Sachin Malhotra begins with an agent cleanup command that accidentally deleted hundreds of workloads after an empty filter matched everything. The incident illustrates why a broad access token is too binary: narrow scopes make agents useless, while wide scopes leave destructive loops unboundedAn AI agent destructive loop repeatedly performs a harmful state-changing action without effective stopping conditions..
The proposed alternative treats authority as a budget with several dimensionsAn AI agent authority budget bounds what an agent may do using limits across scope, rate, impact, cost and reversibility.. Agents may perform actions that fail loudly, while silent or irreversible operations require a human. Every write receives a refillable rate limit, and aggregate trip wires reveal unusual behavior after cheap autonomous actions occur.
Sachin Malhotra uses an undo test to decide how much autonomy each operation deserves: can the agent restore the previous state, and how large is the impact if it is wrongAgent blast radius is the maximum scope of data, systems, people, money, or other resources that an AI agent's error or compromise can affect.? Recoverable low-impact changes can proceed, while higher-risk changes need a second key and an audit trail.
Text instructions explain intent, but deterministic infrastructure must enforce the boundary. A proxy holds real credentialsA credential proxy holds real credentials and performs or signs authorized requests without exposing those credentials to the calling agent., stamps every request with an identity the agent cannot changeAn AI agent identity is a persistent, verifiable identifier used to attribute messages, actions, permissions, and history to an agent. and lets downstream systems apply quotas, approvals, rate limits and alerts consistently across child processes.
Watch on YouTube
