SDD Specification: Robinhood Agentic Trading & Credit Card System v1.0

Anh Nguyen

— 4 min read
Share

1. Purpose & Scope

Mission:
Enable AI agents to autonomously trade equities and make credit card purchases on behalf of Robinhood users within explicitly governed boundaries.

In-Scope:

  • Portfolio analysis and concentration risk assessment
  • Equity trade execution within dedicated agent account
  • Credit card purchases via virtual agentic card
  • Analyst note research and opportunity identification
  • Fraud detection and dispute resolution support

Out-of-Scope (Negative Requirements):

  • No access to primary portfolio or main account
  • No trading options, crypto, futures without explicit future authorization
  • No access to primary credit card details
  • No autonomous execution above user-defined spending limits
  • No override of user approval requirements
  • No trade execution without pre-loaded balance verification
  • No external data sources outside Robinhood MCP allowlist

2. Multi-Agent Architecture

Tier 3 — Supervisor Agent: Governance & Compliance Overseer

  • Monitors all agent activity across the system
  • Enforces spending limits and trading boundaries
  • Triggers circuit breakers on anomalous behavior
  • Cannot be instructed by any worker agent
  • Generates immutable audit trail

Tier 2 — Orchestrator Agent: Trading Workflow Coordinator

  • Receives user trading goals
  • Assigns subtasks to worker agents
  • Tracks state across multi-step workflows
  • Enforces maximum workflow steps
  • Routes escalations to human supervisor

Tier 1 — Worker Agents (four specialized agents):

Research Agent:

  • Reads analyst notes and market data
  • Analyzes concentration risk and sector exposure
  • May only read — cannot execute trades
  • Outputs structured research summaries only

Portfolio Analysis Agent:

  • Reads dedicated agent account only
  • Analyzes holdings, P&L, exposure
  • Cannot access primary portfolio
  • Outputs rebalancing recommendations only

Trade Execution Agent:

  • Executes approved equity trades only
  • Verifies pre-loaded balance before every execution
  • Cannot exceed per-trade limit defined in user preferences
  • Must show trade preview for user approval above threshold
  • Cannot execute if fraud flag is active

Payment Agent:

  • Executes purchases via virtual agentic card only
  • Enforces monthly spending ceiling per user setting
  • Seeks approval per transaction if user enabled this setting
  • Cannot access primary Gold Card details
  • Cannot execute if monthly limit is reached

3. Agent Communication Rules

  • All inter-agent communication routed through Orchestrator
  • Research Agent → Portfolio Analysis Agent: read-only data passing
  • Portfolio Analysis Agent → Trade Execution Agent: recommendations only, not instructions
  • No agent may instruct Governance Overseer
  • All inter-agent messages logged with sender, receiver, content, timestamp
  • Maximum agent exchange depth: 5 hops before human escalation

4. Delegation Lifecycle

Delegation starts when:

  • User explicitly activates agent session
  • Pre-loaded balance verified
  • Spending limits confirmed
  • User approval preferences confirmed

Delegation ends when:

  • Trade executed and confirmed
  • Spending limit reached
  • Session timeout exceeded
  • User explicitly disconnects agent
  • Fraud flag triggered
  • Circuit breaker activated

Delegation rules:

  • Each delegation is task-scoped, not session-scoped
  • No residual authority after task completion
  • Research Agent cannot delegate to Trade Execution Agent directly
  • All delegation changes logged before execution

5. TCO-AI Requirements

T — Testability:

  • Golden scenarios: portfolio rebalance, single equity purchase, credit card payment
  • Negative scenarios: attempt to access primary portfolio, exceed spending limit, trade unauthorized instrument
  • Deterministic test mode required
  • Every trade must produce verifiable evidence artifact
  • Fraud detection must trigger in test scenarios

C — Controllability:

  • Dependency Injection for all tools — no self-created capabilities
  • Allowlisted tools: Robinhood Trading MCP, Robinhood Banking MCP, Analyst Notes API
  • Denylisted: primary portfolio API, primary card API, external payment processors
  • Hard spending ceiling per agent card — not overridable by any agent
  • Hard trade size limit per execution
  • One-tap kill switch must halt all agent activity within 3 seconds
  • Retry ceiling: maximum 3 retries per failed trade before escalation

