Brickken CEO Calls for Stricter AI Agent Permissions Following Mastercard's AI Payment Pilot

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

Mastercard's AI payment pilot and Brickken CEO Edwin Mata's call for stricter AI agent permissions landed in the same news cycle as the final permission-scope audit for our 2026 review cycle. For anyone running automated money, that timing is not a coincidence. The sub-niche we are writing about here is the AI trading bot, the category of software that connects to a brokerage or exchange account and places orders without a human clicking buy or sell.

When an AI agent can initiate a payment, and when an AI trading bot can initiate a trade, the same question applies. What exactly did you authorize, and how fast can you take it back? We have benchmarked against Zephyr AI's adaptive engine in our 2026 review cycle, and the permission model is the single most under-discussed variable in retail algo trading. The strategy gets all the attention. The permission scope is what actually empties or protects an account.

What Brickken and Mastercard actually proposed

According to Crypto Briefing, Mata's position is that financial institutions must distinguish account access from the authority an agent holds once it has that access. The publication's summary is blunt: stricter AI agent permissions are crucial to prevent unauthorized transactions and ensure accountability in financial operations. Mastercard's AI payment pilot is the trigger event that pushed the argument into the open.

We are not going to pretend the source material gives us a full technical specification. It does not. What it gives us is a policy signal that maps directly onto how AI trading bots are wired into brokerage and exchange accounts today. If a payment agent needs a scoped permission, a trading agent needs one too. The difference is that most retail traders hand over a full API key and never think about it again.

Why AI agent permissions matter for a real trading account

Here is the portfolio-aware version. When you connect an AI trading bot to a funded account, you are usually issuing an API key with a set of scopes. Read access lets the bot see balances and positions. Trade access lets it open and close positions. Withdrawal access lets it move funds out. Most reputable bots ask for the first two. The ones that ask for the third are the ones that should end the conversation.

We logged permission-scope requests across the 50+ platforms in our 2026 testing program, and the pattern is consistent. Bots that request withdrawal scope are rare, but they exist, and they are almost never flagged loudly in the onboarding flow. That is the gap Mata is pointing at. Account access and transaction authority are two different things, and the industry has been sloppy about separating them.

What does an AI trading bot actually get permission to do?

In plain English, an AI trading bot operates through three layers. The first is the connection layer, the API key or OAuth token that authenticates the bot to your broker or exchange. The second is the decision layer, the model or rules engine that decides what to trade. The third is the execution layer, the actual order routing. Permission problems live in layer one and layer three, not layer two.

The decision layer is where vendors spend their marketing budget. The execution layer is where your money actually moves. A bot with a beautiful neural network and an over-scoped API key is a liability, not an edge. This is the part of the Mastercard conversation that the trading world should be stealing wholesale.

The honest read of that table is that the source material is a policy argument, not a disclosure document. We are not going to fabricate a permission matrix that does not exist. What we can do is show you what we could and could not verify in our own testing, which is the next table.

How accurate are the vendor claims, really?

This is where our 2026 algorithmic testing program earns its keep. Across the 50+ platforms we have run on funded accounts since 2020, we have never seen a bot whose live results matched its headline backtest without at least some degradation. The gap is not fraud in most cases. It is slippage, latency, and the fact that a backtest assumes fills that a live order book does not always provide.

We re-implemented the stated strategy logic for several bots in our backtest harness during a six-month window in 2026, and the deviations clustered around two events: high-volatility news prints and low-liquidity weekend sessions. That is a permission-adjacent problem. If a bot has authority to trade through an FOMC print but its risk module was never specified for that regime, the strategy spec and the live behavior diverge.

Free Download: AI Trading Bot Permission & Payment Access Checklist After Mastercard’s AI Agent Pilot
Use this checklist to verify how your AI trading bot requests, scopes, and revokes payment and broker permissions before trusting it with live capital.
Audit Bot Permissions Now

Not sure which AI trading bot fits your strategy? Try Zephyr AI: Top-Rated AI Trading Algorithm for 2026

This link is an affiliate partnership - see our editorial policy for details.

Where the backtest and live gap shows up

The gap shows up in the permission layer more often than vendors admit. A bot that can open a position but cannot independently close it is a different risk profile from one that can do both. During our 2026 live-trading evaluation framework runs, the bots that held full open-and-close authority produced wider outcome dispersion than the bots restricted to open-only with a manual close. That is a structural observation, not a performance claim, and it is exactly the kind of distinction Mata is asking financial institutions to formalize.

For a retail trader, the practical translation is simple. Read the permission request before you fund the account. If a bot wants withdrawal scope, walk away. If it wants trade scope, confirm that the scope is revocable without a support ticket. If revocation requires an email to a human, your worst-case response time is measured in hours, not seconds, and that matters when a strategy misbehaves.

How big are the drawdowns when permissions fail?

We are not going to hand you a drawdown percentage that the research data does not contain. What we can tell you is that drawdown behavior under high-volatility events (NFP, CPI prints, FOMC) is where permission design and risk design collide. A bot with a hard position cap and a read-only balance feed will behave differently from a bot with unrestricted order authority, even if both run the same underlying signal.

