Why Trading Desks Need Runtime Governance, Not Just AI Policy
Energy trading desks are deploying AI agents to support market data analysis, trade execution, risk monitoring, and settlement workflows. These agents differ from earlier automated trading systems because they can interpret open-ended instructions, call external tools and data sources, and take multi-step actions with limited human review at each step. The identity and access models built for human traders and static service accounts were not designed to verify an AI agent's identity at the moment it invokes a tool, nor to constrain what that agent can do once it has access to a workflow. NIST's AI Risk Management Framework establishes Govern, Map, Measure, and Manage functions intended to structure accountability for AI systems, and NIST's Generative AI Profile specifically flags the risk of AI systems taking action beyond their intended scope. For a trading desk, that risk translates directly into unauthorized orders, unreviewed risk exposure, or settlement actions taken without a clear chain of accountability. Written AI policy does not address this exposure on its own. Governance has to be enforced at runtime, at the point where an agent attempts to act, not only documented in advance.
Risks AI Agents Introduce on a Trading Desk
- Unverified agent identity: agents often inherit broad service-account credentials, making it difficult to distinguish an agent's actions from a human trader's or another system's.
- Overprivileged tool access: OWASP guidance for agentic AI applications identifies excessive agency and insecure tool design as leading risk categories for systems that act autonomously.
- Unmonitored agent-to-tool connections: protocols such as Model Context Protocol create a new trust boundary between agents and trading systems that requires explicit control, not implicit trust.
- Insufficient audit evidence: logs that record only an action's outcome, without the decision context behind it, are not sufficient to reconstruct why an agent acted during risk review.
- No agent-specific regulatory framework: no AI-agent-specific trading regulation currently exists, leaving desks to apply analogous controls from algorithmic-trading and cybersecurity frameworks as a baseline.
Tool-Call Governance and the MCP Trust Boundary
Model Context Protocol, released by Anthropic in late 2024 as an open standard for connecting AI agents to external tools and data sources, is increasingly used to give agents access to market data, order systems, and settlement platforms. Security researchers and OWASP have documented MCP-specific risks through 2025, including overprivileged tool access, insufficient granular audit trails, and injection risks introduced through tool or resource descriptions. For a trading desk, each MCP or equivalent tool connector should be treated as a discrete security boundary rather than an extension of the underlying model's trust. That means allow-listing which tool servers an agent may connect to, validating the schema of each tool call before execution, and monitoring connector activity independently of the model itself. Tool-call governance of this kind should integrate with existing pre-trade risk controls, such as position and order-size limits already required under frameworks like the SEC's Market Access Rule, rather than operating as a disconnected, parallel control layer.
Implementation Considerations Before Granting Agent Autonomy
- Map existing desk systems and workflows, including market data feeds, order management, and settlement, before assigning any agent permission scope.
- Integrate runtime policy enforcement with existing pre-trade risk controls instead of building a separate, disconnected enforcement layer.
- Align audit log retention and format with existing trading record-keeping obligations rather than creating a non-interoperable evidence store.
- Test agent behavior against adversarial and prompt-injection scenarios, referencing frameworks such as MITRE ATLAS, before production rollout.
- Coordinate agent deployment review with teams responsible for NERC CIP or equivalent infrastructure-security compliance where agents touch operational energy data.