O — Observability:

  • Push notification for every agent-initiated trade
  • Real-time activity log visible in Robinhood app
  • Reasoning trace for every trade recommendation
  • Tool-use trace: which MCP server called, with what parameters, why
  • Intent log: what the agent believed it was doing at each step
  • Fraud detection event log
  • Cost/spend tracking per session

6. Human-AI Operating Contract

User CAN:

  • Set spending limits and trading boundaries
  • Enable/disable per-transaction approval
  • Disconnect agent instantly via kill switch
  • Review full activity log
  • Dispute any agent-initiated transaction

User CANNOT:

  • Grant agent access to primary portfolio
  • Override fraud detection flags unilaterally
  • Disable Governance Overseer monitoring

User MUST trust the agent:

  • Routine equity purchases within pre-approved strategy
  • Research and analysis outputs within known parameters
  • Credit card purchases below approval threshold

User MUST NOT trust the agent:

  • First-time trading strategy outside historical parameters
  • Unusual market conditions (high volatility, circuit breakers)
  • Any trade flagged by fraud detection
  • Purchases near monthly spending ceiling

User MUST approve:

  • Trades above per-trade approval threshold
  • New trading strategies outside original mandate
  • Any transaction flagged as suspicious

Human-only authority:

  • Dispute resolution with Robinhood fraud team
  • Permanent disconnection of agent
  • Increase of spending limits beyond initial setting
  • Authorization of new instrument types (options, crypto — future)

7. Privilege and Escalation Rules

No autonomous privilege escalation:

  • Trade Execution Agent cannot request access to primary portfolio
  • Payment Agent cannot request primary card access
  • No agent can grant another agent authority it doesn't possess
  • All escalation requests route to human user via push notification

Escalation triggers:

  • Trade size exceeds approval threshold
  • Monthly spending limit within 20% of ceiling
  • Fraud detection flag activated
  • Agent loop detected — same trade attempted 3 times
  • Market conditions outside normal parameters
  • Confidence score below defined threshold

8. Loop Prevention and Cost Governance

  • Maximum reasoning steps per trading workflow: 10
  • Maximum agent-to-agent exchanges: 5
  • Similarity detection: if same trade proposed twice, escalate not execute
  • Token budget per trading session: defined ceiling
  • Automatic session shutdown if compute budget exceeded
  • Cost anomaly alert: >200% of baseline session spend triggers review

9. Safety Invariants (Hard Rules — Never Violated)

The system MUST NEVER:

  • Access primary portfolio or main account balance
  • Execute trade without pre-loaded balance verification
  • Execute purchase above monthly virtual card limit
  • Override active fraud detection flag
  • Continue operating after kill switch activated
  • Trade instruments not currently authorized (options, crypto until enabled)
  • Pass primary card credentials to any agent
  • Execute irreversible transaction without user approval above threshold
  • Allow any agent to modify audit trail

10. Multi-Modal Conflict Resolution

When research signal conflicts with portfolio analysis:

  • Conservative action wins — smaller position or no trade
  • Conflict logged and presented to user for decision
  • No autonomous resolution of conflicting signals above materiality threshold

When fraud detection conflicts with trade execution:

  • Fraud detection always wins
  • Trade suspended pending human review
  • User notified immediately

11. Acceptance Criteria

System is compliant when:

  • All TCO-AI requirements verified
  • Golden test scenarios pass
  • Kill switch halts all activity within 3 seconds
  • Spending limits enforce automatically without override
  • Fraud detection triggers correctly in test scenarios
  • No agent accesses primary portfolio or card in any test
  • All inter-agent communications logged
  • Loop detection triggers correctly
  • Human approval gates fire at correct thresholds
  • Audit trail is immutable and complete

12. Key Governance Gap Robinhood's Own Disclaimer Exposes

Robinhood states: "AI agents can make errors, misinterpret instructions, act on incomplete or outdated information, and may behave in unexpected ways. Robinhood does not control, supervise, monitor, recommend, or audit these AI agents."

Translation: Robinhood built the infrastructure. This SDD is the governance layer they didn't write.

Every enterprise connecting third-party agents to Robinhood needs exactly this specification before deployment.

Read more