# Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic

Source: [AI Engineer](https://www.youtube.com/watch?v=rbjWzZK2LU0)  
Feed7 permalink: https://feed7.dev/p/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-1sm80qu  
Published: 2026-08-22T14:00:06.000Z  
Trust: Source Linked (source_linked)

## Why Included

Production agents need bounded write authority, infrastructure-stamped identity, and human-only overrides; a broad token and tool list cannot control blast radius.

## Source Summary

A cleanup agent’s empty pipeline stage removed its filter, matching and deleting about **200 workloads** used by **20 engineers** in **90 seconds**. The proposed alternative treats authority as budgets across action volume, rate, reversibility, and visibility.

## Practical Implication

Classify write verbs by how failures surface, rate-limit every write, and keep overrides outside agent sessions. Record aggregate behavior with trip wires, size limits using an undo test, and let a trusted proxy stamp agent and session identity.

## Agent-Ready Context

A cleanup agent’s empty pipeline stage removed its filter, matching and deleting about **200 workloads** used by **20 engineers** in **90 seconds**. The proposed alternative treats authority as budgets across action volume, rate, reversibility, and visibility.

Classify write verbs by how failures surface, rate-limit every write, and keep overrides outside agent sessions. Record aggregate behavior with trip wires, size limits using an undo test, and let a trusted proxy stamp agent and session identity.

These are production safety primitives, not a guarantee against bad actions. Limits still need tuning by resource and namespace, while quiet or irreversible operations may require a separate human-held credential.

## Connected Context

Feed7 judgment across 545 accumulated Signals:

This sharpens least privilege into quantitative, runtime authority limits: an agent may hold a valid write capability yet still be prevented from acting too broadly, too quickly, or irreversibly. The deletion incident supplies concrete production evidence for external identity, rate limits, trip wires, and human-held overrides, while leaving resource-specific tuning and quiet destructive actions unresolved.

- [IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork](https://feed7.dev/p/it-admin-for-the-ai-workforce-sarthak-aggarwal-decawork-0oxlc5t) — Decawork establishes external identity and policy enforcement as security boundaries; this signal specifies budgets, trusted identity stamping, and trip wires that those boundaries can enforce.
- [Project-scoped Tokens](https://feed7.dev/p/project-scoped-tokens-1emgc6h) — Project-scoped credentials reduce where an agent can act, while action-volume, rate, and reversibility budgets further constrain what it can do inside that project.
- [Gemini API Managed Agents: 3.6 Flash, hooks, and more](https://feed7.dev/p/expanding-managed-agents-gemini-api-3-6-flash-hooks-0xce1pm) — Gemini’s token caps bound model loops, whereas this signal shows that production safety also requires limits on side effects, aggregate writes, and reversibility.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: harness-engineering, tool-use, sandboxing

## Uncertainty

- These are production safety primitives, not a guarantee against bad actions. Limits still need tuning by resource and namespace, while quiet or irreversible operations may require a separate human-held credential.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.