Risk Controls for Automated Strategies

Build your card above before reading on: set the four hard limits, then choose the API-key permission and watch what happens when you reach for withdrawal access. A trading bot is fast, tireless, and completely without judgement. That is fine when the market behaves and catastrophic when it does not, because a bot will execute its worst behaviour at full speed and never stop to wonder if something has gone wrong. The whole point of everything you learned in the earlier modules lands here: no automated strategy should touch real capital until hard, pre-set limits stand between the machine and your money. These controls are not polish you add later. They are the price of admission, decided in advance as cold numbers, not felt in the moment as the account is bleeding.

Four limits, all set before you go live

Think of these four as the seatbelt, and put all of them on before the first real trade. Each one is a hard number you decide up front and the system enforces automatically.

• Max daily loss (the kill switch). Halt all trading once the account drops a set amount in a day, say 3%. One bad session then cannot spiral into a disaster.
• Max single-trade size. Cap how much any one position can risk, or how large it can be, so a single order can never blow up the whole account.
• Total allocation cap. Limit how much of your capital is ever exposed to the strategy at once, keeping the rest ring-fenced from a bot that goes wrong.
• Drawdown-pause threshold. Automatically stop the strategy and demand a human look after a peak-to-trough fall of a set size, so a slow bleed cannot run unattended.

The common thread is that each is a hard figure chosen in advance, not a decision you improvise while watching red numbers scroll past. Panic is a bad risk manager. A pre-set limit is a calm one.

Lock down the API key

When you connect a bot to an exchange, you do it through an API key, and that key's permissions decide how much damage a leak or a rogue bot can do. This is the highest-leverage control you have, because it caps your worst case even if every other safeguard fails.

Keys usually carry three separate permission levels, and the gap between them is the gap between an inconvenience and a catastrophe:

• Read-only. The tool can look but not trade. Use this wherever a bot only needs to observe.
• Trade-enabled. The bot can place orders. Grant this only to something that genuinely needs to.
• Withdrawal-enabled. The key can move money off the exchange. A trading bot has no reason to do this, ever.

The single rule that matters most: never enable withdrawal permission on a trading key. With withdrawals off, even a fully leaked key cannot drain your funds, it can only trade them. Two more habits make the key safer still: add IP whitelisting so the key works only from your known addresses, and create a separate key per tool so you can revoke one without disturbing the rest.

Watch the bot while it runs

"Set and forget" quietly becomes "set and regret". Automation removes the manual clicking, not the responsibility, so a live strategy still needs watching.

Keep an eye on a handful of things: its equity and drawdown against what your backtest and forward test led you to expect, its trade frequency, its average win and average loss, and how correlated its open positions are. Log every action the bot takes so you can reconstruct what happened after the fact. And set alerts that ping you the moment any limit is breached, rather than relying on yourself to remember to check.

The warning signs that say stop now

Some changes in a bot's behaviour are not noise to ride out, they are a signal to pause and inspect. Learn these and you catch trouble early instead of explaining it afterwards.

• Drawdown beyond what your testing predicted. The market may have shifted, or the edge may have decayed.
• A sudden burst of orders. Unusual trade frequency often means a bug looping, and that should stop the bot at once.
• A correlation breakdown. Positions you believed were independent start moving together, which means your real risk is far higher than your position count suggests.
• Slippage or costs running above your assumptions. These quietly erode the edge trade by trade.
• The strategy trading into conditions it was never built for. That is the black-swan warning from the previous module.

When any of these appear, the correct move is to pause and look, never to let it ride and hope it corrects itself.

Quick knowledge check

What are the four non-negotiable limits you set before an automated strategy goes live? A max daily loss (kill switch), a max single-trade size, a total allocation cap, and a drawdown-pause threshold, each a hard number decided in advance and enforced automatically.

Why should a trading API key never have withdrawal permission enabled? A trading bot has no reason to move money, so keeping withdrawals off means that even a fully leaked key can only trade your funds, not steal them off the exchange. It caps your worst case.

A running bot suddenly starts placing far more orders than usual. What do you do and why? Pause it immediately and investigate. A sudden burst of orders often means a bug looping, which can inflict large losses at machine speed if left running.

Sources

• SEC (investor.gov) & FINRA, "Investor Alert: Automated Investment Tools", on why an automated system still needs pre-set rules and active human oversight.
• SEC, "SEC Charges Knight Capital With Violations of Market Access Rule" (Press Release 2013-222), the case where a faulty automated deployment fired a flood of unintended orders and caused roughly $440 million in losses in about 45 minutes.
• OWASP, "Authorization Cheat Sheet", least-privilege API access: separate read, trade, and withdraw permissions, keep withdrawals disabled, and restrict keys by IP allow-list.