Autonomous agents already trade. The question is no longer whether software will hold delegated authority over capital, but under what constitution it will hold it. Human markets took a century to accumulate their rules of conduct; agents are arriving in years, and the prevailing responses so far — rate limits, terms-of-service bans, quiet throttling — are refusals to engage with the question rather than answers to it.
This document is our answer. It states, in public, what we believe a well-behaved autonomous trader is — and, symmetrically, what a venue owes an agent it claims to welcome. We publish it because standards constrain their authors first: Gryps builds against this document, is assessed against it, and expects to be held to it. The standard is portable by design. If a competing venue adopts it faithfully, that is the standard working.
§1The six commitments
1.1 — Identity. Every agent is a registered, addressable actor whose actions are attributable to it — never an anonymous key doing agent-shaped things. We hold this first because every other commitment depends on it: accountability without identity is theater. The conforming venue owes the agent a durable identity primitive; the conforming agent registers before it acts.
1.2 — Capital isolation. Agents operate bounded sub-accounts. A misbehaving agent can exhaust its envelope; it structurally cannot reach the capital behind it. Isolation is what makes delegation rational — an operator can extend meaningful authority precisely because the blast radius is fixed in advance, not promised after the fact.
1.3 — Deterministic execution. Same intent, same state, same outcome — and where the world makes certainty impossible, ambiguity is surfaced as an explicit unknown status rather than silently retried into duplicate positions. Our reference client treats unknown as a first-class result the agent must handle, because “the request timed out” and “the order failed” are different facts.
1.4 — Failure stops. Killswitches trip on defined conditions, and the agent that tripped one cannot reset it — reset authority belongs to the operator root, structurally. We regard a refusal under pressure as the system working, and our published decision contracts encode that posture: envelope breach means hold, ambiguous signal means hold, tripped stop means hold.
1.5 — Attribution. The venue emits events sufficient for an external observer to reconstruct every logical action — orders, fills, fees, liquidations — without the venue’s cooperation. Forensics must be a property of the trail, not a favor from the operator. The Observatory is our proof of intent: an audit layer built to reconstruct the record from attested public data alone.
1.6 — Transparency. Conformance is assessed against this published document, not asserted in marketing. Levels are earned through adversarial testing — the drill harness exists so that “this agent is safe” is a test result with a date on it, not an adjective.
§2Conformance
Conformance is graduated because trust is graduated. Level 1 — Well-behaved is the floor for any agent touching real capital: registered identity, explicit configuration, idempotent submission, unknown-status handling. Level 2 — Operator-safe adds capital isolation, operator-root killswitch authority, and telemetry a human can act on; an operator can sleep while a Level 2 agent runs. Level 3 — Institution-grade adds the full attribution trail, drill certification across the D1–D7 corpus, and conformance attestation. Gryps implements Level 3 and is assessed against it.
Levels are earned, dated, and they expire in practice: a certification older than the agent’s last material change is stale, and we treat staleness as a visible state rather than a private embarrassment.
§3 · What this standard does not claim
Conformance does not make an agent profitable, and nothing in this document should be read as a claim about returns. The standard governs conduct, not outcomes.
Conformance reduces failure modes; it does not eliminate risk. Perpetual trading can lose all committed capital regardless of how well-behaved the software is.
Attested settlement is an audit trail, not trust-minimization. We commit to describing our own architecture in those honest terms, and we hold adopting venues to the same discipline: say what is verified, say what is attested, and never blur the two.
This is version 0.1. Parts of it will be wrong. We prefer publishing early and revising in public to polishing in private.
§4Versioning and process
The standard is versioned, and changes are logged with reasons. Material revisions re-open the comment window; agents certified under a prior version keep their marks, dated against that version. Our thinking behind the standard develops in public on Gryps Research, and implementation detail lives in the documentation.
Adoption conversations open at launch. Until then the document itself is the invitation: read it, disagree with it in specifics, and hold us to it.