Coinbase says it has added Agent Controls to Coinbase for Agents, the product that connects outside AI assistants to a Coinbase account. Per Bankless, the controls went live on Nov. 11 and cap what an agent can do from the exchange's side of the wire. The take: the interesting part isn't the three limits. It's *where* they live.
What Coinbase says shipped
Bankless names ChatGPT, Claude, and Grok as the assistants Coinbase for Agents connects to a Coinbase account. Agent Controls adds three limits:
- ▸A dollar ceiling per trade. One order can't exceed the number you set.
- ▸A cap on total trading over 24 hours. A rolling volume limit, not just a per-order one.
- ▸An auto-stop on portfolio drop. If the portfolio falls past a percentage you choose, the agent is paused. Per the report, trading stays off until the user turns it back on manually.
A fourth control, product permissions, would let users choose whether an agent can trade crypto, equities, or derivatives. Bankless lists it as "coming soon" with no date. Treat it as announced, not shipped.
Why "server-side" is the whole story
Coinbase says the limits are enforced on its servers and the agent cannot edit them. The settings sit in the Coinbase app and website behind the user's password and two-factor login. An agent can point you at the controls; it can't change them.
That is the line between a *guardrail* and a *suggestion*. A limit written into a system prompt is a request the model may or may not honor on a bad day. A limit enforced by the venue is a rule the model never gets a vote on. If your agent can move funds, "please stay under $500" belongs in the second category.
This is the same design pattern builders keep rediscovering across the stack:
- ▸The policy lives outside the agent. Whoever holds the funds enforces the limits, not the thing being limited.
- ▸The change path is separate from the agent path. Raising a limit needs a credential the agent never holds.
- ▸Failure mode is "stop," not "continue." The auto-stop pauses trading and waits for a human.
Smart-contract wallets with spend limits, session keys, and policy engines on the wallet side are the onchain cousins of this idea. Coinbase's version is the custodial one: the exchange is the policy engine.
What's claimed, and what isn't shown
Fair is fair. Everything above is Coinbase's description of its own product, relayed by Bankless. A few things worth keeping straight:
- ▸Enforcement is claimed, not independently verified. We haven't seen an outside test of whether the limits hold under every order type. The announcement is the evidence so far.
- ▸The limits are dollar and percentage caps. They bound the *size* of a loss or a runaway loop. They say nothing about whether the agent's decisions are any good.
- ▸Scope is Coinbase's venue. These controls govern an agent acting through Coinbase for Agents. They don't follow an agent to other venues, wallets, or chains.
- ▸Product permissions aren't live yet. Until they are, the stated controls cover size and volume, not which asset classes an agent can touch.
Bankless also notes that when Coinbase for Agents launched in June, the company said exact rules such as trade-size limits would come soon, and that the product has since added thousands of stocks, perps, and Deribit derivatives. Read that as: the surface an agent can trade grew first, and the brakes arrived after. That's a common order of operations. It's also why the brakes deserve scrutiny now.
Coinbase executive Shan Aggarwal described guardrails like these as how people get comfortable connecting AI to their money. Comfort is a feeling. Limits are a mechanism. Builders should want the mechanism.
What builders can take from it
If you're building an agent that touches funds, steal the pattern rather than the product:
1. Put limits where the agent can't write. Venue-side, wallet-side, or contract-side, never prompt-side. 2. Set three numbers before you set anything else: max per action, max per window, and a drawdown stop. 3. Make resuming a human act. An auto-stop an agent can clear itself is a speed bump. 4. Say what your limits don't cover. Size caps aren't a quality guarantee.
Mapping which wallets, payment rails, and MCPs expose that kind of enforcement is the sort of thing the Sato library tracks, so you can pick a stack by what it actually enforces. Describe the agent at satohub.ai/build and Sato maps the stack.
What to watch
- ▸Product permissions. When (and if) the crypto / equities / derivatives switch ships, and whether it's per-agent or account-wide.
- ▸Other venues. Whether exchanges and wallet providers copy server-side limits, and whether they publish how enforcement works.
- ▸Outside verification. Anyone reproducing the limits against real order flow would turn a claim into evidence.
- ▸The reset path. How cleanly a human re-enables trading after an auto-stop, and what the agent is allowed to see about it.
Agents getting real brakes is good news for the category. Now show the receipts.