After weeks of researching the AI trading landscape, talking to Chief Risk Officers, and analyzing how builders are using LLMs, one thing is clear:
Everyone is moving to LLM-based trading. And nobody has the governance layer to do it safely.
The New Trading Workflow
The way people trade has changed! The old way: staring at Bloomberg terminals and manually typing orders is being replaced by a more powerful and simpler flow:
Human chats with Claude → Claude reasons → Claude calls MCP tool → Alpaca API executes
Claude or any other LLM can summarize a 200-page SEC filing in 3 seconds. It can compare earnings transcripts across 50 companies in minutes. It can pull real-time portfolio data and identify correlations that a human would miss. It can do this with your MCP server or with any tools it has.
Every single fund, broker, and serious trader is experimenting with this right now. The research side is solved. The AI is brilliant at it. But when it comes to execution, everyone hits the same governance or fear issue.
The Execution Gap
I call this the Execution Gap: the space between where the AI reasons and where the trade executes. Even if you don’t care about down to the millisecond trading, life would be easier to just say “buy exactly what we just researched!”
Claude and other LLMs are outside the trading system. It is a separate process, hosted by a separate company, and it is probabilistic. It doesn’t follow fixed rules. It reasons. And when it reasons, it can hallucinate.
I experienced this firsthand. I asked Claude to buy $1,000 of ETH. It tried to place a market order without a limit price. On a volatile crypto pair, that could have resulted in massive slippage. The AI thought it was fine. The API might have even accepted it. But it was a dangerous execution decision made by a probabilistic engine that doesn’t understand market these things.
This is happening to everyone right now. The AI research is incredible, but the AI execution is terrifying. People do the research with AI, then switch to a separate terminal and type the order manually. They don’t trust the AI with the “Buy” button. There is no safety net between the AI and the API. No circuit breaker. No audit trail. Just hope.
LLMs Are the New 1929 Piggy Bank Investment Advisers
In 1937, a group of external financiers gained control of Continental Securities Corporation, borrowed money from Paine, Webber using the trust’s own portfolio as collateral, sold off its legitimate assets, and replaced them with worthless securities from dummy companies they owned. They did this to six different investment trusts. The SEC’s investigation documented 1,300 investment trusts formed since the mid-1920s—only 650 survived. The abuses included self-dealing, contingent compensation that incentivized reckless risk, and outright misappropriation of client cash.
The Investment Advisers Act of 1940 was passed because investment trust managers were treating client money as their personal piggy banks. The 1939 SEC report documented advisers charging contingent fees that incentivized reckless risk, misappropriating client cash, and secretly changing firm ownership without telling investors. Congress responded with fiduciary duty, recordkeeping requirements, and supervisory mandates.
Today, we are facing the same pattern—but this time, the “adviser” is an LLM, and the “supervision” is missing. The AI has no financial stake in the outcome. It can hallucinate a catastrophic trade and walk away with no consequence. A prompt injection or model update can change its behavior overnight without the client’s knowledge. And unlike the 1940 advisers, the AI has direct API access to execute trades in milliseconds.
Just as external financiers manipulated Continental Securities by gaining control and looting its portfolio, an LLM can be manipulated through prompt injection, adversarial inputs, or silent model updates—turning a trusted research assistant into a rogue execution engine that liquidates positions, exceeds risk limits, or trades unauthorized symbols, all in milliseconds and all without leaving a trace unless there is a deterministic governance layer in place.
The Regulatory Reality: This Is Not Theoretical
This is not a hypothetical risk. Regulators are already penalizing firms for exactly this kind of governance failure.
Between 2021 and 2023, a senior quantitative researcher named Jian Wu made unauthorized changes to 14 algorithmic trading models at Two Sigma, a $60 billion hedge fund. His changes caused the models to replicate the forecasts of other models rather than generate unique predictions. This caused Two Sigma to buy and sell securities for clients in amounts, concentrations, and frequencies that differed from their intended strategies—resulting in $165 million in client losses and a $23.5 million payday for Wu. (Reuters, September 11, 2025)
The scheme went undetected for nearly two years. Employees only noticed when they saw “higher-than-expected correlations between Wu’s models and other models.” When Two Sigma began investigating, Wu made additional unauthorized changes to conceal his prior tampering. (Reuters)
The enforcement that followed was twofold:
January 2025 — The Firm Was Punished: The SEC fined Two Sigma $90 million and forced them to repay $165 million to clients. The SEC charged the firm with breaching their fiduciary duty by failing to reasonably address known vulnerabilities in their investment models and for supervisory failures under the Investment Advisers Act of 1940. (SEC Press Release, January 16, 2025)
September 2025 — The Individual Was Punished: The DOJ criminally charged Jian Wu with wire fraud, securities fraud, and money laundering—each carrying up to 20 years in prison. The SEC filed parallel civil charges. Wu is currently a fugitive. (SEC Litigation Release LR-26398)
The lesson is brutal: returning $165 million to clients did not insulate the firm from enforcement. The SEC’s position is clear—if you cannot prove supervision, you are liable. And the individual who manipulated the models faces 20 years in prison.
