Materiality-gated trade execution
Let an AI agent draft fixed-income trades while every above-materiality order stops at an HMAC-signed HITL approval it cannot forge.
A Claude-backed agent can propose a corporate-bond rebalance in seconds — but letting it submit trades over the FIX gateway unsupervised is exactly what a regulator, and your own risk committee, will not sign off on.
Every create_trade action passes through the pure-function policy gate. Sub-materiality orders route T1 (agent executes, written to audit). Above the materiality threshold they route T2 and the agent must request an HMAC-signed approval envelope, scoped to the exact ISIN, notional, and side, before a single FIX message leaves the boundary.
The governed lifecycle for this pattern.
- 01
Agent proposes a trade
The agent calls create_trade with ISIN, notional, and side.
- 02
Gate routes by reversibility
decide(action, context) returns T2 above materiality with a verbatim rule citation.
- 03
Server issues a scoped envelope
An HMAC-signed envelope binds the approval to that exact action; the agent never sees the signing key.
- 04
Human approves, FIX submits
A distinct approver signs off; the decision and envelope are written to the append-only audit chain.
The desk keeps agent-speed drafting while irreversible value movement always has a human in the loop, cryptographically bound to the exact order.