Why trading is its own permission

The easy version of AI access is a single switch: connected, or not. It is easy because it moves the hard question, what may this thing actually do, onto the user, once, at the moment they are least equipped to answer it.

bubi splits it into five.

Reading is not building, and building is not trading

Your AI can be allowed to read your accounts and trades without being allowed to build anything. It can be allowed to build and simulate without being allowed to deploy. Deploying is separate again from placing an order.

Each grant is its own tick, each is withdrawable, and none of them implies the next.

Identity comes from you, not from the conversation

Every governed tool resolves who you are from your signed-in session. Nothing the AI types can change that. It cannot name a different account, and it cannot reach anything you could not reach yourself.

That is why the connector can be a single public URL without being a risk: the door does not take the caller’s word for who they are.

Every action leaves a row

Each attempt through the door writes an audit record carrying a correlation id, whether it succeeded or failed. A failure is as loggable as a success, which is the only version of an audit trail worth having.

You can read your own back. So can we, when you ask us what happened.

What a refusal looks like

A tool your AI has not been granted does not half-work. It fails closed, with a code, a correlation id and a plain reason, and the AI tells you what it was refused rather than quietly working around it.

That is deliberate. The failure mode to avoid is not an AI that gets blocked; it is an AI that gets blocked, does not say so, and improvises something adjacent.

And the part that does not change

bubi never holds your funds, and there is no path in the system that would let it. Your money stays at your broker or your prop firm, in the account you opened.