Definition
The shape is always the same: a goal in words, a set of tools (a search, a file, a shell command, an API), a loop, and a rule for stopping. Nothing about it is new in kind, since a program has always been able to call an API. What is new is that the choice of call is made by a model reading text, so the system can handle work nobody wrote a rule for, and can be wrong where a rule cannot. Two questions describe any such system: which tools it holds, and what it may do without asking.
With money in reach, four failures matter more than the rest. It can misread a figure, and a decimal point out of place is a position ten times too large. It can be instructed by the data it reads, since text fetched from outside can carry instructions a model takes as its own. It can loop, and a step repeated is a fee repeated or an order nobody intended. And its key can be stolen, because a key on a machine that runs unattended is a key an attacker can reach.
Three kinds of bound exist, and they are not interchangeable. What the venue itself refuses to accept is the strongest: the action never happens, whatever the program decides. A limit signed by the person on a device the machine cannot reach comes next, and is only as good as the code that checks it. A figure in a configuration file is the weakest, because whoever reaches the machine reaches the file. A journal is not a bound at all, but without one no bound can be checked after the fact.
Our own agent applies the three in that order. The account key stays in your wallet, Locker Vault on an offline phone first, or the extension or mobile wallet you chose, and can do everything. The agent key lives on the computer, sealed under a password, and may only place and cancel orders and set a market's leverage and margin mode. The mandate signed by your wallet holds the limits (the markets, the largest order, the highest leverage, the orders and the notional per day, the fee and its one recipient), with a term that ends with the agent key, 180 days at most, and the guardian applies the narrower of the mandate and the local policy before every opening.
Example
An example of a bounded loop: our daily pilot. One deliberation a day, at 00:30 UTC unless the charter says otherwise, names a side, a market and a first entry, with a thesis and a confidence, and nothing else: no size, no stop, no target. The code then sizes the position from the charter, which here means a ladder of 1, 1, 2, 3 and 5 stakes at leverage 3, steps 0.5 daily ATR apart, and a base stake of 2.78% of the equity. If the fees, the funding over the days the position is expected to wait and the slippage eat the 10% of the base stake it aims at, the trade is refused after the model has spoken.