We Sold God Out.

I. The Order That Cannot Leave Unchecked

A stock order cannot leave unchecked, a credit memo can, and nobody decided that on purpose.

On 3 November 2010 the US Securities and Exchange Commission, under Chair Mary Schapiro, adopted Rule 15c3-5, the Market Access Rule. Her underlying point was simple: a broker cannot claim to have controlled a risk once the order carrying it has already reached the market. Control has to sit before the order leaves the building.

What the rule actually requires is unglamorous and, fifteen years on, easy to forget is unusual. Every broker with market access must run automated, pre-trade controls on every order, manual or algorithmic, before that order reaches an exchange. Those controls are not advisory. They must prevent the entry of orders that breach a pre-set credit or capital threshold, and they must prevent orders that are erroneous in size or price. The rule’s own language on custody is blunt: the systems doing this checking must sit “under the direct and exclusive control of the broker or dealer” (240.15c3-5(d)), which is the regulator’s way of banning what the industry called naked or unfiltered access, a client routing orders straight to an exchange under a broker’s licence with nothing of the broker’s own in the path. Compliance became mandatory on 14 July 2011.

This is not a monitoring requirement, not a dashboard that flags a bad order after the fact for a human to review at leisure. It is a mandated, deployed, block-before-send control, running without a model in the loop, on every order an American broker sends, for a decade and a half. That is the report, and it is not a proposal or a thought experiment: it has been running, continuously, since 2011.

Now the argument, and the argument has to be more careful than the report. The interesting question is not whether this kind of refusal is possible. Finance already answered that. The interesting question is why it worked here, and what would have to be true for it to work anywhere else.

II. Why the Order Was Easy to Gate

An order is a closed shape, and that closure is the entire trick.

Start with what an equities order actually is, as a piece of data. Strip away the trading strategy behind it and the object reaching the gate has a fixed, small, enumerable set of fields: an instrument symbol, a side, buy or sell, a size, a price, and an account. That is close to the whole schema. Every field is drawn from a bounded domain: symbols are a finite list on any given day, side is binary, size and price are numbers, the account is one of a known set the broker maintains. Nothing about the object is open-ended, and nothing about it requires interpretation.

That closure is what makes a pre-trade check a total function rather than an aspiration. Define the gate as a decision over that tuple: given symbol, side, size, price, account, look up the account’s pre-set credit and capital thresholds, multiply size by price, compare the result against the threshold, and check the price against a band around the last reasonable market price for that symbol. Every one of those steps is a retrieval or a numeric comparison. None of them asks whether the trade is a good idea, whether the strategy behind it makes sense, or whether the trader’s reasoning holds up. The gate never has to understand the order. It only has to read it.

This is worth being precise about, because it is the actual engineering content behind an analogy that usually stays at the level of gesture. A decision procedure is tractable, in the sense of being computable as a total function in bounded time with no undefined cases, exactly when its input reduces to a closed set of attributes with known domains and the acceptance condition can be expressed as a comparison over those attributes. Order size against a credit line is that kind of condition. So is order price against a volatility band. The exchange messaging protocols brokers already use, built around fixed and enumerable fields, do half the reduction before the rule ever has to.

None of this required a hard theoretical result to get right. It required someone to notice that the object crossing the gate was already narrow enough to check completely. The rule did not have to solve judgement. It had to recognise that judgement was not the question being asked. That is why the rule could mandate prevent rather than merely flag, and why a deterministic block was buildable here in a way that, for most of what an autonomous system does, it is not.

III. What Does Not Reduce That Cleanly

Most is not all, and the honest word between them is the entire argument.

Now take an action from outside the order book. Release a credit memo. Approve a KYC file. Escalate a model-validation finding. None of these is a five-field tuple. A memo is natural language whose acceptability depends on whether its claims are true, whether its numbers were computed correctly, and whether the underlying facts it relies on are current, none of which is a fixed attribute sitting on the object waiting to be read off. You cannot look at a paragraph of prose the way you look at a price and a volatility band, because there is no closed schema behind whether its argument holds.

A 2026 theoretical result on the limits of automated enforcement makes the general version of this precise, and it is worth stating carefully rather than waving at. A deterministic gate can only enforce the policies whose accepting states its own model is able to represent. Ask it to enforce a policy over an unrestricted space of actions, meaning any action a sufficiently capable agent might take, and the general problem of deciding, for arbitrary actions, whether the policy holds becomes undecidable. There is no total function that solves it for every case. The result is only tractable once you restrict the policy class, which is another way of saying: once you have already done to the action space what the order book’s own format did to a trade before the rule ever touched it.