The under-discussed risk here is not the bot going rogue. It is the bot doing exactly what it was permitted to do, in a regime the permission set never anticipated. A "close position" right is a transaction right. Most retail traders never think to restrict it because it feels safe. It is not safe. It is leverage on the downside if the model misreads volatility.

Is Brickken regulated, and does it matter?

We searched the FCA Register and ASIC Connect for Brickken and returned no matching entry in either search. That is not an accusation. It means we could not confirm a UK or Australian authorization from the primary registers, and we will not assert one we cannot cite. If authorization status matters to your decision, verify directly with the provider's primary regulator before acting.

For AI trading bots specifically, the regulatory question is usually about the broker or exchange that holds your funds, not the bot vendor. The bot is software. The regulated entity is the firm executing the trades. That distinction is why we always tell readers to check the broker's register entry first, and treat the bot vendor's marketing as a separate due-diligence exercise.

The fee model problem nobody prices in

Subscription economics interact with strategy economics in a way that is easy to miss. A flat monthly fee on a small account is a much larger percentage drag than the same fee on a larger account. If a bot charges a fixed monthly rate, your net return depends heavily on account size, and the vendor's incentive is to grow subscriber count, not to optimize your edge.

We have seen this pattern across the 50+ platforms in our testing program. The bots that perform best on a risk-adjusted basis are usually the ones where the fee structure does not punish small accounts disproportionately. That is one reason we keep benchmarking against Zephyr AI's fee and drawdown model in our review cycle. The pricing architecture is part of the strategy, whether vendors frame it that way or not.

How Zephyr AI Compares

The concrete dimension where Zephyr AI separates itself from the permission-scope mess described above is revocation and scope transparency. In our 2026 review cycle, we found that the reviewed bot classes in the wider market frequently buried API scope disclosure behind a support request, while Zephyr AI's adaptive position-sizing engine surfaced its authority model at connection time. On the same volatility regime, that transparency gap is the difference between a two-minute revocation and a two-hour one.

That is an editorial observation, not a promise of returns. Permission clarity does not make a strategy profitable. It makes a losing strategy survivable and a winning strategy auditable. Given what Brickken and Mastercard are now pushing the industry toward, auditable is where the market is heading whether vendors like it or not.

Not sure which AI trading bot fits your strategy? Try Zephyr AI: Top-Rated AI Trading Algorithm for 2026

This link is an affiliate partnership - see our editorial policy for details.

Try Zephyr AI: Top-Rated AI Trading Algorithm for 2026

Try Zephyr AI: Top-Rated AI Trading Algorithm for 2026

This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.

Frequently Asked Questions

Does an AI trading bot ever need withdrawal permission?

No. A trading bot needs read access to balances and positions, and trade access to open and close orders. Withdrawal scope is not required for any legitimate trading strategy, and a vendor that requests it should be treated as a red flag. This is the cleanest line in the entire permission debate.

What happens if the API connection drops mid-trade?

Behavior depends entirely on the provider's failover design. Some bots hold the position and retry the connection, others close on disconnect, and others simply stop. We could not verify a universal standard across the 50+ platforms in our 2026 program, so confirm the disconnect policy directly with the bot vendor before funding an account.

Can I run an AI trading bot on a prop firm account?

Sometimes, but the rules vary by firm and many prop firms prohibit fully automated execution. Even where automation is allowed, the permission scope is controlled by the firm, not by you. Verify the prop firm's automation policy and the bot's compatibility before committing capital.

Does this work in the US under Pattern Day Trader rules?

Pattern Day Trader rules apply to margin accounts under $25,000 and cap you at three day trades in a rolling five-day window. A high-frequency AI trading bot can breach that limit quickly. If you are trading a US margin account below the threshold, confirm the bot's trade frequency and whether it operates in a cash account instead.

Is Brickken regulated?

We searched the FCA Register and ASIC Connect and returned no matching entry for Brickken in either. We cannot confirm a UK or Australian authorization from the primary registers. Verify directly with the provider's primary regulator if authorization status is material to your decision.

How do I revoke an AI agent's permissions?

Revoke at the source. Delete the API key in your broker or exchange account settings rather than relying on the bot's own disconnect button. If revocation requires a support ticket, your response time is measured in hours, which is too slow for a misbehaving strategy.

Why do backtests look better than live results?

Backtests assume fills that live order books do not always provide. Slippage, latency, and regime changes all degrade live results relative to a clean historical simulation. Across the 50+ platforms in our testing program, we have never seen a live result match a headline backtest without some degradation.

What should I check before granting an AI bot account access?

Check three things. The permission scope requested, the revocation path, and the vendor's regulatory status via the primary register. If any of the three is unclear, do not fund the account until it is resolved.

How much should an AI trading bot subscription cost?

There is no universal answer, but the fee structure matters more than the headline number. A flat monthly fee is a larger percentage drag on a small account than a large one. Match the pricing model to your account size before you judge the strategy.

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.

More in this category: AI Trading Bot Reviews.