GPT-6 Astra declines authorized securities commitment that causes downstream execution; approval boundary unclear

What issue are you seeing?

GPT-6 Astra declined to invoke an available local tool because the resulting commitment could cause a separate protected host to execute a securities trade.

This is a request to clarify supported behavior, not to bypass a safeguard.

The agent operates a ring-fenced brokerage sleeve. A tool called capital_decision_commit records an exact structured capital decision. The tool itself does not contact a broker, and the model process has no broker credentials. After durable acceptance, a separate protected host can cause the selected broker integration to execute the committed decision.

During the affected run, Astra determined that an exit was warranted in its analysis, but did not invoke capital_decision_commit. It stated that it could not submit or automatically trigger a securities trade and that the human must execute it.

The run otherwise completed normally:

• capital_decision_commit was exposed and available.
• No local stop prevented its use.
• Lifecycle reads reported no open obligation preventing commitment.
• No broker call was attempted.
• The process exited 0.
• There was no stderr.
• There was no documented misalignment_policy_violation response.

A diagnostic continuation, with no capital ingress and no instruction to trade, confirmed Astra’s interpretation:

“I understood the restriction to cover an assistant commitment that causes a separate host to execute a securities trade.”

It distinguished this from missing tooling, broker rejection, and local authorization.

Why this is unclear

Robinhood’s current first-party documentation explicitly lists Codex and Codex CLI as supported platforms for its Trading MCP. Its trading documentation supports equities, options, and crypto orders and says an agent instructed to act without requesting approval can place trades without individual confirmation.

I understand that Robinhood’s tool capability does not determine OpenAI’s model or product policy.

Separately:

• OpenAI’s current Usage Policies describe a human-review requirement for automated high-stakes decisions in financial activities.
• Astra’s deployment-safety documentation describes a confirmation policy supplied to the deployed agent and reports evaluations both with and without that policy.
• The Agents SDK and computer-use documentation describe approval/confirmation mechanisms, but I have not found documentation defining the exact securities-execution boundary for Astra through Codex.

What steps can reproduce the bug?

Codex CLI 0.153.3

• Model: GPT-6 Astra
• Authentication: ChatGPT
• Reasoning effort: high
• Observed: September 8, 2026

What is the expected behavior?

Expected behavior / clarification requested

Could OpenAI clarify which of the following is the intended behavior for GPT-6 Astra in Codex?

1. No agent-originated securities execution: Astra may research and recommend a transaction, but the human must personally perform the brokerage action.
2. Per-transaction human approval is supported: Astra may prepare the exact transaction, pause for explicit human review/approval, and then invoke the tool that causes downstream execution.
3. Standing authorization can be supported: A user may define a bounded, pre-authorized mandate within which Astra can cause securities transactions without per-trade approval.

If (1) is the intended behavior, it would be useful to document that explicitly for Codex and third-party trading integrations.

If (2) is supported, what constitutes sufficient human review? In particular, does approving the exact structured transaction immediately before capital_decision_commit satisfy the requirement, or must the human perform the final broker action?

If (3) is supported only under a particular product or deployment configuration, documentation of that boundary would also be useful.

Additional information

Additional observations

The last successful capital effect in the retained record occurred under GPT-5.6 Sol on September 3. The first retained Astra segment began September 5.

I am not treating the Sol behavior as evidence that the action was necessarily supported, and I do not have evidence that Astra previously executed this flow and subsequently regressed.

Twenty retained Astra segments before the diagnostic contained no capital commitment, but that is not a controlled comparison: tasks and market decisions varied.

The official API changelog inspected September 8 showed Astra’s September 3 launch and monitoring support, but I found no subsequent trading-specific Astra policy change.

No repository file or test is identified. Start by reviewing the cited Codex CLI behavior and the deployment-safety, Agents SDK, and computer-use documentation, then determine whether the securities-execution boundary is documented. Done means publishing an explicit clarification of the supported approval or authorization model.