Risk Management: Stops, Liquidation & Survival
Survival beats optimization every time — and the first thing that kills an autonomous trading agent is a stop placed on the wrong side of the liquidation price.
The agent that bled out quietly
Here is a pattern that shows up in production autonomous trading agents. The agent runs for three days without a closed position. Its capital is declining. Nobody notices for 24 hours because the logs show normal-looking activity: entry signals, order submission, position confirmations. What is actually happening: the agent is entering a position, the exchange rejects the stop order, the agent retries, the retry fails, and the position is automatically closed by the exchange's margin system with a small loss — plus fees on both ends. The agent re-enters. The cycle repeats.
The root cause is a stop that the exchange cannot honor, and the reason the stop is invalid is almost always the same thing: the stop was computed from a flat, assumed maintenance margin rather than the actual liquidation price as reported by the exchange.
This lesson is about the specific mechanics of why that happens, and the stack of risk controls that prevent it. Survival is not about having a good signal — it is about never letting a bad structural assumption kill a position that the market was actually favorable on.
Why the naive stop fails
On perpetual-futures exchanges, every position has a liquidation price — the price at which the exchange forcibly closes the position to prevent it from going negative. The exchange calculates this dynamically based on the actual maintenance margin requirement for the symbol and the position size.
The problem arises when an agent computes the stop price using a hardcoded or assumed maintenance margin rate. The assumed rate is almost always lower than the actual rate on leveraged or illiquid symbols. A lower assumed maintenance margin makes the estimated liquidation look further away from entry than it actually is — so the stop, computed with a safe buffer from the naive liq, ends up below (for a long) or above (for a short) the real liquidation price.
The exchange sees this as a nonsensical order: a long position's stop must be above the liquidation price (otherwise the stop would only trigger after the exchange already liquidated you). It rejects the order with an error that translates to "stop must be beyond liquidation."
The fix has three parts. First, use per-symbol maintenance margin rates from the exchange's API — never a hardcoded float. Second, cap effective leverage when entering a position, so the liquidation price stays far enough from entry that a valid stop is mathematically possible. Third, when placing or re-placing a stop, clamp its price to the LIVE liquidation price retrieved from the exchange plus a buffer — if the clamped stop ends up on the wrong side of entry, halt rather than submit.
The buffer itself is not a magic constant. A fixed 0.5% looks safe in a calm market and evaporates in seconds during a volatility spike, leaving the stop sitting right on top of liquidation. Scale it with recent volatility: a structurally sound buffer is roughly the larger of the symbol's recent intraday range and a floor (say 0.5%), so a normal move does not clip the stop and a violent one does not breach liquidation before the stop fires.
The full risk gate stack
A stop-vs-liq check is one gate in a larger sequence. Before any order reaches the exchange, an autonomous agent should run a layered stack of risk controls in a specific order — each gate catching a different class of failure.
The gate order matters. You check size before leverage because size determines notional exposure, which determines how tight the liquidation is. You check leverage before the stop-vs-liq gate because capping effective leverage is what creates the room for a valid stop. And you check max concurrent positions and daily loss cap last, because those are portfolio-level constraints that only make sense after the individual trade has passed its own gates.
The daily loss cap trap
The most commonly undercounted loss in autonomous agents is fees from aborted entry cycles. An agent that enters a position, fails to confirm the stop, and closes the position has still paid entry and exit fees — typically 0.04–0.1% of notional per side. If the daily loss cap only counts realized P&L from closed trades, a fee-bleeding loop runs completely unchecked.
The cap must count everything that reduces the account balance: closed P&L from completed trades plus all fees from aborted entry cycles. An agent that entered and aborted 20 times at $5 per cycle has lost $100 — regardless of what the closed-trade P&L register shows.
Size limits and leverage caps
Effective leverage — defined as notional position value divided by the margin used — should be capped per symbol, not just globally. Perpetual-futures exchanges may allow up to 10x or 20x leverage, but a higher leverage cap moves the liquidation price proportionally closer to entry. At 20x on a symbol with a 1% maintenance margin, the liquidation is effectively 5% from entry — leaving almost no room for a valid stop in the presence of any real volatility.
A practical effective-leverage cap of 5x–7x on most crypto perpetuals leaves enough room between entry and liquidation for a stop that is both exchange-valid and structurally meaningful. When adding a new symbol, set its maximum leverage explicitly and verify that a stop at the symbol's typical daily range does not conflict with the resulting liquidation price.
Build it: validate the stop
Implement the validation function that runs before every stop placement. It takes the proposed stop price and the live liquidation price from the exchange, clamps the stop to the safe side, and throws a halt signal if no valid stop can exist between entry and the liquidation boundary.
What clamping achieves
A stop-clamping function seems like a trivial fix. It is not. It is the enforcement point that keeps the agent's intent (protect this position) aligned with what the exchange can actually execute. Without it, the gap between the assumed liquidation and the real one will eventually be large enough that the proposed stop falls entirely outside the valid range — and the agent's error handling becomes the last line of defense.
When the clamp would push the stop past entry, that is meaningful information: the position's risk parameters are incompatible with the available margin. The right response is not to place a stop as close to entry as possible and hope. It is to halt, surface the position with its details, and let the operator decide whether to close it manually or accept a wider stop.
Survival is a choice that gets made in the code before the market has any say.