Boundaries
The interestinglist is the oneof refusals
Any product can promise its AI is careful. The question worth asking is which things are impossible rather than discouraged — and whether the impossibility lives somewhere the model cannot argue with.
Structurally impossible
Each of these is enforced by a separate service, on the path an order must take, and each has a test that fails if the guard is removed.
- Place an order without a human confirmation. Every change the assistant wants is a proposal.
- Place an order that fails your risk limits. The gate is a different service, it signs its approval, and execution refuses a signature that does not match what it is about to send.
- Reach a live venue from an account that may only trade on paper. The venue is checked against what the connector actually is, not against the name the order carries.
- Trade or read an account that is not yours. The account’s owner is asked of the service that owns that fact, on every account-addressed surface.
- Promote a strategy to live. That needs a human, a scope, and a risk policy in force at the time.
- Withdraw anything. No credential in the system holds a withdrawal permission, and none is asked for.
- Delete a screen and its history from a sentence. Deletion cascades, so it is not offered to the assistant at all.
- Grant itself a role or an entitlement. Roles are an administrator’s grant; entitlement is a property of the account record, not of the credential asking.
Why "structurally" is the word that matters
A prompt is not a boundary
Instructions in a system prompt are a strong suggestion to a very persuasive machine. They are not a control. Every item above is enforced outside the model’s reach — in a service the model calls, which decides on its own and does not read the argument that accompanied the request.
A boundary you cannot test is a claim
Each guard here has a test that deliberately breaks the guard and expects the test to fail. That sounds pedantic until you have seen a guard that quietly disarmed its own assertion — we have, and it looked green for five days while doing nothing.
And the person who wrote it is a boundary too
The account that owns the platform is one account, and a registrant cannot become it. That is a property of there being exactly one path that writes the column, rather than of anyone remembering to check.
Questions about the boundaries
Can I turn the confirmation off?
No. Automation that runs unattended exists — a promoted strategy — and it is a different thing with a different setup and its own gate. The conversational path always confirms.
What if the model is jailbroken?
Then it produces a persuasive proposal, and the gate refuses it exactly as it would refuse a bad one you typed. That is the design: nothing on the money path takes the model’s word for anything.
Do these apply on paper too?
All of them. Paper differs in where the order goes, not in what is allowed to send one.
Try to get it to break one
A paper account is the right place to find out how the refusals behave.