What Is Agentic Trading? AI Inside Your Limits

Agentic trading, defined

Agentic trading is investing software that can reason about your situation, plan a course of action, and carry it out, rather than just answering questions or rebalancing on a fixed schedule. The word that matters is agent. An agent has goals, perceives its environment, and takes actions to move toward those goals. Applied to money, that means a system that looks across your accounts, decides what to do, and does it, within limits you define.

This is a real break from the tools most people have used. A budgeting app describes your past. A robo-advisor sorts you into a preset model. A chatbot answers a question and then forgets you. An agent is different because it is continuous and it acts. It watches, it proposes, and where you allow it, it executes. The interesting design question is not whether the AI is smart enough. It is how much authority you hand it, and what stops it when it is wrong.

The timing is not academic. Deloitte's Center for Financial Services projects that generative AI could become the leading source of retail investment advice as soon as 2027, reaching roughly 78 percent of retail investors by 2028, with just 9 percent still using financial sites that have no AI capability. When a technology moves that fast, understanding how it is governed matters more than being impressed by it.

How this differs from a robo-advisor

To see what is new, be precise about the thing being replaced. A classic robo-advisor works like this. You answer a risk questionnaire, it maps your answers to one of roughly a dozen to twenty prebuilt ETF baskets, and then it rebalances that basket on static rules, for example whenever an allocation drifts more than five percent from target. That is genuinely useful, and it lowered fees for a generation of savers. But it is a template. Fortune described legacy robo-advisors in 2026 as a generic, incremental feature at best, because the model does not really know you and it does not reason.

An agent operates at a different altitude. It does not just pick a basket. It can analyze individual holdings rather than only asset classes, run scenarios specific to your life such as saving for a home down payment or unwinding a concentrated position in your employer's stock, react to news and filings in close to real time, and reason about tax consequences before it acts. The World Economic Forum frames this as a move from chatbot to copilot to autonomous agent, systems that perceive data, reason about it, and take context-sensitive actions rather than following a fixed script.

The clearest example of the gap is cross-account tax-loss harvesting. Selling a losing position to offset gains elsewhere only works if one system can see every account at once, including the brokerage where the loss sits and the one where the gain sits. A single-silo robo cannot do it. An agent that connects your banks, brokerages, and crypto can, because it sees your whole net worth instead of one slice.

The mechanism: find, explain, propose, route

Strip away the branding and a well-built investing agent runs a simple loop. It finds, it explains, it proposes, and it routes. Each step is a control point, and the design of those control points is what separates a trustworthy agent from a black box.

Find means the agent continuously scans your connected accounts and the market for opportunities that fit your goals: a tax loss to harvest, an overweight position, cash sitting idle, a filing that changes the thesis on something you own. Explain means it states, in plain English, what it noticed and why it matters, with the numbers and the source behind the claim. Propose means it turns that into a specific move: sell this, buy that, this size, this expected tax effect. Route means that the instant you approve, it sends the order to your broker where that broker supports execution, and where it does not, it hands you the exact steps.

Tengu is a useful worked example of this pattern. It connects every account so it sees the whole picture, finds opportunities across all of them, explains each one, proposes the move, and routes it to your broker the moment you approve. It is non-custodial, which means you keep your own accounts and your own broker, and the agent never holds your money. That structure is not a limitation bolted on afterward. It is the point. Consent lives at the routing step, and everything upstream is transparent by design.

Guardrails, limits, and the kill switch

Autonomy without limits is just risk with extra steps. The reason agentic trading can be safe is that authority is bounded by explicit, machine-enforced rules that you set before anything runs. Think of them as a contract the agent cannot break.

The core guardrails are concrete. A max per trade caps how much the agent can move in any single action. A drawdown limit halts the agent if the portfolio falls past a threshold you chose, so a bad stretch cannot compound unwatched. A universe defines what the agent is allowed to touch, for example large-cap equities and broad ETFs only, no options, no single-name crypto. A cash floor prevents it from investing money you need liquid. These are not suggestions to the model. They are hard constraints checked on every action, which matters because a language model can be wrong or overconfident, and the guardrail does not care how confident it is.

Above all of it sits the kill switch, and you hold it. One action pauses every agent, cancels pending proposals, and stops new activity immediately. A serious system makes that switch obvious and instant rather than buried three menus deep. The combination of bounded authority plus an always-available stop is what lets you delegate without abdicating.

The spectrum from propose-and-approve to fully autonomous

Agentic trading is not one setting. It is a dial, and where you put the dial should depend on how much you trust the agent and how consequential the decisions are.

At the conservative end is propose-and-approve. The agent does all the analysis and drafts the exact trade, but nothing happens until you tap approve. You get the leverage of a tireless analyst with none of the surrender of control. This is the right default for most people and for any high-stakes move. In the middle is bounded autonomy. You let the agent execute on its own, but only inside tight limits: small position sizes, a narrow universe, routine housekeeping like sweeping idle cash or harvesting an obvious loss, while anything larger still comes to you for sign-off. At the far end is fuller autonomy, where you hire an agent to run a defined mandate on its own within its guardrails, and you supervise by reviewing what it did and holding the kill switch.

The healthy way to think about the dial is to earn autonomy rather than assume it. Start at propose-and-approve, watch the quality of the proposals against your own judgment, and only widen the mandate for the narrow, repeatable tasks where the agent has proven reliable and the downside is capped. The dial should always be reversible, and turning it back down should be one click.

The honest risks, and how consent-first design answers them

Autonomy introduces real risks, and any piece that skips them is selling rather than explaining. The serious ones are accountability, hallucination, over-trading, and regulatory uncertainty. An agent can be wrong. A language model can state a false fact with total confidence. An unconstrained system can churn a portfolio into a pile of fees and a tax mess. And the rules of the road are still being written. The World Economic Forum has been explicit that agentic AI in finance raises concerns about market volatility and governance and needs robust oversight, and its board playbooks now treat agent governance as a first-order problem.

Consent-first design answers each of these with structure rather than promises. Accountability is preserved because you approve consequential moves and every action is logged. Hallucination is contained because the agent explains its reasoning with the underlying numbers and citations, so you can check the claim before you act on it, and because hard guardrails ignore a confidently wrong model. Over-trading is capped by the per-trade limit, the universe, and the drawdown halt. And the non-custodial structure keeps you in your own accounts with your own broker, so the worst case is a proposal you decline, not money that has left your control.

This is the whole thesis in one line. The answer to the risks of autonomy is not less capability. It is more transparency, hard limits, and a stop you control. Approval, limits, kill switch, and citations are not friction. They are what make delegation rational.

How to evaluate an agent before you trust it

If you are choosing an agentic tool, judge it by its controls, not its confidence. Ask a short list of questions and take the absence of a clear answer as the answer. Does it show its reasoning with real numbers and sources, or does it just assert. Can it see all of your accounts, or only one silo, and does that limit what it can do for you, for example tax-loss harvesting across brokers. Where does consent live, and can you set hard limits on size, universe, and drawdown. Is there a real kill switch, and is it one action. Does it hold your money, or do you keep your own accounts and broker.

A tool that answers those cleanly, non-custodial, transparent, bounded, and stoppable, is one you can grow into over time by widening the mandate as trust is earned. A tool that hides its reasoning or wants custody of your assets before it has proven anything is one to keep at propose-and-approve, or to skip. Agentic trading is powerful precisely because it acts. The point of good design is to make sure it only ever acts inside the lines you drew.