Policy limits for AI agents: kill switch, caps and double checks

Limits that live outside the model, so the agent cannot argue with them

By Zypher Agent team | 29 October 2026

A language model can be persuaded, confused or fed hostile text. So the limits on what it may do cannot live in its prompt. In Zypher Agent they live in a policy file that the server reads again on every call. The model never sees a way to change it.

This note describes the main controls and what each one is for.

A kill switch and dry-run by default

One setting blocks all execution immediately, with no restart. Dry-run is also on by default, so a fresh setup simulates before it ever sends anything. Turning dry-run off is a deliberate step taken after testnet behaviour has been checked.

Caps on each action

Swaps are checked against limits such as a maximum amount of HYPE per swap and a maximum slippage. Perpetual orders have their own limits. Token launches are checked against policy bounds as well. A proposal that breaks a limit is rejected before you are asked to approve it.

Two checks and a single-use ticket

Policy is checked twice: when an action is prepared and again when it is executed. Over MCP, the agent holds only a confirmation ID that works once and expires after 120 seconds, and the parameters stay locked on the server. In the app, a proposal expires after 10 minutes and still needs your wallet approval.

Untrusted text and an audit trail

Text from outside, such as posts or token names, is wrapped and labelled as untrusted so it cannot pass as an instruction. Every tool call is written to an audit log. One caveat: the daily perpetual notional cap counts only executions made on the server side, not orders you approve in the browser.

About Zypher Agent

Zypher Agent is an agent-first app and MCP server for the Elysium and Hyperliquid testnets. An assistant reads markets and proposes actions; you approve each one in your own wallet, or enable the optional Agent Wallet so it can execute within your limits. Mainnet is not enabled.

This article is general information and not financial, legal or tax advice. Zypher Agent runs on testnets only, where tokens have no real value. Statements about how the product works describe its design; they are not a guarantee of any outcome.