{"topic":"api-security","title":"api security","url":"https://theexchange.tech/archive/api-security","description":"Dispatches on api security for AI agents in financial services.","questions":[],"count":1,"startHere":[],"articles":[{"title":"The scoped key is the mandate: eToro wrote the agent's boundary in code, not policy","url":"https://theexchange.tech/articles/the-scoped-key-is-the-mandate-etoro-wrote-the-agents-boundary-in-code-not-policy","json":"https://theexchange.tech/articles/the-scoped-key-is-the-mandate-etoro-wrote-the-agents-boundary-in-code-not-policy.json","excerpt":"An eToro Agent Portfolio is a funded sub-account an agent reaches through a scoped API key — open, close, check balances, and nothing outside the sleeve. Wealth management spent this year writing AI policies. This venue wrote a constraint instead, and the difference is that a constraint binds on the days nobody is reviewing you.","publishDate":"2026-08-11","author":"Dean Whitfield","topics":["execution","delegated-trading","api-security","retail-investing","risk-controls","mandates"]}]}