That is the honest limit, and it has two edges worth naming separately, because they fail for different reasons.

The first is semantic quality. Whether a memo’s argument is correct is a claim about the world, not an attribute of the memo, and a gate that only compares declared attributes against thresholds has no purchase on it. You can check that a number was recomputed rather than merely asserted. You cannot check, by the same mechanism, that the recomputation used the right model.

The second is aggregate effect. A gate evaluates one action at a time and has no visibility into what a thousand individually compliant actions add up to across a portfolio, a desk, or a quarter. This is not unique to agentic systems: 15c3-5 shares exactly this blind spot. It clears orders one at a time against static thresholds and has nothing structural to say about a strategy built entirely from orders that each, individually, clear every check.

So the claim here is narrower than the analogy usually gets stretched to, and the narrowing is the point, not a hedge tacked on afterward. Not all consequential actions reduce to an attribute-checkable gate. Most do. Whether a data source is stale enough to distrust is a timestamp comparison. Whether a ratio in a memo is right is a recomputation and a comparison, done independently of whatever the agent claims. Whether an approval is real is a check against an authenticated identity, not a string in a transcript. Whether an agent is permitted to take an action at all is a lookup against a capability list. Each of those is a closed, bounded, attribute-checkable question sitting inside an action that looks, on the surface, as unstructured as a memo. The engineering work is doing to a credit decision or a model-validation step what an exchange’s message format already does to an order: pulling the checkable, typed substrate out of the open-ended act and gating that, while refusing to pretend the remaining semantic judgement has been solved along with it.

IV. The Mandate Is Not the Determinism

The mandate was never the hard part. The hard part was making the mandate true at deploy time.

Even a well-scoped mandate is not self-executing, and the clearest proof in this exact context is Knight Capital.

On 1 August 2012, Knight deployed a new order router to seven of its eight production servers. The eighth did not receive the update. On that server, a flag dormant for years was repurposed by the new code and, when triggered, reactivated old, defunct logic left over from a discontinued system, which had no check against how many times an order had already been filled. In roughly forty five minutes, that server sent more than four million orders trying to fill what should have been two hundred and twelve customer orders. The loss exceeded four hundred and sixty million dollars. No automated circuit halted the runaway server; the firm relied on people noticing, and people did not notice fast enough, partly because the deployment itself had no discipline behind it, no consistent rollout across the fleet, no verification that all eight servers ran the same code. The SEC’s first ever enforcement action under 15c3-5, in October 2013, followed directly: a twelve million dollar penalty, a censure, and a mandated independent consultant.

The lesson is not that the rule failed. It was not violated by bad drafting. It was violated by bad deployment. A mandate that says controls must exist says nothing about whether the code implementing them is structurally incapable of reaching an unchecked state. Knight’s dormant flag was exactly that: a code path the mandate did not know existed, one bad repurposing away from going live, on a server nobody had finished updating. Determinism that depends on every server being correctly configured at every point in time is not determinism. It is a promise renewed at each deployment, and promises get missed.

I should say plainly what I have a stake in here, because the essay’s own logic requires it. I build exactly this kind of thing: a deterministic capability bound, enforced at the tool-call boundary, per system, at execution time, independent of whichever model is generating the action underneath it, of the sort sometimes called Ring Zero, a kernel whose transition function is total over a closed, enumerated set of allowed actions, so that an action outside that set does not merely get discouraged, it has no execution path at all, and anything ambiguous fails closed rather than through. I sell a version of that fix. Knight’s eighth server is the failure mode that design targets: not a missing rule, a rule with a hole in its own reach that nobody could see until it cost four hundred and sixty million dollars to find. I am arguing for my own product here, and the reader should weigh it accordingly rather than take my account of the fix on trust.

V. The Regulator Is Already Asking For It, Voluntarily

Nobody is waiting for permission to build this. Some of them are already building it.

If the case for a deterministic action gate in agentic systems sounded like an idea nobody in finance had reached yet, that needs correcting directly, because it is not true.

In July 2026, a BuildFin.ai led initiative at the Monetary Authority of Singapore published a white paper on safeguards for agentic finance at runtime, describing an architecture that sits between an agent and the systems it can act on, evaluating each proposed action and returning one of three outcomes: allow it, escalate it to a person, or reject it. That is close to a verbatim restatement of this essay’s thesis, arrived at independently, from inside the regulatory ecosystem rather than from a vendor pitch. Separately, Singapore’s Infocomm Media Development Authority has extended its Model AI Governance Framework to cover agentic systems, describing expectations around a working kill switch, defined behaviour when a system goes offline mid-task, containment through restricted execution environments for higher-risk work, and human approval before irreversible actions such as deletion or payment.

