Give the Agent a Budget, Not a Token
AI Engineergo watch the original →
the gist
Stop granting agents god-mode tokens. Instead, enforce safety through asymmetric verbs, rate-limited write operations, and identity-stamping proxies that prevent agents from bypassing their own constraints.
The Breakthrough
Instead of managing agent permissions through static token scopes, developers should implement a budget-based system that enforces constraints on operations, volume, and recoverability.
What Actually Worked
- Asymmetric Verbs: Categorize operations by their failure mode. Grant agents access to verbs that fail loudly (e.g., unskipping a test, which triggers a red build) and keep humans in the loop for verbs that fail silently (e.g., skipping a test, which can hide production bugs).
- Rate-Limiting Ceilings: Apply a hard ceiling on every write operation. Configure these limits to refill automatically over time, allowing the agent autonomy within a defined blast radius without requiring manual ticket filing for quota increases.
- Trip Wires: Monitor aggregate behavior rather than individual actions. Use trip wires to detect when an agent's investigation threads exceed a baseline, allowing for iterative prompt adjustments based on real-world data rather than static allow lists.
- Identity Proxying: Force all agent requests through a proxy that stamps the agent's identity onto the call. This prevents the agent from spoofing its identity or modifying headers to reset its own rate limits.
Before / After
- Before: An agent, using a broad token, deleted 200 workloads in 90 seconds because a filter evaluated to null, impacting 20 engineers and destroying uncheckpointed training jobs.
- After: With rate-limited deletes and an undo-test policy, the same agent is capped at a fixed number of deletes per hour, and any operation that cannot be automatically rolled back requires a human-held second key.
Context
When agents are given broad access to production infrastructure, they often behave like junior engineers who are confidently wrong. The author argues that token-based access control is a boolean (yes/no) that fails to scale. By treating agent permissions like an onboarding checklist for a new hire, teams can build guardrails that bound the agent's power without rendering it useless.
Notable Quotes
- "A token is a boolean, a static list of scopes you hold or you do not."
- "A trip wire that nobody sees is practically useless."
- "Text shapes what an agent is trying to do and infra is bounding how wrong can it go."