D0 架构：构建知道何时不交易的 AI 代理

✍ Donut🕐 2026-04-16📦 11.7 KB 🟢 已读 𝕏 文章列表

文章探讨了在金融市场中构建 AI 交易代理的挑战，指出单纯提升模型智能度不足以保证安全，关键在于架构设计。作者提出了“受限自主性”的概念，并详细介绍了 D0 架构的四个核心层次：验证状态、类型化边界、约束层和闭环进化，旨在确保代理在处理真实资本时的安全性与有效性。

AI交易智能体架构设计风险控制 D0 LLM 金融科技系统安全

# How We Built a Trading Agent That Knows When Not to Trade **作者**: Donut **日期**: 2026-04-15T14:06:19.000Z **来源**: [https://x.com/DonutAI/status/2044417037238460766](https://x.com/DonutAI/status/2044417037238460766) --- ![Image](/doc/637/image/img_943b29bd728f.jpg) Why the next wave of AI trading won’t be won by the bot that sounds smartest, but by the system that knows when the model is wrong, uncertain, or not allowed to act. Everyone is racing to build smarter agents. In markets, that misses the point. The hard part is not getting an AI to generate a trade strategy, explain a chart, or sound convincing in a Telegram group. The hard part starts one step later, when the model has already made up its mind and now wants to touch real capital in a market that is adversarial, always moving, and completely indifferent to whether your architecture looked impressive in a demo. That is where most AI agent design breaks and that is exactly where D0 begins. A lot of people in AI still talk as if better models will automatically produce better autonomous systems. That is true in some low-stakes environments. If your coding copilot makes a bad suggestion, you reject it. If your writing assistant gets the tone wrong, you edit it. If your chatbot hallucinates, maybe you laugh, maybe you retry. Trading is different. In markets, mistakes do not sit politely in a chat window waiting for a human to clean them up. They become positions, losses, missed exits, liquidation risk, slippage, and a trail of bad decisions that the market happily compounds for you in real time. That is why markets are such a clean stress test for AI agents. They force you to separate what looks intelligent from what is actually safe, useful, and deployable. Financial markets run 24/7. They are noisy, hostile, fragmented, and full of false signals. They punish latency, ambiguity, and overconfidence. If an AI agent can operate well in that environment, it is because the entire system around the model was built to survive contact with reality. ## Not All Agents Are Created Equal This leads to a hot take that more people in AI should say out loud: most “autonomous agents” should never be allowed to trade. Now, say it again. Not because the models are dumb. In fact, the problem is almost the opposite. Frontier models are getting more capable, more persuasive, and more operationally useful. They can absorb more context, reason over more variables, and produce cleaner decisions than ever before. But that increase in capability does not automatically increase safety. In markets, smarter can also mean more dangerous. A stronger model with direct access to execution can simply make larger mistakes, faster, with better-written explanations. The industry tends to think about model progress in terms of what an agent can now do. We think the better frame for high-stakes systems is the tension between scope, fidelity, and containment. Scope is how much the agent is able to do. Fidelity is how closely the system tracks what the user actually meant. Containment is how tightly the system bounds damage when the model is wrong, compromised, or uncertain. Better models usually expand scope. They often improve fidelity too. But containment does not improve on the same curve, because containment is not just an intelligence problem. It is a systems problem, a security problem, and in player vs player domains it becomes an incentive problem too. That distinction matters. A model can understand a user’s intent better than last year’s model and still make a catastrophic decision because the world-facing layer gave it too much freedom. A model can produce a brilliant trading thesis and still fail if the execution path is ambiguous, under-specified, or insufficiently bounded. A model can even be directionally right and still lose money because it was allowed to size incorrectly, act on stale state, or ignore hidden risk limits. In other words, once an agent crosses from cognition into actuation, the bottleneck changes to what exactly is allowed to happen after the model reasons?” That is the core idea behind constrained autonomy. We do not see constraints as a weaker form of autonomy. In high-stakes systems, constraints are what make autonomy real. A useful agent is not one that is free to do anything. It is one that can think flexibly while remaining mechanically bounded when it comes time to act. The model should be free where flexibility creates value and constrained where freedom creates blow-up risk. That split sounds obvious once you say it plainly, but most agent design still treats the model as both the brain and the final authority. That works fine until the action surface becomes expensive. ## The D0 Architecture D0 is built around the belief that the real edge in agentic trading will come from architecture, not just model quality. The public version of that architecture compresses into four layers: verified state, typed boundary, constraint layer, and closed-loop evolution. Each layer exists because the one thing you cannot afford in financial markets is soft ambiguity pretending to be intelligence. Verified state means the model is not reasoning from vibes, stale chat context, or a giant memory blob pretending to be ground truth. It is reasoning from structured facts about the world right now: market state, balances, positions, recent execution outcomes, delegation level, and system risk state. This matters more than most people realize. Traders already know that a small mismatch in state can destroy an otherwise solid decision. AI builders should learn the same lesson that a model that reasons beautifully on bad state is not intelligent in practice. ![Image](/doc/637/image/img_bc61f5c320da.jpg) The D0 Architecture The typed