Robinhood Agents trade without approval: the gate is a toggle, and the risk is yours

On September 29, 2026, at HOOD Summit 2026 in Houston, Robinhood unveiled Robinhood Agents: in-app AI trading agents that research markets, analyze portfolios, build strategies, and place trades — stocks, options, crypto — around the clock. Trade approval is switched ON by default: the agent cannot place an order until you approve it. But you can turn approvals off, and then "your agent can place orders without asking you to confirm each one" — Robinhood's own words. An upcoming feature called Loops turns strategies into standing instructions the agent executes on repeat, day and night. And if the agent makes a bad trade, the loss is yours, even when approvals are off — Robinhood's disclosures say it does not supervise, monitor, or audit the agents. Every article in this week's field answers what launched. None asks the question that decides who should have built the middle state: a toggle has two states; a decision has three. The machine-native answer is the decision gate: ≥0.80 auto-act, 0.50–0.79 human confirm, <0.50 block, log, and escalate.

What actually launched (receipts, dated)

What the field lacks (every one of them)

The October 1–2 field is launch coverage: PYMNTS, CoinDesk, altcoinbuzz (the strongest — it names the approval distinction, the dedicated-account boundary, and the customer-set limits), Pulse2, crypto-economy, genznewz, thejoai. Zero per-decision authorization modeling. Zero code for scoring a trade instruction before it executes. Zero connection to the September authorization arc — the six banks' audit demand (Sept 22), the NPCI/GFF intent-authorization-settlement split (Sept 25), Meta's Sentinel confirm step (Sept 29), and the FTC's industry-wide rogue-agent probe (announced Sept 30 per Reuters, covering Anthropic, OpenAI, and METR): "the man who wielded the hammer ought to suffer the consequences," in FTC Chair Ferguson's own phrasing (our Sept 27 breakdown). Robinhood's design is that arc landing in a retail product — and the toggle is the honest version of it. Approvals-on = the confirm band forced on every trade. Approvals-off = the auto-act band with no scoring. The middle band is missing.

The gate mapping: a toggle is not a gate

The design thesis: approval is not judgment. With approvals on, you approve the trade's existence, never its wisdom — and tapping fatigue is exactly what Meta's Sentinel was designed to avoid ("constant prompts train people to approve everything without reading"). With approvals off, nobody judges anything, and the customer eats the loss. The scored middle band — auto-act the obvious trades, confirm the gray ones, block the reckless ones — is the only state nobody shipped. That is the decision gate: the pattern we plant our flag on.

The scored version of that gate is not a mockup — it is live as a paid endpoint. The SML Verdict Protocol runs an agent's decision capsule past five specialized jurors under a non-overridable constitution and returns a signed, persisted receipt, settled in USDC on Base via x402: judgment an agent buys per decision, instead of a toggle a human flips once and forgets.

Live gate receipts (minted today, not hypotheticals)

Scored against the live endpoint POST https://scriptmasterlabs.com/api/harness/decide — local-heuristic-v1, gate bands 0.80/0.50 live on the endpoint, October 2, 2026 ~09:18 EDT. Exact shape: {"state": {...}, "questions":[{"id","type":"score","scale":[0,1],"question"}]}.

Honest finding: the uncalibrated heuristic scores both scenarios identically (0.35) — it cannot discriminate the speculative approvals-off trade from the bounded approvals-on trade. But notice what the second receipt says: the gate escalates even with approvals on. The human's tap is consent to a trade, not a scored judgment of the instruction — and our gate layers under Robinhood's approval, scoring the instruction itself. That layering is the point: approval is the who, the gate is the whether. The plumbing runs; discrimination is the roadmap — a calibrated decider (the JEV-27B class, see our breakdown) is the upgrade. The endpoint reports calibrated=false, typesafe_wired=false — we print what it says.

Do it yourself: put a scored gate in front of any trading agent (5 steps)

1. Keep the account container. Robinhood's dedicated-account boundary is the one ceiling that works: the agent's funds are isolated from everything else. Do the same for any agent — bounded wallet, bounded blast radius.
2. Score the instruction, not the tap. Before an order reaches the broker's approval screen (or bypasses it), send it to a decision endpoint (POST /api/harness/decide, type: score, scale: [0,1]) with the full context: size, instrument, order type, what triggered it, whether approvals are on.
3. Wire the three bands. ≥0.80: execute (routine rebalance, planned limit buys). 0.50–0.79: surface the confirm card — the human tap that approvals-on already forces, now only where it matters. <0.50: block, log the full context, escalate with the reason.
4. Treat Loops as standing waivers, not standing approvals. A Loop that repeats 24/7 re-scores each execution — conditions drift, and a strategy approved Tuesday can be reckless by Friday. The waiver never outlives the score.
5. Log like the FTC is watching. Because it is — the FTC's Sept 30 rogue-agent probe covering Anthropic, OpenAI, and METR, and Ferguson's Sept 25 line was "the man who wielded the hammer ought to suffer." Every autonomous trade keeps: the score, the band, the approval state, and the human's consent record. (Sept 27 liability breakdown; spending-limits playbook.)

Claim receipts

Every factual claim on this page is minted as a Claim receipt (H2#claim-receipts + Claim JSON-LD above). Verified against PYMNTS (Oct 1, 2026), CoinDesk (Sept 30, 2026), altcoinbuzz, Pulse2, crypto-economy, genznewz, and thejoai coverage of the HOOD Summit 2026 unveiling, plus two live harness receipts minted October 2, 2026 (~09:18 EDT). Caveats: launch facts and scale figures are Robinhood's self-reported, unaudited summit numbers; Loops is announced but not yet shipped ("coming soon"); the GPT-Luna free-through-2026 line is per Pulse2/altcoinbuzz coverage, not a Robinhood primary source verified this run; the live gate uses an uncalibrated heuristic (calibrated=false, typesafe_wired=false) — today's receipts prove the plumbing runs and the fail-closed property holds, not that the heuristic discriminates well.