policy · receipts · track record

Governed agentic trading

Brokerages are opening to AI agents. Robinhood now lets any MCP agent read a portfolio and place real orders, and its safety model is a funded sub-account, a notification feed, and a disconnect button. There is no per-trade cap, no symbol allowlist, no daily-loss stop, and no audit a third party can check. The only limit on a looping agent is the account balance.

Noren is the layer that governs the order before it leaves. A policy the operator writes is enforced ahead of the venue, every decision, placed or refused, becomes a signed receipt (to be anchored on Robinhood Chain once the contracts are live), and the receipt history compounds into a track record an agent can prove to anyone.

The policy

Per-order and daily caps, an allow/deny universe, permitted sides and order types, rate limits, a daily-loss stop, and a human-approval threshold. Enforced before the order is sent, not observed after.

The receipt

Every decision is signed ed25519 over a canonical hash, refusals included, with onchain anchoring on Robinhood Chain coming soon. Change one field and verification fails. An activity feed inside a broker app can't do that.

The record

Receipts roll up into mandate adherence and activity: how often the gate had to refuse the agent, and what it actually did. A track record that travels between venues and can't be self-asserted.

The policy an operator writes

{
  "venue": "robinhood-crypto",
  "mode": "dry_run",
  "caps": { "per_order_usd": 500, "daily_notional_usd": 2000 },
  "risk": { "daily_loss_stop_usd": 300 },
  "universe": { "allow": ["BTC-USD", "ETH-USD"], "sides": ["buy"] },
  "order_types": ["market"],
  "rate": { "max_orders_per_min": 10 },
  "approvals": { "require_human_over_usd": 400 }
}

Coming soon on Robinhood Chain

Decisions anchored onchain

When the Noren contracts go live on Robinhood Chain (chain id 4663), each decision, placed or refused, will be anchored there so anyone can verify it. Nothing is anchored yet, so this page shows no transactions and no track record. The policy gate itself works today in dry run, as shown below.

An order that breaks a cap is refused before it leaves.
A symbol outside the allow list is refused.
An order over the approval line waits for a human.

What the gate decided · real output

This is the unedited output of the demo below, run against a mock broker with no credentials. Four orders went to the gate. One was allowed to proceed (as a dry run, nothing was sent) and three were refused, each with the reason and a receipt whose signature verified.

within policy (~$60)Executeddry run: not sentsignature verified

over per-order (~$1200)Blockedper-order cap exceeded (1200.00 > 500.00)signature verified

not in universe (DOGE)Blockedsymbol DOGE-USD is not on the allow listsignature verified

needs approval (~$450)Blockedapproval required and not grantedsignature verified

No order was placed and no account was touched. The gate is real code with real tests, and this run is a mock, not a live venue.

Run it · no keys, no account

The whole gate runs locally in dry-run with zero credentials, from the source tree (source repository: coming soon):

cd agent-os
cargo run -p noren-robinhood --example governed_demo

Live execution attaches your own API key on your own account, held in a signing sidecar the daemon never reads. Noren is infrastructure you run, not a broker, adviser, or custodian, and it never holds funds.

US beta testers wanted

We're extending the same gate to Robinhood's hosted agentic MCP, and that beta is US-only. If you're trading with an agent on it, we're looking for five testers to run the proxy and help pin down the connect flow. Write the contact form .

Noren is not affiliated with, endorsed by, or sponsored by Robinhood Markets, Inc. Nothing here is investment advice. Agentic trading involves significant risk.