boundary is where a lot of so-called autonomous systems quietly fail. Natural language is great for planning, explanation, hypothesis generation but it is a terrible execution interface. A model can think in language, but the system should not execute in language. If the model wants to express a trade, that intent should be translated into a typed action with explicit fields like asset, side, size, leverage, stop loss, take profit, and execution metadata. The moment real capital is involved, free-form output stops being elegant and starts being a bug. Traders understand this instinctively. You would never want an exchange API to interpret your vibes. The same should be true for agent execution. Then comes the constraint layer, constraints cannot live only inside the model. If they do, they are not really constraints. They are preferences. Real constraints live outside the reasoning path, where they can validate, refuse, suspend, or reroute actions before those actions hit the market. This is where policy becomes real. This is where risk logic matters more than rhetoric. And this is where the system earns the right to be trusted. In a high-stakes environment, a good architecture is one that remains safe even when the model is wrong. The last layer is closed-loop evolution. In the real world, what matters is not what the model intended. What matters is what actually happened. Did the order fill? At what price? Under what volatility regime? What did the market do next? What changed in portfolio state? How should that update the system’s future behavior? If verified outcomes do not flow back into the next cycle, the agent is not really learning from reality. It is just reenacting the same reasoning theater on top of a changing market. Underneath those four layers sit two design choices that matter a lot. The first is path separation. Research can be probabilistic and degradable. An LLM can summarize, weigh weak evidence, and say it needs more data. That is acceptable on the research path because a bad summary degrades analysis quality, not capital. Execution is different. Anything that can move money needs to be typed, validated, and independently verifiable. The second is role separation. The model plans. Infrastructure normalizes. The constraint layer adjudicates. The executor executes. The recorder captures what happened. This separation is what allows the system to improve as models improve without turning every model gain into a larger blast radius. ## This Is Where Intelligence Stops Being Enough This is also where we think the next real debate in AI should be. For the last two years, the center of gravity has been reasoning quality, agent loops, and tool use. All of that matters. But the next wave of real-world agents will be defined less by whether they can complete a benchmark and more by whether they can operate inside hard boundaries without becoming useless. That is the actual design challenge. Not maximum autonomy but create useful autonomy, with limited tool access, and controlled execution. Not a model that always says something impressive. A system that knows what it is allowed to do, what it must verify, and when it should refuse. For traders, this matters because the future interface to markets will not be another dashboard with more indicators crammed onto the screen. It will be an agent layer that monitors, reasons, filters, proposes, and, under the right constraints, acts. But that future only works if the architecture is built for trust from day one. Nobody serious wants an AI that sounds like a genius and trades like a gambler. The product has to make money management, risk control, and execution discipline feel native, not bolted on after the demo. For AI enthusiasts, the lesson is broader than trading. Markets simply expose the truth faster. Once an AI system can trigger irreversible consequences, the old mental model of “just give it more intelligence” stops being enough. Autonomy becomes a systems question. The interesting frontier is no longer model-only. It is the interface between reasoning and the world. That interface is where real product differentiation will come from, and it is where most of the field is still underbuilt. Our view is simple: the winners in agentic trading will not be the teams that ship the flashiest agent first. They will be the teams that build agents people are actually willing to trust with live capital. That means verified state instead of synthetic confidence. Typed actions instead of natural-language execution. Hard constraints instead of polite model instructions. Real feedback loops instead of static demos. In short, it means building autonomy that can survive reality. That is the bet behind D0. It’s not just a chatbot that talks about markets and it’s not a copilot that leaves all the hard parts to the user. D0 is a personal agentic trading system built for the financial internet as it actually is: fast, noisy, hostile, and unforgiving. If that sounds like the direction you’ve been waiting for, join the D0 waitlist. Also, check out: getdonut.ai for more information If you want to read more about Constrained Autonomy, check out our tech technical blog on the matter by our Chief Scientist @trorooro : https://getdonut.ai/blog/constrained-autonomy/ ## 相关链接 - [Donut](https://x.com/DonutAI) - [@DonutAI](https://x.com/DonutAI) - [103K](https://x.com/DonutAI/status/2044417037238460766/analytics) - [join the D0 waitlist.](https://forms.donutbrowser.ai/d0) - [getdonut.ai](https://getdonut.ai/) - [@trorooro](https://x.com/@trorooro) - [https://getdonut.ai/blog/constrained-autonomy/](https://getdonut.ai/blog/constrained-autonomy/) - [Upgrade to Premium](https://x.com/i/premium_sign_up) - [10:06 PM · Apr 15, 2026](https://x.com/DonutAI/status/2044417037238460766) - [103.2K Views](https://x.com/DonutAI/status/2044417037238460766/analytics) - [View quotes](https://x.com/DonutAI/status/2044417037238460766/quotes) --- *导出时间: 2026/4/16 15:51:24*

🔗 相关文档