Two concessions belong here, unsoftened. First, neither of these is a rule. The agentic finance paper is explicitly voluntary guidance from an industry initiative, not a supervisory expectation with an enforcement date, and the Singapore framework is guidance rather than binding law in the way 15c3-5 is. Second, and more uncomfortable for this essay’s claim to fresh thinking, a consortium inside the regulatory space is already converging on close to the same architecture I am describing as a build target. That is a fast-follower dynamic, not a market I am opening alone, and I would rather name it than have a reader find it and conclude I had not read the paper. What still separates a serious build from the white paper is depth rather than category: execution quality at the kernel level, model-risk-management grade evidence trails, and the structural fail-closed property Knight argues for, none of which a description on paper delivers by itself.

VI. The Case Against This Essay

An essay that cannot be argued with is not an argument, it is a slogan.

Take the strongest objections above, in order.

The rule looks harder in the text than it behaves in practice. Nothing in 15c3-5 as written permits a soft, tunable warning a trader can click through, and the direct-and-exclusive-control language is meant to foreclose exactly that. But rules are implemented by firms, and firms vary in how tightly they hold that line: thresholds get raised under desk pressure, alerts get set to advisory mode in busy periods, and the gap between the rule’s design and a firm’s actual configuration is where a regulator’s exam findings tend to live. The claim here is about what the mandate requires, a genuinely unbypassable reject path, not about how uniformly every broker has held that path shut. Concede the gap plainly; it is exactly what a well built kernel is supposed to close by making the reject path structural rather than configurable.

The scoping move in sections two and three is the essay’s biggest exposure, because it is load-bearing. If a critic can show that most of what a consequential financial agent does fails to reduce to attribute-checkable questions, the whole argument collapses into a curiosity about equities trading. The concession already built into section three, that semantic quality and aggregate effects sit outside the gate, is the honest boundary, and most of what makes an agent’s action dangerous in a regulated pipeline, a stale input, an unverified number, a missing authorisation, is the attribute-checkable kind. But that is a claim to keep testing against real agent traces, not one an essay gets to settle by asserting it.

Then there is Burak Oktenli, who published a piece in Eurasia Review on 4 September 2026, two days before the idea behind this essay was drafted, making a closely related argument from 15c3-5 and adjacent European and UK algorithmic-trading controls. His argument is about authority: that an AI agent should never hold one broad permission to trade or act, and that these rules model the narrow, revocable authority an agent should be scoped to instead. That is a real argument, and it arrived first. What I am arguing differs in kind, not just emphasis: not how much authority an agent should be handed, but whether a deterministic mechanism can refuse a specific action before it executes, which needs the typed-action reduction in section two and the Knight build-time lesson in section four, neither of which his piece turns to. The two arguments are compatible and probably should be read together. Neither of us gets to claim the base analogy as original; that credit sits with the rulebook.

Last, the plainest conflict of all. I sell the thing this essay argues someone should build. I said so directly in section four rather than waiting for a reader to notice, and I am saying it again here because a declared interest belongs in the body of an argument, not its footnotes. Read everything above with that in mind.

VII. Coda

Finance did not prove the problem is solved. It proved that the gate can be built.

None of this proves the problem of governing autonomous systems is solved. It proves something narrower: that a mandated, block-before-send, model-free refusal of a live financial system’s output has been running in production, at national scale, since 2011, for a specific, nameable property of the object it gates, not a general theory of control that transfers automatically to anything else.

That property, a closed and bounded shape reducible to checkable attributes, is not unique to an order book. It shows up in most of what makes an autonomous financial agent’s actions dangerous: whether the data behind a decision is current, whether a number was actually recomputed rather than just asserted, whether an approval came from an authenticated person rather than a plausible sentence in a chat window, whether the action attempted is one the system is permitted to take at all. Building the gate for those questions, and refusing to pretend it also settles whether the underlying judgement is sound, is the actual work between where finance already is and where every other function handling an autonomous agent’s output is not.

So the honest way to close is with the question left open, not answered. The equities desk has not been allowed to send an order that a deterministic control has not first cleared, for fifteen years, and nobody at the firm considers it remarkable. Most other functions inside the same institutions, running agents against far less structured decisions, have no equivalent gate at all. The rule is not proof that gap will close on its own. It is a licence, sitting in plain sight for fifteen years, to go and build the gate that the rest of the agent’s actions still do not have.