When allowing the AI agent to trade directly, the most dangerous thing is not that it comes up with a bad idea, but rather that that bad idea can be executed continuously. On November 11th, Coinbase will launch Agent Controls for Coinbase, for, and Agents. Users will be able to set a maximum single transaction amount, a 24-hour cumulative transaction volume limit, and an automatic stop for portfolio losses; product category permissions are also planned to be implemented. More importantly, these restrictions are enforced on the Coinbase server, not within the agent itself.

This location determines whether the control is reliable. If the limits are only specified in prompts or proxy configurations, models may misinterpret the rules, and third-party tools might be able to bypass them. By placing the constraints on the server that actually executes the transactions, every instruction must pass through the same set of checks before entering an order. Agents cannot increase the limits or resume transactions on their own. The proxy is responsible for proposing actions, while the platform retains the final authority to execute them.

Three different restrictions block various forms of loss of control.

Single transaction limits control the maximum loss per error. For example, if a user sets the limit for each transaction to $100, even if the agent generates larger orders, they cannot be executed. The 24-hour total limit addresses another type of risk: the model may break down a target into many small transactions, each of which complies with the limit, but the cumulative amount far exceeds the user's expectations. Only by tracking the total amount over a rolling window can the platform prevent this situation where "no single transaction exceeds the limit, but the total gets out of control."

Automatically stop using the portfolio decline threshold. The example given by Coinbase is to set it at 5%. When the portfolio's decline exceeds this threshold, the agent stops placing orders until the user re-enables it within the application. It is not a guarantee against losses: rapid price fluctuations, slippage, and delays in order execution may still result in actual losses exceeding the trigger point. It is more like a circuit breaker that forces the decision-making back to humans before the anomaly continues to expand.

The upcoming product permissions will allow users to choose whether an agent can trade categories such as crypto assets, stocks, and derivatives. The leverage, trading hours, and clearing rules vary greatly between different products, and a mere amount limit cannot fully reflect all risk preferences. It is clearer to default high-risk categories to closed status and then allow users to enable them actively, rather than letting the agent decide for itself whether it is suitable this time or not.

Limited protection for transactions, yet no model-based judgment is provided.

Coinbase clearly reminds in the announcement that there may be errors or failures with the AI agent, and users still bear the risk for transactions executed by the agent and data used by third-party AI providers. Server limits can prevent orders that exceed boundaries, but they cannot guarantee that every transaction within those boundaries is reasonable, nor can they verify whether the information referenced by the model is correct. A $100 error is still an error; it's just that the loss is kept within a controllable range.

The data paths are also worth looking at separately. Coinbase for Agents Connects research, strategies, and transactions to the agents selected by users through MCP. Transaction control is managed by the Coinbase account, which is protected by passwords and two-factor authentication; at the same time, the positions, intentions, or context sent to third parties AI may be subject to a different set of privacy policies. Users need to distinguish between "who can place orders" and "who sees what"; these are not the same set of permissions.

The authority to set limits remains with the Coinbase application or webpage, rather than being modified within the chat with the intelligent agent, which is an important form of isolation. The ideal process should also allow users to clearly see the current limit, remaining quota, trigger records, and the reasons for rejected orders. If the intelligent agent simply returns a message saying "Transaction failed," it is difficult for users to determine whether the issue is related to market conditions, permission issues, or the activation of risk control measures. Expllicable rejections are part of building trust in the proxy trading process.

Proxy finance begins to cede its place to execution layer rules for prompts.

In the past, many discussions about agent security focused on how to write prompts and how to make models “remember not to do certain things.” However, when funds are involved, reliable boundaries must be implemented at an execution level that models cannot modify. Single-transaction limits, cumulative limits, product whitelists, and manual recovery mechanisms are all controls familiar from traditional payment and transaction systems; they are now simply re-applied at the entry points for intelligent agents.

This also provides a reusable structure for other proxy products: models can be planned, and tools can be executed, but high-cost and irreversible actions must go through an independent policy engine; after an exception is triggered, the process stops by default, rather than allowing the same model to decide whether to continue on its own. Coinbase This time, it did not eliminate the risk of agent transactions; instead, it changed "trust in model self-discipline" to "server-enforced boundaries." It is only when AI begins to deal with real assets and control shifts from the dialog box to the execution gate that the product truly takes a leap forward.