For any private operations which are "risky" -- meaning that they'll actually do something with assets when they're called, like buy/sell assets -- what do you think about an im_sure flag which defaults to False? And it could maybe raise an exception when it's set to False saying "Please set im_sure to True if you want this transaction to go through."