Sachin Malhotra begins with an agent cleanup command that accidentally deleted hundreds of workloads after an empty filter matched everything. The incident illustrates why a broad access token is too binary: narrow scopes make agents useless, while wide scopes leave destructive loops unbounded.
The proposed alternative treats authority as a budget with several dimensions. Agents may perform actions that fail loudly, while silent or irreversible operations require a human. Every write receives a refillable rate limit, and aggregate trip wires reveal unusual behavior after cheap autonomous actions occur.
Sachin Malhotra uses an undo test to decide how much autonomy each operation deserves: can the agent restore the previous state, and how large is the impact if it is wrong? Recoverable low-impact changes can proceed, while higher-risk changes need a second key and an audit trail.
Text instructions explain intent, but deterministic infrastructure must enforce the boundary. A proxy holds real credentials, stamps every request with an identity the agent cannot change and lets downstream systems apply quotas, approvals, rate limits and alerts consistently across child processes.
Watch on YouTube