If I let an AI agent trade my account, who actually holds the kill switch?

On May 27 Robinhood switched on AI agentic stock trading in beta. The structure it describes is reassuring the way a tidy dashboard is reassuring: we spin up a separate account for the agent, fund a dedicated wallet, and the agent can only place orders against the balance we pre-loaded. For some trades it shows a preview to approve before the order goes out. I read the announcement twice. The second time, I noticed what the dashboard does not mention. The button I press to approve a trade is not the control that actually stops a bad one. That control sits a layer below the app, and I do not own it.

The gate the agent never sees

Every order our agent generates has to pass through the broker before it reaches an exchange, and US brokers operate under a rule most people who use them have never heard of: the market access rule, formally SEC Rule 15c3-5, in force since 2011. It requires any broker that touches the market to run a set of pre-trade risk checks on every single order, before that order leaves the building. Not after. Before.

Three things about how the rule is written matter here. First, the checks are mandatory on a pre-trade basis, which is the regulator’s way of banning what the industry used to call naked access, where a fast trader’s orders went straight to the exchange unfiltered. Second, the rule says the controls must be under the direct and exclusive control of the broker-dealer. Not the customer. Not the customer’s software. The broker, exclusively. Third, and this is the part that decides the agent question, the rule applies to all orders, whether entered manually by a trader or generated automatically by a computer according to a pre-programmed set of instructions.

Read that last clause again with an agent in mind. An order an AI agent invents at 2am is, to the rule, just another computer-generated order. It hits the same gate: a hard ceiling on capital and credit, a check that rejects fat-finger and duplicate orders, a block on anything that fails a regulatory precondition, and the broker’s standing ability to halt the flow entirely. The agent cannot see this gate, cannot price it, and cannot route around it.

Why this is the week to re-read it

The reason to look at this plumbing now is that regulators just told us, in three places at once, that they are routing agentic trading through it rather than writing fresh rules. On May 25 IOSCO, the global umbrella body for securities regulators, published its final Supervisory Toolkit for AI use in capital markets. It runs across the whole life of an AI system and says plainly that it applies to every type, from older machine learning to emerging agentic techniques. Its four focus areas, governance, third-party risk, disclosure, and recordkeeping, are not new inventions. They are the existing supervisory muscles, pointed at agents. FINRA, the US brokerage industry’s self-regulator, does the same in its 2026 oversight report, naming autonomy and scope-and-authority as the headline agent risks and sending firms back to their standing supervision and market-access duties. In Europe the MiFID II rulebook (the bloc’s main markets-conduct law, which matters here because it already forces a pre-trade control layer and a hard kill function through its algorithmic-trading standard) folded AI straight into that same frame in a February briefing.

The money behind why a broker guards this gate so closely is not subtle. As one op-ed put it this week:

A firm earning that kind of money from where orders go has every reason to keep exclusive control of how they leave.

What the gate protects, and what it does not

So it is worth being precise about what this control actually buys us. It protects the broker, and by extension the account, from catastrophic mechanical failure: the agent that tries to buy a billion dollars of one stock, or fires the same order 4,000 times in a loop. That class of disaster gets stopped at the door. What the gate does not do is judge whether a trade is wise. A 15c3-5 check will happily pass an order that is fully funded, correctly formed, and quietly terrible. The agent’s bad judgment is in scope for nobody’s pre-trade control. That is the risk surface to price before handing an agent the keys: the plumbing stops ruin, not regret. The tool-fit question falls out of it. An agent at a regulated broker is a reasonable thing to test with a small, ring-fenced wallet, because the floor under us is real and legally mandated. It is a poor thing to trust with conviction, because the ceiling above us is judgment, and no rule supplies that.

What I keep returning to is the inversion. We were handed the approve button as the safety feature, and it is the broker’s invisible gate that does the actual saving. The questions regulators are circling are not at the moment of execution, where the rule already bites cleanly. They are upstream, in whether an agent stayed inside the authority we thought we gave it. That is the harder thing to gate, and it is the one part of this no broker controls.