The gate
An order does not exist until a separate service has evaluated it against your limits and signed an approval for that exact quantity and price. Execution will not submit an order whose approval does not match what it is about to send.
The component that talks to the exchange does not decide whether a trade is allowed. It receives a signed approval and verifies it, and a mismatch — a different quantity, a different price, an expired signature — is a refusal, not a warning. A gate that lives inside the code it gates is a gate that a future change can walk past without anyone noticing.
The signature covers the order’s own values, and the approval is consumed when it is used. Replaying it does not place a second trade, and amending an order after approval means a new evaluation — because an amend can grow a position, which is the same act as opening one.
Every limit is computed against a snapshot of your portfolio. If that snapshot is older than the platform is willing to trust, the answer is no. Sizing a position against yesterday’s equity is how a risk limit becomes decorative — the arithmetic is right and the input is wrong.
Every one of these runs on every order, including a protective exit and including an amend.
The loss you would take if the stop filled, as a fraction of equity. An order with no stop, or one whose stop implies a loss above your limit, does not pass. This is the limit that does the most work, because it is the only one that reads the trade’s own shape.
Total notional and per-symbol concentration, so a book cannot become one position wearing five tickets.
Distance from the equity high-water mark, with consecutive losing closes counted separately. A losing streak and a slow bleed are different failures.
A ceiling per venue and market type, checked against what the order actually asks the venue for, not against what the strategy intended.
How old the portfolio snapshot and the mark prices are. Stale enough and the answer is no, with the age named — an unfamiliar refusal that tells you the data stalled is worth more than a confident number that did not.
You can change a policy, and the change is a versioned, auditable act with the previous version still readable. What you cannot do is have an order skip the evaluation — there is no path to the venue that does not pass through it.
No, and it is not asked to. The assistant proposes; the gate decides. A proposal that fails comes back with the check that refused it, which is more useful to you than a smaller order it invented to slip through.
It goes through. Cancelling reduces exposure and can never create any, so a gate that refuses cancels traps you in a position it will not let you leave — that would be the more dangerous design.
Yes. A strategy that only passes with the gate switched off has not been tested, and paper is where you find that out for free.
Propose something oversized on a paper account and read the refusal. It names the check, not just the outcome.