AI Agents in the Market: Tool, Trader, or Transmission Mechanism?

Artificial intelligence enters a trading system in three analytically distinct roles. As a tool it produces information for another decision-maker. As a trader its output can change orders within delegated limits. As a transmission mechanism it becomes a channel through which many firms behave alike. The three differ in one variable, which is who holds authority to act, and Figure 1 draws where that authority sits.

Figure 2 asks what the third role costs, and returns an answer sharper than the usual worry about model concentration. With genuinely independent controls, a market in which every firm runs the same model produced no systemic event at all in 200,000 simulated periods. It is the independence of the controls, not the diversity of the models, that moves the tail.

Section 01Three framings, one variable

The tool and trader framings can be separated by authority alone. If a human or a separate system decides whether to act on the output, the model is a tool. If the output can alter live orders within delegated limits, it is a trader, whatever the internal documentation calls it. The distinction is about the wiring rather than about the sophistication of the model.

The current practitioner evidence is cautious. The Financial Markets Standards Board reported in February 2026 that advanced AI in wholesale trading remained at a relatively early stage of deployment, concentrated in support and analytical functions rather than in autonomous execution. That is a description of a moment and should not be read as a permanent account.

Section 02The control boundary

Figure 1 makes one reference architecture explicit. A proposing model feeds a separately owned risk gate. The gate checks hard limits and market-access controls. The router executes within its own tolerances, and every step writes to a record that can be reconstructed afterwards.

The invariant is not the particular diagram but the separation of concerns. The component proposing an action should not be the sole authority defining, applying and waiving its own limits. Capability can widen the set of admissible proposals; it does not remove the need to say who grants authority, under which limits, and with what evidence.

Supervisors have converged on much the same list. ESMA's February 2026 supervisory briefing on algorithmic trading covers governance, testing, outsourcing and pre-trade controls. The AFM's April 2026 exploratory work on AI in capital markets raises accountability, auditability and the consequences of common inputs. Neither is binding and both describe the same boundary.

Section 03What correlated authority costs

Figure 2 states the transmission question as arithmetic. Five hundred firms, each running a model that produces a materially wrong signal two per cent of the time, each with a control that blocks a wrong signal nine times in ten. A share of firms use a common model, whose errors arrive simultaneously. The parameter that varies across the three lines is how much of each control's blocking power is common-mode: how far the control shares the assumptions of the model it is supposed to check.

With fully independent controls, the outcome was never observed. Across 200,000 simulated periods at a common-model share of 100 per cent, a quarter of the market did not once act on a wrong signal in the same period, which bounds the per-period frequency at about 1.5 in 100,000 rather than establishing that it is zero. The common model is a single point of failure, and nine independent checks in ten are enough to stop it becoming a systemic one.

Once controls are half common-mode, the same probability crosses a measurable threshold at a common-model share of 45 per cent. Once they are fully common-mode, at 25 per cent, and it then rises to the model's own error rate, because at that point the control has stopped being a control.

The policy reading is narrower than reassurance about concentration. Model share and control independence are different variables, and the second is the one worth measuring. A market with one dominant model and genuinely separate controls behaves differently from a market with three models whose risk gates were all trained on the same data by the same vendors, and the second is easier to arrive at without noticing.

treat the right-hand side of the boundary as invariants the proposing
model cannot relax:

    hard pre-trade limits      independently owned, not model-adjustable
    market-access controls     enforced outside the proposing system
    records                    source data, model and policy version,
                               rationale, and the resulting order
    kill authority             exercisable without the model's cooperation

the scenario in Figure 2, stated in full:

    M = 500 firms      model error e = 0.02      control blocks c = 0.90
    rho = share of blocking power that is common-mode with the model
    threshold = 25% of firms acting wrongly in the same period
    200,000 periods per point, NumPy PCG64 seeded 20260601

    rho = 0.0   not observed at any share (0 of 200,000 draws per point)
    rho = 0.5   crosses at a 45% share
    rho = 1.0   crosses at a 25% share, then rises to the model's error rate

Section 04Governance as engineering

Read this way, governance stops being principles posted on a wall and becomes a question about where the boundary is drawn and how well the right-hand side is built. The engineering implications are concrete: hard pre-trade limits independently owned and difficult for the proposing model to circumvent; records preserving source data, model and policy version, rationale and resulting order; and the ability to stop the system without its cooperation.

Even a perfectly governed firm can be one node in a badly correlated system.

The transmission problem cannot be solved by architecture inside one firm, which is the uncomfortable part. The Financial Stability Board identifies third-party concentration, market correlation, cyber risk and model risk as system-wide channels, and the quantity that determines whether they bind, the share of firms sharing a dependency, is invisible from inside any of them. Issue 010 makes the same point about infrastructure with the same kind of arithmetic.

This rejoins the crowded-signal problem of Issue 017 through common inputs rather than shared papers. Local controls govern what one system may do. System resilience depends on provider diversity, strategy heterogeneity, and whether the checks are genuinely independent of the things they check. Only the first of those three is easy to observe, and the scenario here suggests it is the least important of them.

This research is analysis and commentary for general information. It is not investment advice, legal or compliance advice, an offer, or a solicitation, and it contains no price forecasts. Figure 2 is simulated under declared parameters; regulatory and practitioner descriptions summarise the publications cited.