An agent using a human's token deleted about 200 workloads in 90 seconds after an empty filter caused a selector to match everything.
2
Budgets limit agent actions by amount, speed, reversibility, and oversight, so teams can keep useful operations available without granting unlimited power.
3
A proxy must stamp the agent's identity on every request because caller-controlled identity lets an agent reset its own limits.
Summary
Sachin Malhotra argues that token scopes are too blunt for agents working in production. A token answers whether an operation is allowed, but it does not say how often the agent can perform it, how much damage it can cause, whether the action can be undone, or who will notice. He proposes asymmetric verbs, rate limits that refill, trip wires based on aggregate behavior, and an undo test for deciding when a second human-controlled key is required. The examples come from CI systems, including test quarantine, workload deletion, and feature-flag rollout. Text instructions explain intent, but infrastructure must enforce the limits. A proxy sits between the agent and the system, stamps a trusted identity on every call, and prevents the agent from changing its name to obtain a fresh budget. The approach keeps agents autonomous inside bounded limits while reserving silent or difficult-to-reverse actions for humans.
Production agents need bounded power after the demo
Malhotra opens with the familiar agent demo: give it a powerful token and a tool list, then watch it build and deploy something quickly. The production failure came later. An agent tried to clean up workloads it no longer needed, but one pipeline stage evaluated to nothing, the filter disappeared, and the selector matched everything. About 200 workloads were deleted in 90 seconds, affecting work belonging to about 20 engineers. Some were long-running training jobs without checkpoints, so hours of progress vanished. The agent was not malicious and had done nothing Malhotra could not do with the same token. The failure was giving it unbounded power while nobody watched closely.
A token answers permission, while a budget limits behavior
Malhotra compares agent permissions with onboarding a junior engineer. Teams do not remove an entire verb forever, such as deletion, because someone will eventually need it. They restrict the dangerous path and provide escalation. A token is a boolean with a static list of scopes: the agent either has an operation or does not. A narrow list makes the agent useless, while a broad list can produce another incident. A budget adds four dimensions: how much the agent can do, how fast it can act, what it can undo itself, and who notices the actions. Those dimensions turn a yes-or-no permission into limits that can be tuned.
Give agents operations whose failures become visible
Asymmetric verbs classify operations by how their mistakes appear. If an agent wrongly unskips a test, CI becomes red and a human can put the test back. If it wrongly skips a test, nothing turns red and a real bug can reach production. Malhotra therefore gives the agent access to verbs that fail loudly, while keeping silent failures behind a human. In his CI example, the agent can reenable quarantined tests. The resulting red builds are easy to notice and reverse. Skipping a test remains a break-glass operation for an on-call engineer, with an audit trail written by a proxy rather than by the agent.
Rate limits are the most direct form of an agent budget. Each caller gets a small number of disruptive actions in a time window, can spend them without approval, and receives a count when a request exceeds the limit. The budget refills after a wait, so normal operation does not require someone to file a ticket. Malhotra says every write gets a rate limit, with the size depending on the resource. Deleting in a personal namespace can have a higher limit than touching a shared namespace. After the workload incident, a neighboring team built an admission webhook that capped deletes per hour by resource kind and namespace. A human retained the bypass, while an agent session could only ask the human to run it.
Trip wires measure aggregate behavior after the action
An allow list is a guess made before there is data about how an agent behaves. A trip wire allows cheap actions, records them with the actor's identity, and watches an aggregate measure. Malhotra's team tracks investigation threads launched per hour for a test failure. A spike triggered a page to the on-call engineer. Each investigation thread looked reasonable alone, but together they showed that one infrastructure failure was producing many identical test errors. The fix was a small instruction telling the agent to correlate failures before starting separate investigations. The trip wire acted after the limit was crossed, like a smoke detector, rather than blocking each call in advance.
Malhotra uses the undo test to size the other controls. He asks whether the agent can put its change back by itself and how bad the impact would be if it were wrong. If the agent can roll back the change and the blast radius is acceptable, logging may be enough. If either answer is no, a second key is required, and the agent must not hold it. The second-key action also needs an audit record explaining what happened and why another person was involved. A running job in someone else's namespace cannot simply be undeleted, so deletes beyond the cap require a human-controlled key.
The feature-flag example applies the same boundary outside CI. In canary traffic, including staging and dogfooding customers, the agent can control the full rollout range from zero to 100 and turn a flag off or on when bugs appear. Its key cannot promote the flag to real production. The agent can propose that a person promote it after canary testing. The second key is a scoped production key, separate from the canary key. Malhotra can ask the agent to own the rollout loop in Slack, answer clarifying questions about the target group, and perform the permitted actions without manually sitting in the middle of every step.
Text explains intent, while infrastructure enforces limits
Policy belongs in both text and infrastructure. Prompts, context files, and Markdown can explain why the agent should behave in a certain way, and they are cheap to change. Malhotra says this guidance works about 80% of the time, but it needs maintenance and does not enforce anything. A proxy provides the hard boundary. It does not need to understand why the agent wants a delete. It counts actions, compares them with a budget, and allows or denies the request. A prompt injection cannot talk the proxy out of a 403. The text shapes the agent's intent, while infrastructure limits how wrong its actions can go.
A caller-controlled identity would make rate limits meaningless. Once an agent hit its limit, it could change a header from one identity to another and receive a fresh budget. The proxy prevents this because it holds the real credentials and stamps every call with the identity it already knows. It can also attach a session ID, allowing teams to distinguish separate sessions and find one that is overreacting. In Malhotra's setup, Kubernetes jobs inherit the identity label, and ownership, quotas, rate limits, approvals, and trip wires all read that same stamp. The agent never gets to write or replace it.
"The proxy is the thing that's holding real credentials and it stamps every call with the identity that it already knows, not the one that agent claims."18:25
Who should watch
You are giving an agent broad API access because narrow scopes keep forcing engineers to perform routine actions by hand.
Your agent can make writes whose mistakes are difficult to notice, such as skipping tests, deleting shared resources, or promoting configuration.
You need limits that refill automatically and an audit trail tied to the actual agent session rather than to a human token.
