Every activation passes a gate the broker defines

Why do risk limits fail in practice?

Because they are implemented inside strategy logic, where a defect can place an order no rule would have permitted, or left to discretion, where they can be overridden in the moment. A limit that can be bypassed is a preference rather than a control.

The structural fix is to make the check a separate stage every order passes through. Placed there, the limits hold regardless of what a strategy requested and regardless of how a bad afternoon is going. That placement is the whole of the design.

What does the platform gate on?

Four families of control: exposure, loss, readiness and lifecycle. Each is evaluated before an order is eligible to route, and a rejection carries a stated reason rather than a silent adjustment.

A silent adjustment is worse than a refusal. A strategy that asked for a size it could not have and received a smaller one without being told is a strategy whose behaviour no longer matches its specification, and the divergence surfaces later as a result nobody can explain.

The four control families

Readiness is the family most often omitted elsewhere, and the one that stops a strategy evaluating on stale prices.

What does the broker control plane expose?

Strategy approvals with rejection context; risk and exposure by client, strategy, symbol and segment; remote API credentials with scopes, limits and IP allowlists; controlled egress assignment; F&O HALT-NEW controls; order monitoring, latency and exceptions; and role-based access with tenant isolation.

Module availability depends on tenant configuration, plan entitlements, connector readiness and deployment policy. This is a configurable control plane rather than a fixed one, and what a given broker sees is what that broker's deployment enables.

How does an emergency stop work?

HALT-NEW blocks new F&O exposure while preserving safety-critical processing. It can apply globally, per tenant or per strategy, and it fails closed if its state cannot be verified, expiry handling, fill processing, reconciliation and eligible exit workflows continue to run.

Failing closed is the property that matters. A kill switch that cannot confirm its own state and therefore permits new entries is not a kill switch. And keeping exits available while entries are blocked is the correct asymmetry: a system that can enter but not exit accumulates risk with no way to shed it, which is the one failure mode that must never be permitted.

HALT-NEW and the other controls improve discipline and incident response. They cannot prevent all losses, gaps or execution risk, and nothing on this page suggests they can.

What does governance leave behind?

Connected audit evidence: who approved what, on what grounds, what was rejected and why, what exposure resulted, and what an order's path through the checks looked like.

The useful test of an audit trail is whether it lets somebody investigate why an order was allowed, blocked, filled, rejected or paused, after the fact, without the person who built the strategy in the room. Under NSE/INVG/67858 of 5 May 2025 that record has to be available for at least five years and must identify the actual user and user ID behind each order rather than a shared service account.