How Agent Provost Could Have Stopped This
Agent Provost does not sit inside the model. It cannot prevent a quant from modifying model parameters. But it sits between the model’s output and the broker’s API—and that is where the damage happens. Here is how Agent Provost’s rules engine (defined in lua/rules_engine.lua) would have caught Wu’s scheme:
1. cumulative_trade_notional Rule — Catches “Concentrations That Differed”
The SEC complaint states that Wu’s changes caused trades in “concentrations that differed from Two Sigma’s intended strategies.” Agent Provost’s cumulative_trade_notional rule tracks rolling trade exposure per user, per machine, per ticker within a configurable time window. If Wu’s manipulated models started concentrating trades in specific symbols beyond the firm’s approved limits, the proxy would have hard-blocked the trades with a 403 PROVOST_INTERVENTION: Cumulative Risk Limit Exceeded response.
2. max_trade_notional and max_trade_size Rules — Catches “Amounts That Differed”
The complaint states that Wu’s changes caused trades in “amounts that differed from intended strategies.” Agent Provost’s max_trade_notional rule blocks any single trade that exceeds a configured dollar value. The max_trade_size rule blocks any trade that exceeds a configured share quantity. If Wu’s models started generating larger trades than the firm’s strategy intended, those trades would have been blocked before reaching the broker.
3. symbol_order_cooldown Rule — Catches “Frequencies That Differed”
The complaint states that Wu’s changes caused trades in “frequencies that differed from intended strategies.” Agent Provost’s symbol_order_cooldown rule blocks repeat orders for the same symbol within a configurable time window. If Wu’s models started trading the same symbols more frequently than intended, the proxy would have blocked the repeat orders with a 403 PROVOST_INTERVENTION: Symbol Cooldown Active response.
4. allowed_tickers Rule — Catches Unauthorized Symbols
Agent Provost’s allowed_tickers rule (draconian mode) blocks any ticker that is not explicitly on the approved list. If Wu’s manipulated models started trading symbols that were not part of the firm’s intended strategy, those trades would have been blocked.
5. Immutable Audit Trail — Catches the Scheme in Days, Not Years
The scheme went undetected for nearly two years. With Agent Provost running, every blocked trade would have generated a PROVOST_INTERVENTION error log with provost_user (Wu’s identity), provost_machine (his workstation), provost_request_id (correlation ID), and the exact request_body JSON that the model sent. These logs are written to S3 with Object Lock in COMPLIANCE mode—meaning they cannot be deleted or altered by anyone, including Wu himself.
The pattern would have been visible within days: one user’s models generating trades that consistently violate the firm’s risk parameters. Not two years later.
6. The Concealment Attempt Would Have Failed
When Two Sigma began investigating, Wu made additional unauthorized changes to conceal his prior tampering. With Agent Provost in place, even if Wu modified the models to hide his tracks, the trades still had to pass through the rules engine. The proxy does not care what the model’s internal parameters are—it only cares whether the JSON payload violates the active rules. The concealment would have been blocked at the execution layer.
7. The Same Rules Apply to the 1937 Continental Securities Looting
While Agent Provost cannot prevent a hostile corporate takeover, if the looters had been executing trades through an API to sell off the legitimate portfolio and buy shares in their own dummy companies, the allowed_tickers rule would have blocked purchases of unauthorized securities, and the max_trade_notional rule would have flagged the rapid liquidation of portfolio assets. The immutable audit trail would have made the looting visible within days, not years.
How Agent Provost Aligns With the Regulations That the SEC Enforced
SEC Advisers Act Rule 204-2 (Books and Records Retention): Requires advisers to retain records of all investment decisions for 3–5 years. Agent Provost captures every AI-generated trade request as structured JSON in S3 with Object Lock in COMPLIANCE mode—meaning no one, not even an admin, can delete or alter these records until the retention period expires. Each log entry includes provost_user (who initiated the trade), provost_machine (what system sent it), provost_request_id (correlation ID across both hops), request_body (the exact JSON the AI sent), and resp_body (the API response).
