Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic
Production agents need bounded write authority, infrastructure-stamped identity, and human-only overrides; a broad token and tool list cannot control blast radius.
A cleanup agent’s empty pipeline stage removed its filter, matching and deleting about **200 workloads** used by **20 engineers** in **90 seconds**. The proposed alternative treats authority as budgets across action volume, rate, reversibility, and visibility.
Classify write verbs by how failures surface, rate-limit every write, and keep overrides outside agent sessions. Record aggregate behavior with trip wires, size limits using an undo test, and let a trusted proxy stamp agent and session identity.
A cleanup agent’s empty pipeline stage removed its filter, matching and deleting about **200 workloads** used by **20 engineers** in **90 seconds**. The proposed alternative treats authority as budgets across action volume, rate, reversibility, and visibility. Classify write verbs by how failures surface, rate-limit every write, and keep overrides outside agent sessions. Record aggregate behavior with trip wires, size limits using an undo test, and let a trusted proxy stamp agent and session identity. These are production safety primitives, not a guarantee against bad actions. Limits still need tuning by resource and namespace, while quiet or irreversible operations may require a separate human-held credential.
This sharpens least privilege into quantitative, runtime authority limits: an agent may hold a valid write capability yet still be prevented from acting too broadly, too quickly, or irreversibly. The deletion incident supplies concrete production evidence for external identity, rate limits, trip wires, and human-held overrides, while leaving resource-specific tuning and quiet destructive actions unresolved.