Turning your Copilot into a Financial Agent

In January, I vibe coded my first prototype of a crypto trading agent for perps on Hyperliquid. It had tools for researching the market, proposing trades, and executing them using a private key stored in a .env variable (not very secure I know).

Within minutes of finishing the MVP, I had the agent TUI open on one side of my screen and Hyperliquid on the other. I was watching its thinking readout as it picked up the execution tool for an ETH short. The entry price looked unreasonable to me, but that could well have been be my irredeemable ETH holder bias.

I hadn't pressed an approval button or signed a transaction. The system didn't force the agent to stop. It could move directly from proposing the trade to placing it, which is exactly what it did.

The position was small enough, probably less than 10% of the wallet. I let it execute. When the trade moved against me, I chickened out and closed it myself, realizing I hadn't prompted the agent to set a tight stop loss. My entire risk instruction was: "Keep trades reasonably sized." (And yes, I've since graduated from pure slop trading prompts.)

Nothing went wrong. The trade was small, and I exited it myself. But I needed to close it because I suddenly realized there was no safety net. But that was the slightly scary sign my financial copilot had been successfully upgraded to a genuine autonomous financial agent.

The line between advice and authority

A copilot, like ChatGPT, Claude or Gemini’s chat modes can research, reason, and recommend. An agent has the authority to act autonomously. Once the system can move real assets without waiting for me to press a button or sign a transaction, the design space completely changes.

I tend to think of there as being four useful levels of financial autonomy:

1. Research: The system gathers information and helps the user understand it.
2. Recommend: It forms a view and proposes an action.
3. Prepare: It turns that recommendation into an executable order or transaction, but waits for a human to approve it.
4. Transact: It can execute autonomously using real assets.

The jump from level 3 to 4 is the category boundary: before that, the human still holds authority, but after it, the agent does.

For what it’s worth, the SEC has started drawing a similar distinction. In 2025, the SEC Chair Paul Atkins described "agentic finance" as autonomous AI agents that can "execute trades, allocate capital, and manage risk." In 2026, the SEC’s Dave Sanchez contrasted systems that answer questions with systems that can "execute workflows." These were forward-looking speeches rather than new specific SEC rules, but they show some direction on where the regulation is headed. (Atkins, Sanchez)

It's also what we're hearing from traders, funds, and fintechs. They're interested in agents that can operate independently, but they want risk limits, codified trading philosophies, exception handling, and supervision. They don't want to approve every transaction: approving every action turns the agent back into a dumb assistant. Feeling like you have to sit there watching what the agent does turns you or your your team members into babysitters.

A prompt isn't a mandate

You can’t fix this kind of autonomy issue with a longer or smarter prompt. It wasn’t even like the prompt I wrote even failed in an obvious way. A $10 position could reasonably be described as "reasonably sized." The problem was in part that the safety recommendations I threw in had no teeth, and nothing to stop the model or its context window throwing it out.

A proper, professional mandate could've required a stop loss on every leveraged position and capped the loss at the stop to 5% of the wallet. It could've limited which assets the agent could trade, total portfolio exposure, and correlated positions.

The mandate also needs to cover uncertainty. Unfamiliar market conditions, a failed source, or stale or conflicting data might all require escalation. The exact boundaries might vary by agent and strategy, which is why they're part of a mandate rather than universal rules.

Put the rules outside the agent

Those rules should live outside the agent. The system interpreting the market shouldn't also be solely responsible for interpreting and enforcing its own limits.

Every proposed transaction should pass through an independent control at the point of execution, regardless of which model, prompt, or tool produced it. The agent can propose an action, but shouldn’t be able to rewrite its authority to make the action fit. Loosening the rules should require escalated human approval.

The signing setup matters too. Giving the agent direct access to a private key was convenient for a prototype, but it created an obvious exfiltration risk. A production agent should use a secure signing system where the key isn't extractable. Ideally, that separate service is what checks the policy before it signs anything.

There also needs to be an emergency control outside the agent. If I shut it down, it should block new transactions and close every open position without depending on the agent to cooperate.

Escalate the exception, not every trade

When an action falls outside the mandate, it stays blocked. But the agent should be able to explain why it believes the action fits its strategy and request a one-time exception. Teaching agents to learn from rejected actions is a separate and interesting problem, but more on that another time!

Most compliant activity shouldn't produce a notification at all. Ideally, the agent runs for as long as possible without taking up any mental bandwidth. I might check it when I feel like it or receive a daily summary. It should interrupt me when it reaches a boundary or genuinely needs a decision.

Trust has to be earned

Trust should build over time. Before giving an agent more capital or freedom, I'd want to see consistent performance without degradation, reliable compliance with its mandate, no bugs or operational breakdowns, and a proper security posture around its keys and enforcement. A proper paper trail to validate that it’s working like I think it should be working.

More automation can come as the agent deserves it. That's how we already delegate financial work to people. A trader gets a mandate, not unlimited authority. They can act independently inside it and escalate when they reach its boundaries.

That first January prototype is just a single simple example from the beginning of my learning journey at Nava. If you’re curious about the many other financial agent building lessons we’ve learned since, follow along!

For now I'll leave you with this TL;DR: Autonomy becomes truly useful when the agent can act without constant supervision. A copilot becomes an agent when it can move assets without asking each time, and it becomes trustworthy when that authority is given a hard limit outside the model. That’s the kind of safety and certainty we need as we continue to hand over financial capabilities to AI agents.