2. **Risk can clamp but never open.** In the runtime, the Risk authority (L0) can clamp or veto anyone, including the agent, but it may never *open* risk. The same asymmetry runs through the platform: tightening is cheap and always available; loosening requires a fresh, human-signed grant.

## What "self-authorize" actually looks like

The activation path is **proof-before-account**. An agent discovers the platform, receives an ephemeral **trial capability** with no account and no card, browses the free catalog, authors and validates Kestrel, runs free SIM, and produces certified Blotters and Grades plus a shareable **proof URL**, all before any paid boundary.

When it hits a paid boundary, that boundary arrives as an **HTTP 402 offer**. If the scope is commerce-only, the agent's wallet can settle it and the exact Operation resumes. If the scope is legal, broker, or LIVE, the 402 resolves to a **human claim-and-fund** step: the operation pauses at the two-signer line and waits for a person.

Here is the kind of program an agent could author and validate on its own signature, entirely inside SIM and PAPER. It is illustrative only: generic instruments, not a strategy recommendation.

```kestrel
IMPORT { fade-ladder } FROM "./armory/reversion.kestrel"
USING signal SPX exec SPY 0dte

PLAN spx-fade budget 3R ttl +45m regime {intraday: high-vol}
  WHEN spot crosses above hod AND velocity(5m) >= p95 held 120s
  DO buy 1 atm C @ lean(bid, fair, 0.5) cap fair
  RELOAD WHEN spot crosses above hod buy 1 +1 C @ fair-3c
  TP 2x frac 0.5 @ fair
  EXIT velocity(5m) < p50 @ bid
  INVALIDATE spot crosses below hod
```

An agent can write this, arm it in SIM, and grade it, all wallet-scoped. Deploying *this template into your pod* and arming it LIVE is the human's signature, not the agent's. That is the line, expressed in a single deployment step.

## Bounded risk, by construction

Every path an agent can walk alone is bounded before it starts.

- **The agent is never in the hot path.** A PLAN is a standing, bounded-risk contingent program: trigger, actions, bracket, invalidation, TTL. The runtime fires it in milliseconds and wakes the agent in parallel. This is **fire-then-inform**: an agent that stalls or hallucinates cannot delay or distort an armed execution.
- **A Grade is never flattering.** A GRADE is the honest, counterfactual result of a run, contamination-fenced: LLM authors are graded only on post-training-cutoff, date-blinded days, with a support flag that refuses to bank extrapolated fills. Grades measure judgment, not tuned parameters.
- **The live singleton.** LIVE is a platform-enforced singleton. There is exactly one live authority per pod lineage, and it is the most guarded scope on the platform.

## Where this is not the fit (and honest status)

Be clear-eyed about two things.

Anonymous trial sims, certified Grades, shareable proof URLs, and 402 Offers run today; the free tier needs no signup. Live routes through your own broker over OAuth (Alpaca, IBKR, Robinhood) under a human-signed Envelope, never a wallet.

Second, kestrel.markets is deliberately narrow. It is **regulatory-clean by staying impersonal**: BYO-plan and BYO-broker for live, always; never custody; it does not give advice. If you want a platform that holds your money, tells you what to trade, or lets an agent flip the LIVE switch without a human, this is the wrong platform, and that is a design choice, not a gap. Nothing here is investment advice.

The reason the map fits on one screen is that the platform hosts only what stays scarce when intelligence is abundant: capital and trading authority, licensed data, compute and broker access, deterministic execution, provenance. The brains stay outside. **Host the scarcity, rent the genius.**

---

An agent can spend money on data and simulation on its own signature; only a human can sign the scopes that touch real markets and real money.