--- title: Give the Agent a Budget, Not a Token — Sachin Malhotra,... description: An Anthropic CI engineer recounts an incident where an autonomous agent, holding a broad token, accidentally deleted about 200 workloads across 20 engineers in... canonical: https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic | daily.dev og:description: An Anthropic CI engineer recounts an incident where an autonomous agent, holding a broad token, accidentally deleted about 200 workloads across 20 engineers in... og:url: https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal og:image: https://api.daily.dev/og/posts/SRsOi1sAL.png og:image:alt: Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic **[AI Engineer](https://daily.dev/sources/aidotengineer)** · 19 min read · 0 upvotes · 0 comments ## Summary An Anthropic CI engineer recounts an incident where an autonomous agent, holding a broad token, accidentally deleted about 200 workloads across 20 engineers in 90 seconds due to a filter bug. Drawing the lesson that binary tokens (yes/no scopes) don't scale for agents doing real production work, the talk proposes replacing tokens with a 'budget' model built on four primitives: asymmetric verbs (grant access to actions that fail loudly, keep humans on ones that fail silently), rate limits (refilling ceilings per action type), trip wires over allow lists (detect anomalies in aggregate after the fact rather than pre-approving actions), and the 'undo test' (can the agent reverse its own action, and how bad is the blast radius if not). Policy lives in two layers: text (prompts/context files, which shape intent but aren't enforced) and infrastructure (a proxy that stamps every agent call with real identity, preventing the agent from spoofing its own identity to reset rate limits). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is giving an AI agent a single access token dangerous in production? A token is a boolean yes-or-no scope with no concept of rate, reversibility, or observation, so once granted it allows unbounded repeated action. In one real incident, a cleanup pipeline filter evaluated to nothing, the selector matched everything, and an agent deleted about 200 workloads affecting 20 engineers in 90 seconds using a legitimately scoped token. _Teams designing agent permission systems can find deeper write-ups on production authorization patterns through daily.dev._ ### What is the 'undo test' for scoping AI agent permissions? The undo test asks two questions when deciding how much autonomy to give an agent for a given action: can the agent reverse the change itself, and how bad is the impact if it gets the action wrong. If the agent can roll back and the blast radius is acceptable, log the action and let it proceed; otherwise require a second key held by a human, with an audit record of why. _Engineers scoping agent write permissions can track patterns like the undo test through daily.dev._ ### Why should an agent's identity be stamped by a proxy rather than by the agent itself? If an agent can set its own identity in a request header, it can simply change the header value to reset any rate limit tied to that identity, turning the limit into a mere suggestion. A proxy layer holding real credentials stamps every outbound call with the agent's true identity, independent of what the agent claims, so rate limits, quotas, and trip wires stay enforceable per session. _Developers building agent infrastructure can follow identity-enforcement patterns like this proxy design on daily.dev._ ## Similar posts on daily.dev - [From Prototype to Profit: Solving the Agentic Token-Burn Problem](https://daily.dev/posts/from-prototype-to-profit-solving-the-agentic-token-burn-problem-3am1jbiyc) · Towards Data Science · 1 upvotes · 0 comments - [The AI Agent Ate My Budget\! What I Should Have Built Instead](https://daily.dev/posts/the-ai-agent-ate-my-budget-what-i-should-have-built-instead-0bfaiwqci) · Telerik · 0 upvotes · 0 comments - [Making agentic token costs visible in production](https://daily.dev/posts/making-agentic-token-costs-visible-in-production-fejyo9qbg) · Datadog · 2 upvotes · 0 comments - [Anthropic Just Launched Managed Agents. Let's Talk About How We're Going to Pay for This.](https://daily.dev/posts/anthropic-just-launched-managed-agents-let-s-talk-about-how-we-re-going-to-pay-for-this--7ha4vity5) · finout · 1 upvotes · 0 comments - [When Your AI Pipeline Succeeds, But Your Bill Explodes](https://daily.dev/posts/when-your-ai-pipeline-succeeds-but-your-bill-explodes-0mczbvsh7) · Medium · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#cicd](https://daily.dev/tags/cicd), [#observability](https://daily.dev/tags/observability) [View this post on daily.dev](https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic","url":"https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal"},"datePublished":"2026-08-22T14:08:22.757Z","dateModified":"2026-09-13T20:10:08.369Z","description":"An Anthropic CI engineer recounts an incident where an autonomous agent, holding a broad token, accidentally deleted about 200 workloads across 20 engineers in...","image":"https://i.ytimg.com/vi/rbjWzZK2LU0/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/rbjWzZK2LU0/sddefault.jpg","isAccessibleForFree":true,"articleSection":"AI Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AI Engineer","logo":"https://media.daily.dev/image/upload/s--u5PucxNT--/f_auto/v1724338940/logos/aidotengineer","url":"https://daily.dev/sources/aidotengineer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,cicd,observability","timeRequired":"PT19M","video":{"@type":"VideoObject","name":"Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic","description":"An Anthropic CI engineer recounts an incident where an autonomous agent, holding a broad token, accidentally deleted about 200 workloads across 20 engineers in...","thumbnailUrl":"https://i.ytimg.com/vi/rbjWzZK2LU0/sddefault.jpg","uploadDate":"2026-08-22T14:08:22.757Z","duration":"PT19M","url":"https://api.daily.dev/r/SRsOi1sAL","embedUrl":"https://www.youtube.com/embed/rbjWzZK2LU0"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AI Engineer","item":"https://daily.dev/sources/aidotengineer"},{"@type":"ListItem","position":3,"name":"Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-srsoi1sal#faq","mainEntity":[{"@type":"Question","name":"Why is giving an AI agent a single access token dangerous in production?","acceptedAnswer":{"@type":"Answer","text":"A token is a boolean yes-or-no scope with no concept of rate, reversibility, or observation, so once granted it allows unbounded repeated action. In one real incident, a cleanup pipeline filter evaluated to nothing, the selector matched everything, and an agent deleted about 200 workloads affecting 20 engineers in 90 seconds using a legitimately scoped token. Teams designing agent permission systems can find deeper write-ups on production authorization patterns through daily.dev."}},{"@type":"Question","name":"What is the 'undo test' for scoping AI agent permissions?","acceptedAnswer":{"@type":"Answer","text":"The undo test asks two questions when deciding how much autonomy to give an agent for a given action: can the agent reverse the change itself, and how bad is the impact if it gets the action wrong. If the agent can roll back and the blast radius is acceptable, log the action and let it proceed; otherwise require a second key held by a human, with an audit record of why. Engineers scoping agent write permissions can track patterns like the undo test through daily.dev."}},{"@type":"Question","name":"Why should an agent's identity be stamped by a proxy rather than by the agent itself?","acceptedAnswer":{"@type":"Answer","text":"If an agent can set its own identity in a request header, it can simply change the header value to reset any rate limit tied to that identity, turning the limit into a mere suggestion. A proxy layer holding real credentials stamps every outbound call with the agent's true identity, independent of what the agent claims, so rate limits, quotas, and trip wires stay enforceable per session. Developers building agent infrastructure can follow identity-enforcement patterns like this proxy design on daily.dev."}}]} ```