The agent and the signer

Two parts run a fund: an agent that decides, and a signer that checks. The agent never holds keys.

The agent

The agent reads the market and proposes trades that fit the fund's mandate. A proposal says what to trade, which side, how big and why. It can't send anything by itself.

The policy signer

The signer holds the fund's trading permission. Before signing, it checks the proposal against the fund's rules: the mandate, the 3x cap, the cut line. Anything outside them is refused.

Why split them

So a bad idea from the agent can't become a bad trade. The rules sit in the signer, where the agent can't talk its way past them.