The last gate: designing due diligence into order execution
·Vectopian · algolab, execution, safeguards, risk, ruby, order-management
A trading idea is only half the job. The other half is getting the order into the market without shooting yourself in the foot, and knowing when to refuse.
This article walks through where order execution goes wrong, a three layer design that separates deciding what to hold, planning when to act, and gating whether an order may leave, the categories of safeguards that make that gate real, and the extra due diligence professional firms often put around it.
We learned this while putting strategies like Ruby into live markets. The daily decision can be careful. The timing layer can wait for a better price (Intraday fills and VWAP). None of that helps if the last step is careless.
So before talking about layers and checklists, it helps to walk the path of an order and notice where things go wrong.
Where execution goes wrong
Picture a simple day. Overnight, the system decides it wants more of a leveraged Nasdaq asset and less cash sitting idle. Mid morning, it tries to buy. What could break between that intention and a sensible fill?
The market looks ugly, but the order still goes out.
Buyers and sellers are far apart. Say you would pay $64.20 to buy while the best bid sits at $63.90. That gap is the spread. On a calm short term bond asset, a few cents of gap can already be a bad deal. On a noisy leveraged product, wider gaps are common, but “wider than we planned for” still means you are paying a tax the signal never earned. Without a check, the algo shrugs and buys anyway.
Price has jumped, and nobody asked why.
Yesterday the asset closed near $100. This morning it is printing near $97 after bad news, a few percent move before you have even finished your coffee. Maybe that is fine. Maybe you want a human (or a hard stop) before you add size into a gap. An unchecked system treats every print as normal.
Price does something strange: a flash crash, not a normal market.
Sometimes the tape does not merely gap. It collapses for minutes, prints prices that make no sense next to everything around them, then snaps most of the way back. That is a flash crash: a short, violent break in market structure rather than a calm reprice on news.
These events are rare. You still do not want to be in the crossfire while bids vanish, spreads blow out, and temporary prints look like “opportunities.” An algo that only sees “cheap” can buy into a broken book. An algo that only sees “sell everything” can dump into a vacuum. Either way, you are volunteering to be liquidity for someone else’s chaos.
Real world reminders help keep the imagination honest. On 6 May 2010, U.S. equities plunged and recovered within minutes in the episode still called the Flash Crash. On 24 August 2015, many ETFs printed far away from the value of what they held while the underlying market was already stressed. Single names have their own mini versions: a thin book, a cascade of stops, a print that looks like a typo until your fill confirms it was not. Rare does not mean imaginary. Diligence means refusing to treat those minutes as ordinary trading weather.
Yesterday’s plan trades today.
At 10:00 the system published “own 2,000 shares of Asset A.” At 11:00 that plan was replaced with “go flat.” A leftover instruction from the old plan still tries to buy. If nothing blocks stale instructions, you just bought into a decision you already cancelled. It is like a food delivery arriving for an order you voided an hour ago.
The same quiet asset gets traded again and again.
A short term Treasury ETF is meant to park cash, not become a pinball. One careful buy is enough for the day. A buggy loop that “tries again” every minute can nick it ten times before lunch. Each nick looks small. Together they are churn, fees, and a story you will hate explaining.
The order is too big for one bite.
The plan says move a large sum. The market is thin right now. Sending the whole size at once is like backing a truck into a narrow alley: you move the price against yourself. Caps on how much you send in one go are not pessimism; they are manners.
You sell what you do not own, or buy before you have cash.
The plan wants to rotate out of one asset and into another. If buys fire first, you may borrow risk you did not mean to take. If sells fire for more shares than you hold, you invent a short position by accident. Family strategies that are meant to stay long only do not get to “discover” shorting at 10:17.
You ask for “whatever the market will give.”
A market order says: fill me now at any price. On calm names that can be fine. On fast, leveraged products, “any price” can be a souvenir. A limit order says: fill me only up to this worst price I accept. That single choice is already a form of due diligence.
The exchange is closed, the name is not meant to be traded, or the quote looks broken.
Trying to trade a signal only index ticker. Sending an order after the close. Believing a bid that sits above the ask (a crossed book, the market’s version of a typo). These are not clever edge cases. They are “please do not press Go.”
None of these require a computer science degree to understand. They are the same instincts a careful human trader already has, written down so a machine cannot skip them when it is in a hurry.
That is the design problem: what must be true before money is allowed to move?
Three jobs, three layers
If one piece of software decides what to hold, when to trade, and whether the order may leave, every bug has a direct line to the broker. We prefer three clear jobs.
