Owner limits

You set the limits when a session starts. Your agent can tighten them and can never raise them. These are limits you set; losses are still possible.

The model

Pick a preset at session start. Standard is the default.
Inside a session the only change is tighten. There is no loosen call, no setter and no environment override.
No MCP tool can set, raise or clear a limit.
Loosening past a preset needs acknowledge_loosened_limits, and the receipt then records loosened: true.

Presets

Limit	Conservative	Standard	Pro	Hard ceiling
Max leverage	3x	5x	10x	Per-coin max
Per-order cap	$10k	$25k	$250k	20% of depth
Daily stop	3%	5%	10%	25%
Open positions	3	5	15	50
Max slippage	25 bps	50 bps	100 bps	300 bps
Order rate	2/s	5/s	10/s	10/s

import { GuardSession } from "@perpbrain/sdk";

const session = GuardSession.fromConfig("standard");   // default

Depth and leverage

The per-order cap is the lesser of the preset dollar amount and 20% of visible book depth inside the slippage cap. Effective leverage is the lesser of the preset and Hyperliquid's per-coin max, halved for coins outside the top 20 by open interest.

Closing is always allowed

Stale data, the daily stop and the kill switch only block new risk. A close or reduce always goes through.

Rule	Blocks	Code
Data older than 2s	New opens	`stale_data`
Data older than 5s	All new risk (halt)	`stale_halt`
Daily stop reached	Opens until 00:00 UTC (reduce-only)	`daily_stop_reduce_only`
Kill switch latched	Opens until owner config changes and the session restarts	`kill_switch`

Kill switch

A tool call can engage it with trigger_kill_switch. Nothing inside the session can clear it. It clears only when you change the owner config and restart. A restart with the same config keeps the latch.

Block codes

A blocked simulated order raises GUARD_BLOCKED:<CODE> with the headroom left: coin_not_allowed, notional_exceeded, aggregate_notional, depth_cap, leverage_exceeded, open_positions_exceeded, daily_stop_reduce_only, slippage_exceeded, order_rate, stale_data, stale_halt, kill_switch.

On the receipt

Each run records guard_preset, limits, effective_limits_per_coin, loosened, limits_hash and market_snapshot_id, so anyone checking the receipt can see exactly which limits applied.