Section 206(2) and 206(4) (Fiduciary Duty and Anti-Fraud): Requires advisers to act in the best interest of clients. The Two Sigma case was charged under these sections because unauthorized model changes caused client harm. Agent Provost’s deterministic circuit breaker ensures that no trade can execute outside of approved risk parameters. If an AI hallucinates a trade that violates position limits, symbol blocklists, or notional caps, the trade is hard-blocked with a 403 before it reaches the broker.
Rule 206(4)-7 (Written Compliance Policies and Procedures): Requires advisers to adopt and implement written policies designed to prevent violations. The SEC charged Two Sigma with failing to enforce their own policies. Agent Provost’s rules.json file IS the written compliance policy, encoded as executable code. The rules engine enforces it deterministically—no human override, no “forgetting,” no “looking the other way.”
Section 203(e)(6) (Supervisory Failures): The SEC charged Two Sigma with failing to supervise their personnel. Unauthorized changes went undetected for nearly two years. Agent Provost logs every blocked trade attempt as a PROVOST_INTERVENTION error with user identity, machine identity, and timestamp. If an employee or AI starts making unusual trades, the audit trail makes it immediately detectable—not two years later.
FINRA 3110 / 4511 (Supervision and Books-and-Records): Requires supervisory oversight and retention of records. Agent Provost’s two-hop proxy architecture captures both the LLM-to-MCP and MCP-to-API communication channels, providing end-to-end traceability that supervisors can review.
EU AI Act (High-Risk AI Requirements): Mandates logging, traceability, human-override controls, and a kill-switch. Agent Provost delivers all four through structured JSON logging, the human-in-the-loop model, and the deterministic circuit breaker.
FCA AI Governance Principles (UK): Expects auditability and operational resilience. The two-hop proxy captures every request and response body for forensic analysis.
MAS FEAT Principles (Singapore): Requires transparency, accountability, and human oversight. Agent Provost provides agent-level control mechanisms and programmable risk guardrails.
ISO 42001 / ISO 27001 (Global): Provides foundational controls for AI governance, security, and traceability.
The Two Sigma case proves the SEC is already enforcing the 1940 Act against algorithmic failures. Agent Provost is the technical implementation of what the 1940 Act demands.
What Agent Provost Does Not Do
Agent Provost sits at the execution layer, not the model development layer. It does not prevent someone from modifying an AI model’s training data, prompt instructions, or algorithm parameters. It does not log when rules in rules.json are hot-reloaded or changed—it logs transgressions against the existing rules.
What it does is ensure that no matter what the model outputs, the execution is governed. Even if someone tampers with the AI’s instructions, the trade cannot execute if it violates the active rules. That is the layer Two Sigma was missing.
The Human-in-the-Loop Model
The most realistic and profitable path forward is Human-in-the-Loop:
- Human uses Claude to research stocks, options, and crypto.
- Human decides what to buy and tells the AI to execute.
- Agent Provost checks the rules engine, allows or blocks, and logs everything immutably.
The human makes the decision. Agent Provost enforces the guardrails. The AI is the reasoning engine, not the execution engine.
This is the model I built Agent Provost for. It bridges the Execution Gap with a deterministic layer that lets humans use AI safely. Remember that ETH trade Claude tried to place without a limit price? I had Agent Provost running. It hard-blocked the request in sub-millisecond time with a 403 response, forcing the AI to correct itself and submit a safe limit order instead. And the entire attempted trade was logged immutably to S3 with Object Lock.
Who Needs This Right Now?
- Hedge Funds: Every fund experimenting with LLM-driven research needs a governance layer before they can move to execution. Without it, they are one hallucination away from a catastrophic trade—and the SEC has proven they will hold the firm liable.
- Brokers: Platforms that want to offer AI trading assistants cannot let millions of customers trade via AI without a governance layer. One rogue trade from a hallucinated command is a lawsuit waiting to happen.
- Professional Traders: People who want institutional-grade discipline and safety without the institutional price tag.
The Solution
The market is not waiting. LLM-based trading is happening now. The research side is exploding, but the execution side is the bottleneck.
Agent Provost is the deterministic governance layer that removes that bottleneck. It inspects every JSON payload from the LLM, enforces hard risk rules in sub-millisecond time, and logs every decision immutably to S3 with Object Lock.
No hallucination reaches the API. No rogue trade executes. No decision goes unlogged.
The Execution Gap is real. The solution is built. The market is ready.
Check out Agent Provost at AWS Marketplace, contact us for a big discount.