Layer 1: Decide what to hold
Once a day (on a schedule we chose on purpose), the system publishes a target book: these names, these sizes. Think of it as writing tomorrow’s shopping list, not walking into the shop yet.
It does not place orders. If the data is still warming up, it keeps yesterday’s list rather than inventing a new one half ready. If there is effectively no capital left to risk, it can say “hold nothing” and let the rest of the system unwind. Questions like how much risk, how much cash buffer, and whether spare cash sits in a bond asset live here. The next layers are not allowed to quietly rewrite that story.
Layer 2: Plan when to act
During the session, the planner compares the target list to what you actually hold and figures out the next sensible steps: sell this, buy that, wait for a better moment, skip tiny noise.
It may check every minute. It still does not talk to the broker. It only prepares a request (an intent) and knocks on the last door. Good manners belong here too: sell before you buy when you are rotating, wait for a timing cue if you use one, and stop fussing once the book already matches the plan.
Layer 3: Gate whether the order may leave
This is the only door to the broker. Every order, ordinary plan trades and special maintenance alike, passes through it. The gate does not try to be clever about markets. It asks a colder question: may this leave?
That separation is itself a safeguard. Not a number on a dashboard. A rule of the house: the decision maker and the planner never get the keys.
Categories of safeguards
Once you have a last door, you still need a clear checklist. We group the checks so each one has a job.
1. Identity: is this still today’s decision?
Only the active plan may speak. If an instruction carries yesterday’s label, or no label at all, it dies at the door.
Concrete example: At open the plan said “buy the bond asset.” An hour later a new plan said “stay in cash.” A leftover buy request from the old plan arrives. The gate refuses it. Stale is not “close enough.”
2. Market structure: does the tape look trustworthy?
Is this name even allowed to trade in this system, or is it only for signals? Is the exchange open? Is the last price real? If there is a bid and an ask, are they the right way around? Is the spread inside what we allow for this name? Has price moved too far from yesterday’s close for us to act without pause?
Concrete example: A calm bond ETF normally trades with a very tight spread. Today the gap between buy and sell quotes is several times wider than usual. The gate blocks. You missed a fill; you also missed paying a bad tax.
Another: A leveraged asset gapped sharply from yesterday’s close. The signal may still like it. The gate can still say “not until this looks less like a free fall print.”
Flash crash: Price plunges far from the recent fair range, spreads explode, then the tape snaps back. The move is rare and not normal market behaviour. Deviation and spread checks exist so you are not forced to be liquidity in that crossfire.
Calm assets and wild leveraged assets do not share one patience setting. Tight rules for quiet names; more room for noisy ones, still finite. If a name is not on the approved list, it does not trade. Full stop.
3. Size and tempo: how much, and how often?
Even a fair price can be the wrong size, or the wrong number of trips to the well.
Concrete example: The plan wants a large purchase. The gate trims the order to a maximum size per send so one clumsy request cannot dump the whole truck on the market.
Another: The cash parking bond asset is allowed one successful order per day. A second attempt, even if “the loop meant well,” is not a shrug. It is a fire alarm: notify, stop, and get a human involved. Risk names might allow a couple of clips. Still not all afternoon.
A useful detail: the daily allowance is only spent when an order truly goes out. If a later check blocks the trade, you have not used up the day’s budget on a refusal.
4. Pricing policy: what is the worst price we accept?
We prefer limit orders: here is the worst price we will take. We do not ask for “anything the market will give.”
Concrete example: You want to buy. The gate places a limit a little above a fair middle price, enough to get done when the market is reasonable, not enough to chase a spike. On the way out, it floors the price to the exchange’s minimum tick so a fractional fantasy does not get quietly rounded into the wrong resting price at the broker.
Choosing that worst acceptable price before you send is already due diligence.
5. How loudly we fail: skip, block, or halt
Not every “no” should sound the same.
Skip or trim is soft. You asked to sell something you do not hold: ignore it. The size was too large: trim it and continue. Note it for later. The day goes on.
Block is firm. Spread too wide, gap too large, wrong plan label, broken quote. That order does not leave. The system can keep running.
Halt is loud. Something smells like a runaway (for example, blowing through the daily trade budget). Stop. Tell someone. Do not keep “trying.”
If everything is a halt, the system is fragile. If nothing is a halt, the checklist is decoration. Choosing the volume of each “no” is part of the design.
6. A paper trail that explains, but does not steer
A gate that cannot explain itself is superstition. Every attempt should leave a short story: what we tried, what the quotes looked like, why we allowed or refused, what price we asked for.
Blocks and stops deserve the same respect as fills. The diary is for learning and forensics. It should not quietly become a second brain that changes the plan. Holdings remain the truth of what you own; the log only explains how you got there, or why you did not.
