The risk desk gives you a live view of the two independent layers that protect your capital while your agent is running. Every time one of those layers blocks a trade — whether the Risk Engine decided the order would breach a rule, or the TWAK signing layer refused to sign it — the risk desk surfaces the event in real time. You do not need to manufacture a test scenario to see these layers work: set a tight daily drawdown cap and your agent will produce genuine block events during normal operation.
The two-layer defense
Halyrd’s risk system is built from two layers that are deliberately independent of each other. Understanding the distinction helps you interpret what you see on this screen.
Policy layer — the Risk Engine asks: “Should we make this trade?” It lives inside the Halyrd application code. It knows your strategy intent, your equity history, your current drawdown, and your evaluation rules. It is smart and context-aware, but it is also code written by humans — which means it can have bugs, and it depends on correct application state to make the right call.
Physics layer — TWAK guardrails asks: “Is this transaction physically permitted to exist?” It lives in the signing layer, outside the Halyrd application entirely. It enforces a fixed set of hard limits — which tokens can be traded, how large a single trade can be, how much daily volume is allowed, and how far slippage can go — regardless of what the application code says. Even if the rest of the agent is compromised, confused, or hallucinating, TWAK simply refuses to sign a transaction that falls outside those limits.
The point of having both is defense in depth. The Risk Engine catches almost all bad trades with full context. TWAK is the crude backstop that holds even if the Risk Engine has a bug. One-line version: the Risk Engine decides what’s smart; TWAK decides what’s possible.
Layout
The risk desk displays as two side-by-side columns.
Policy column (Risk Engine)
The left column shows the current state of your evaluation rules and a live log of every policy veto.
Active EvaluationConfig values:
| Rule | What it enforces |
|---|
| Max drawdown % | Hard ceiling on equity drawdown from peak; breach demotes to paper |
| Daily drawdown % | Per-UTC-day leash; breach locks live trading until the next UTC day |
| Consecutive loss limit | Stand-aside trigger after N consecutive losing trades |
risk_veto events list the most recent policy-layer blocks in reverse-chronological order. Each entry shows:
- Timestamp
- Rule name that triggered the veto
- Plain-English reason (e.g. “Would breach daily drawdown limit — 7.9% used of 8.0% allowed”)
- Reference to the order that was blocked
Physics column (TWAK guardrails)
The right column shows the fixed signing-layer constraints and a log of every transaction the TWAK layer refused.
Active TWAK configuration:
| Guardrail | What it limits |
|---|
| Token allowlist | The set of tokens the signer will sign transactions for. Always a superset of your active watchlist. |
| Per-trade cap | Maximum notional size of a single swap |
| Daily volume cap | Maximum total notional across all swaps in a UTC day |
| Slippage bound | Maximum price impact allowed on any swap |
twak_block events list the most recent physics-layer blocks, each showing:
- Timestamp
- Which guardrail was triggered
- Reason (e.g. “Per-trade cap exceeded — attempted 480againstcapof400”)
- Reference to the blocked order
To see the kill switch take effect in your own session, visit the kill switch action in Settings. After revoking, the kill switch state in the physics column immediately updates to reflect the revoked state.
Blocked orders log
Below the two columns, a single chronological feed combines every blocked order regardless of which layer blocked it. This gives you a unified timeline of every trade your agent tried to place but could not.
Each entry in the log is labeled by its source so you always know which layer fired:
| Label | Source |
|---|
| Policy veto | Risk Engine blocked the order before it reached the signing layer |
| Physics block | TWAK signing layer refused to sign the transaction |
| Quote rejected | The verified price quote failed validation before either risk layer evaluated the trade |
Quote rejections
Quote rejections are a third type of skip that appears in the blocked orders log. Before your agent evaluates whether a trade is worth taking, it fetches a verified executable price from the TWAK routing layer. If that price quote fails any of the following checks, the agent skips the trade and journals the reason rather than proceeding with an unreliable price:
| Rejection reason | What happened |
|---|
| Divergence | The verified quote deviated too far from the CMC mid price, suggesting abnormal market conditions |
| Stale | The quote was too old — the block it was based on is outside the freshness window |
| Insufficient liquidity | The quote reverted or showed impact too large to fill at a reasonable price |
Quote rejections are not bugs — they are the system working correctly. Your agent will never fall back to an unverified price. A rejected quote means the agent skipped that cycle and logged a SKIPPED entry in the journal. The position in a quote rejection is always zero: no capital was at risk.
Generating real events during normal operation
Both columns start populating as soon as your agent begins trading. You do not need to trigger any special mode or synthetic breach to see the risk desk fill up with real data.
The easiest way to generate risk_veto events quickly is to set a tight daily drawdown cap in your EvaluationConfig — for example, 3% instead of the Balanced default of 8%. With a tighter cap, normal intraday fluctuations will naturally produce policy vetoes that appear in the Policy column and the blocked orders log. When you are satisfied with the behavior you see, you can adjust the cap back to your preferred level in Settings.
twak_block events appear during live trading whenever the signing layer’s hard limits are tested. The most reliable way to observe them is to set a per-trade cap slightly below your typical position size, trade once, then restore the cap.
Changes to your EvaluationConfig create a new config version and take effect immediately. Each change is recorded in the Strategy Versions history with a timestamp. If you lower your drawdown caps for testing purposes, make sure to restore them before your agent’s next live trading cycle.
Kill switch
The kill switch is the fastest way to stop your agent from executing any further transactions. Activating it revokes your agent’s TWAK signing session immediately — the agent cannot sign a swap, a registration, or any other on-chain action until you restore the session.
The kill switch state is always visible in the physics column of the risk desk. When revoked, the column displays a clear Session revoked indicator. Your agent continues its paper-trading loop and journal entries; only real transaction signing is blocked.
To activate the kill switch, go to Settings → Kill switch and follow the type-to-confirm prompt.