The Risk Stack — defense in depth for automated trading
Every layer of this platform assumes the layer above it can fail. Strategies can be wrong, regimes can flip, feeds can stale — so risk is not one stop-loss but a stack of independent circuit breakers, each anchored to a different measurement, each able to fire alone. This is the operator's manual for all of them.
The philosophy: independent anchors
A single stop-loss has a single failure mode. The stack works because each layer is anchored to a different measurement — dollars, size, entry distance, market structure, per-leg PnL, account totals — so no one bad input can blind all of them. Whichever fires first wins, exits are never blocked by any filter, and every layer is kill-switched independently so you always know exactly what is armed.
The full stack, layer by layer
| Layer | Anchor | Action when hit |
|---|---|---|
| Volatility brake / momentum guard | Realized σ, short-term drift | Pull quotes / withhold the exposed side — before risk exists. |
| Direction gates 📈 🧭 🌋 | Indicators, regime, lifecycle evidence | Block opening against the call; never block exits. |
| Hard inventory limit | Position size (lots) | Taker-flatten + cool-off. Size itself is the risk. |
| Inventory stop-loss % | Distance from your average entry | Flatten the book; a busted average is a busted thesis. |
| 4H structural stop | Previous completed 4H candle ± buffer | Flatten; the market's structure — not your entry — said stop. |
| 🛟 Rescue trigger / ceiling | Per-leg unrealized USDT | Pause adds → income-funded reduce → force-flatten at 2×. |
| Session loss stop | Session realized+unrealized USDT | Flatten everything in the session and halt it. |
| Daily cap / kill switch | Account-level totals / operator | Stop all trading. The floor under everything. |
Session loss stop — the one that matters most
Every desk session carries a hard dollar floor. The moment a session's total PnL (realized plus unrealized, marked against live prices) touches your limit, the desk cancels its orders, flattens its positions and halts — no averaging through it, no "one more cycle." It is the layer we recommend configuring first, because it is the only one denominated in the unit you actually care about: money. Strategy sessions are lifecycle-linked to their deployments, so stopping a strategy stops its trading — there is no such thing as an orphaned session quietly placing orders.
The 4H structural stop
Entry-relative stops answer "how much am I willing to lose"; structural stops answer "at what price is the idea disproven." The 4H structural stop exits longs below the previous completed 4-hour candle's low (shorts above its high) by a configurable buffer — the classic swing-trader invalidation, automated. On a fresh 4H candle the level re-anchors; if structure data is temporarily unavailable the desk holds the last known level rather than trading unprotected — stale beats none, and none never silently happens.
Rescue governors & cool-offs
The 🛟 rescue governor (full mechanics in the MM guide; adopted per-side by Grid Strike) is the stack's most distinctive layer: a trapped side stops adding, the healthy side's realized profits fund reduce-only trims of the trapped leg, and a hard 2× ceiling caps the experiment. Cool-offs everywhere follow the same logic as a casino leaving the table: after any forced exit, the desk waits — because the conditions that forced the exit are usually still present.
Exchange truth & reconciliation
Sizing guidance
Rules of thumb we use ourselves: session loss stop ≈ 1–2% of the capital allocated to that session; rescue trigger ≈ 1.5–2% of a full leg's notional; soft inventory ≈ 3 lots per book on movers; and leverage low enough that the structural stop — not the liquidation price — is always the binding constraint. If liquidation is closer than your stop, you are not trading a strategy, you are donating to the insurance fund.
FAQ
Do the direction gates ever block an exit?
Never. Gates constrain opening risk only; every exit path — TPs, stops, rescue reductions, session flattens — ignores them by construction.
What happens if two layers fire at once?
Whichever action is more conservative wins — a flatten outranks a pause, a halt outranks a flatten. Layers compose; they never deadlock.
Is any of this optional?
Each layer has its own kill switch, and the platform ships with conservative defaults. What is not optional is visibility: an armed layer shows its state on the desk, and a fired layer says so in the session log.
Related guides
Armed, visible, layered
Every layer described here ships in the terminal — try the full stack on paper, free.