What to keep in mind
A few principles survived contact with live sessions:
- Split the jobs. Decide what to hold, plan when to act, and only then ask whether the order may leave. If one box does all three, every bug owns the broker.
- Refuse stale instructions. An order without a living decision is not an order.
- Trust the market only after you check it. Spread, gaps, open hours, and “are we even allowed to trade this?” come before clever timing tricks.
- Tune the rules per instrument. A bond ETF and a 3× Nasdaq product are not the same animal.
- Prefer limits, and mean them. Decide the worst price you will accept before you ask for a fill.
- Name the kinds of “no.” Skip, block, and halt are different promises to the person on call.
- Spend daily budgets on real sends, not on refusals. Diligence should not punish you for being careful.
- Write everything down without letting the diary drive. Capture what left, and what did not.
What professional firms often add next
The gate in this article is the last door before an order leaves. Serious trading firms usually put more due diligence around that door, not instead of it. The aim is the same: stop a bad moment from becoming a live fill, and make sure someone can explain what happened afterward.
Pre-trade risk and capital. Before the broker is asked to do anything, the firm asks whether the book can absorb the trade. That includes buying power and margin, how large the name would become in the portfolio, sector or single-name concentration, and whether the trade would breach a mandate or a risk budget. A clean market quote does not rescue an order that the capital rules should have refused.
Compliance and restricted lists. Not every trade that is profitable on paper is allowed. Firms maintain lists of names that cannot be traded, products that are out of scope, and periods when certain accounts must stay dark. Short sale locate rules, wash sale concerns, and jurisdiction limits belong here. The gate’s job is mechanical refusal when the policy says no. In our own algos we take the same idea in a simpler form: some tickers are deliberately non-tradable (for example signal-only names used for indicators), and the system explicitly identifies what may be traded through an approved list. If a name is not on that list, it does not get a ticket, no matter how confident the signal sounds.
Broker, venue, and connectivity. Professionals care who will handle the order and whether the pipe to that broker is healthy. Best execution policy, approved venues, cancel-on-disconnect behaviour, and simple heartbeat checks sit beside the price and size rules. If the connection is sick, diligence is to wait, not to hope the next submit lands cleanly. We do not have the luxury of routing across many brokers. We use a single broker on purpose: one counterparty keeps tax reporting simpler and makes post-trade reconciliation far easier to trust. Connectivity diligence still matters; multi-broker complexity is a cost we choose not to carry.
Kill switches and human escalation. Size caps and daily trade budgets are local brakes. Firms also keep firm-wide or strategy-wide pauses: maximum daily loss, maximum order rate, and a hard stop on new risk after a drawdown threshold. Some exceptions require a human on the desk. The point is not bureaucracy. It is making sure a runaway loop meets a red handle someone can pull.
Change control for the live path. Guardrails only help if the wrong person cannot quietly retune them at 9:55. Professional shops treat live parameters and live code as controlled changes: review, staged promote from paper or small size to full size, and a rollback path when a release misbehaves. Diligence includes how the system was allowed to change, not only how a single order was checked.
Data integrity beyond a single quote. A bid and an ask are not enough if the feed is stale, the clock is wrong, or the symbol map points at the wrong instrument after a corporate action. Firms watch for silent data failure, sometimes across more than one vendor, so the gate is not asked to bless fiction. We use two data sources for redundancy for the same reason: if one feed lies or goes quiet, we still have another view of the tape before we trust an order path.
Post-trade cost analysis. Diligence does not end when the ticket comes back. Transaction cost analysis compares fills to fair references such as arrival price or VWAP, then feeds those lessons back into limit offsets, size caps, and timing rules. The paper trail is for forensics; the cost review is for improvement. We do not yet have a full reporting stack for this. We do collect the data so we never lose traction on what we did, and so a proper cost review can be built on facts rather than memory.
Operations and recovery. Someone must know what happens if the machine dies with orders working, how open orders cancel, and how broker positions are reconciled to the books at the end of the day. Settlement failures, cash availability, and custodian or prime broker health are dull until the day they are not. Operational diligence keeps a clever strategy from being undone by plumbing. We keep a clean restart path so the server can come back without drama: state recovers sensibly, the session can resume, and we are not left guessing whether the book and the broker still agree.
None of these layers replace a sound decision about what to own, or honest work on when to trade inside the day. They sit around the last gate so that when money finally moves, more than one kind of due diligence has already had its say. The quieter claim remains: before money moves, due diligence has already happened in layers, and the last door is allowed to say no.