The API provides two major protections for market makers trading large amounts programmatically:

MMP Config
Cancel on Disconnect

MMP Config

This subaccount-wide setting sets max amount or delta limits per currency for each subaccounts. The matching engine will block orderbook crosses that would breach these limits as long as the mmp param is set in private/order and MMPs have been turned on via private/set_mmp_config.

There are 3 other benefits to marking your orders mmp and setting an mmp config:

Engine restart protection: upon engine restart, all orders marked as mmp=true will NOT persist, thus protecting against any engine downtime.
Margin efficiency: our risk engine will take your mmp limits into account when determining your open order margin.
Rate limit efficiency: orders with mmp=true have a 3x lower rate limit cost than normal orders.

Note: in addition to calling private/set_mmp_config, order params must also be set to mmp=true

Cancel On Disconnect

This subaccount-wide setting forces the WebSocket servers to cancel all standing orders for the market maker if the connection drops.

Note: we recommend setting both mmp=true and turning on Cancel On Disconnect for the most protection against system downtime.