A strong answer. “The framing I'd start from is that this layer exists because the strategy will be wrong, the market data will be wrong, and the connection will drop — and it has to fail safe in all three cases, not just the first.

Where it sits. In the order path, synchronous, before the gateway. Not asynchronous, not advisory. A risk check that can be bypassed under load is not a risk check. It has to be fast enough that nobody is ever tempted to turn it off, which in practice means simple arithmetic on pre-loaded limits rather than anything that touches a database in the hot path.

What it checks, cheapest first. Fat-finger bounds on price and quantity — is this order more than n% away from last traded, is the notional above a hard ceiling. Then position and exposure limits, gross and net, per instrument and per strategy. Then order rate limits, because a runaway loop sending a thousand orders a second is a more likely failure than a single wrong one, and exchanges have their own order-to-trade ratio penalties that you will breach first. Then daily loss limits, which is the one that actually stops a bad day becoming a fatal one.

The state problem, which is the hard part. The risk layer's view of your position has to be correct, and it gets its position from fills. If a fill is dropped or duplicated, the risk layer is now wrong and it will happily approve orders it should refuse. So it reconciles against the exchange's own position, continuously during the day and not just at close, and it goes flat-and-refuse on a mismatch rather than trusting itself.

Disconnection. If the market data feed goes stale, every price-based check is now evaluating against a stale price, which is worse than no check. So staleness is itself a condition: no tick in n milliseconds means reject new orders. And if the order gateway drops, the first thing on reconnect is not resuming — it is querying open orders and positions, because the exchange's view is truth and yours is a cache.

The kill switch should be at the gateway and it should cancel-on-disconnect, which most exchanges support natively. A kill switch that requires your process to be healthy in order to work is not one.

And I'd want the whole thing testable deterministically — a recorded market session replayed with injected failures — because you cannot test this in production and hope.”